GDPR and the AI Act in 2026: what a small business actually needs if it runs a chatbot
Since August 2, 2026, new AI transparency rules apply. Who actually holds your customers' data, what a DPA is, and why backups aren't a technical footnote.
If you added an AI chatbot, an automated email assistant, or some other AI tool to your site over the past year, you probably haven't read the full rulebook behind it. You're not alone — but since August 2, 2026, part of that rulebook is already in force, not "coming soon." Here's what it actually means for a small business, without the legal jargon.
What took effect on August 2, 2026
The EU AI Act introduced a transparency obligation under Article 50: if an AI system talks directly to people, the person has to know they're talking to a machine. In practice that means:
- A visible indicator on the chatbot widget, or an opening message that says "I'm an AI assistant" — not an impersonation of a staff member.
- A clear path to a human — one click to a phone number, email, or "connect me to a person."
The obligation applies regardless of company size — 5 employees or 500, the rule is the same. For small businesses the penalties are, in practice, proportional, but the real risk isn't the fine: it's the trust you lose when a customer realizes the "advisor" on your site was a bot presented as a person.
GDPR didn't go anywhere
The AI Act added a new layer, but GDPR still applies in full — and for most sites, it's the more practical problem. If you connect a chatbot to OpenAI, Anthropic, or another provider, you're the data controller; the provider is the processor. That means:
- You need a data processing agreement (DPA) with the provider — not a formality, a requirement under GDPR Article 28.
- You need to know where the data is physically stored — inside the EU, or does it leave (and if so, under what safeguards, typically standard contractual clauses).
- If the provider uses subprocessors, their contract usually owes you advance notice before adding a new one — worth checking that clause instead of accepting it blindly.
If you're already using a ready-made widget (Intercom, Crisp, Tidio with an AI feature), check whether they publish a DPA — serious providers have one on their site, usually under "Legal" or "Trust."
Who actually holds your customers' data
The architecture you pick for your AI tool directly determines where your customers' conversations and inquiries end up.
| Option | Where the data goes | Control | Typical cost |
|---|---|---|---|
| Ready-made SaaS widget with AI (Intercom, Tidio) | The provider's servers, often outside the EU | Low — the provider's terms decide | ~€20–100/mo |
| Custom bot over an API (OpenAI/Anthropic) | At the model provider, contractually excluded from training on your data | Medium — you control what you send | Project cost + usage |
| Self-hosted / open-weight model | Your own infrastructure or chosen EU hosting | High — but you also own the security | Higher upfront cost |
For most small businesses, option 2 is the sensible balance: contractual protection from a serious provider, without the cost and complexity of running your own hosting.
Backups aren't a technical footnote — they're part of GDPR
GDPR Article 33 requires notifying the data protection authority within 72 hours of becoming aware of a data breach. That rule doesn't work if you have nothing to restore from to figure out what was actually affected.
The minimum every small business should have:
- The 3-2-1 rule — 3 copies of the data, on 2 different media, 1 off-site (a separate cloud or provider).
- Automatic, not manual, backups — a manual backup is a backup you forget right before you need it.
- A written incident plan — who calls whom, who notifies the authority, within how many hours — written before you need it, not during the panic.
Enforcement against small businesses so far is far from the maximum €20 million — administrative fines for minor violations typically run from a few hundred to a few thousand euros. But the fine isn't the main risk. Losing customer data with no backup is reputational damage that no payment fixes.
Practical checklist
- The chatbot/AI assistant on your site clearly identifies itself as AI, with a path to a human.
- You have a signed DPA with every provider that sees customer personal data.
- You know exactly where that data is physically stored.
- Automatic backups following the 3-2-1 rule, tested at least once — not just configured.
- A short written plan for what you do if you suspect a breach.
None of this needs a serious budget — it needs half a day of focus and a bit of order. It's the same logic behind the internal systems we build — for example Studio Botema's ERP keeps orders and customer data on its own infrastructure with clear control over who can access what, instead of scattered across five disconnected tools.
If you have an AI chatbot on your site or are considering adding one and aren't sure it's "by the book" — describe what you're using. We'll tell you honestly whether it's fine, or whether there's one or two things worth fixing right away.