The EU AI Act: what it really means for your website

The AI Act is the first comprehensive law regulating artificial intelligence across the entire EU. It entered into force in August 2024 and has been applying step by step since. The idea behind it is actually very reasonable: the greater the risk an AI application poses to people, the stricter the rules.

The law therefore roughly distinguishes four levels. At the top are applications that are simply banned, such as systems that rate people by their behaviour and disadvantage them. Below that come high-risk applications, for example AI used to select job applicants or grant loans. Then come applications with transparency obligations, and at the bottom everything that poses hardly any risk.

The good news first: almost everything small and medium-sized businesses use on their website falls into the bottom two levels.

The rules didn't arrive all at once, but in stages. That caused a lot of confusion, because each stage triggered a new wave of articles. The key dates are:

• February 2025: banned applications are prohibited, and companies are expected to make sure their people are trained in using AI
• August 2025: obligations for providers of large AI models, meaning the companies behind ChatGPT, Claude, Gemini and co.
• August 2026: the transparency obligations apply, and these are exactly what affect many websites
• After that: the rules for high-risk applications follow with longer transition periods

So August 2026 is the point at which the law becomes very practical for many businesses for the first time. That's why we're getting questions about it right now.

When people chat with an AI on your website, they need to know. That's the core, as simple as that. Nobody should believe they're talking to an employee when in fact a program is answering.

In practice, a clear notice right in the chat window is usually enough, ideally in the very first message. A sentence like "You're chatting with our digital assistant" does the job. The only exceptions are cases where it's obvious to everyone that a machine is speaking.

Honestly, we'd consider this the right thing to do even without a law. Anyone who feels deceived because the friendly "Lisa" in the chat suddenly gives confused answers loses trust. And trust is what a website is there for in the first place.

This is where uncertainty is greatest, and also where there's the most exaggeration. Not every image an AI helped with needs a label.

A labelling obligation applies mainly to so-called deepfakes. These are images, videos or audio recordings that show real people, places or events so realistically that they could be taken for real, even though they aren't. A generated photo supposedly showing your team in front of the company building falls squarely into this category.

For texts, the line is drawn more narrowly. A label is required when an AI text is published to inform the public about matters of general interest and nobody has reviewed it editorially. If a person has read, edited and taken responsibility for the text, this obligation generally does not apply.

For a typical company website, that means:

• An AI graphic used as a mood image or illustration is generally not a problem
• A deceptively real photo of people or places that never existed like that should be labelled
• Texts you prepare with AI and then revise yourselves usually don't need a notice
• Automatically generated posts that go online unchecked are the case where you should look closely

Still, our advice is to be open when in doubt. A small notice harms no one, but an exposed deception does.

One point often gets lost in the whole discussion. Since February 2025, companies that use AI are expected to make sure their employees have sufficient knowledge of it. The law calls this AI literacy.

It sounds bigger than it is. Nobody requires a certificate for everyone who occasionally has ChatGPT rephrase a text. The point is that people know what the tools can do, where they make mistakes and which data you'd better not paste into them.

A short internal meeting, a few clear rules on one page and someone to ask are already a very good start for a small business. What matters is that you've thought about it and can show that if needed.

The fines mentioned in many articles really are high. For banned applications they reach up to 35 million euros or seven percent of global annual turnover, for breaches of the transparency obligations up to 15 million euros or three percent.

These figures are upper limits and are aimed mainly at large corporations. For small and medium-sized businesses, the law explicitly provides that their size is taken into account when setting the amount. That's not a free pass, but it's no reason to lie awake at night either.

Incidentally, for most businesses a different kind of damage is more realistic than a fine: customers who feel deceived and competitors who are happy to point it out.

You don't have to read any law for this. Simply go through your site once with these questions:

• Is there a chat where an AI answers, and does it clearly say that it's an AI?
• Are there photos of people or places that were entirely generated and look real?
• Are texts anywhere generated automatically and published without review?
• Do you use AI tools that process personal data, and is that stated in the privacy policy?
• Does everyone on the team know which AI tools they're allowed to use and for what?

If you feel good about all of these points, you're already well positioned for most requirements. Where you're unsure, it's worth taking a closer look. And for anything heading towards high risk, such as AI in hiring, you should get legal advice. We see this article as guidance, not legal advice.

We use AI ourselves every day and therefore asked early on what the law means for our own work. Our answer is pretty unspectacular: be open, let people keep the responsibility and don't show anything that doesn't exist like that.

On the websites we build, we show real people and real projects. If a client wants a chatbot, we build in the notice from the start instead of retrofitting it later. And texts that AI helped with never go online unread with us.

If you're unsure whether your site is fine, just send us the link. We'll look at it and tell you honestly whether there's anything to do, even if the answer is that everything is already in order.