Does the EU AI Act Apply to My Website? A Scoping Self-Test for Small Business Owners

The EU AI Act (Regulation 2024/1689) is generating a lot of noise — and a lot of confusion. Some businesses are convinced it only affects tech giants. Others are worried every website in Europe needs a complete AI compliance overhaul. Neither is quite right. This article walks you through a clear self-test so you can find out exactly where you stand in under five minutes.

Bottom line up front: Most small business websites only face Article 50 transparency obligations. If your site has a chatbot, these obligations are real and have a concrete deadline. If your site has no AI features at all, the Act currently has almost nothing to say to you.

How the EU AI Act is structured

The AI Act uses a risk-based hierarchy. Understanding which tier you fall into determines what you need to do:

Prohibited AI (Article 5) — AI that is outright banned in the EU (social scoring, certain biometric systems, subliminal manipulation). Virtually no ordinary website falls here.
High-risk AI (Annex III) — AI used in hiring, credit scoring, critical infrastructure, medical devices, law enforcement, and similar sensitive decisions. Most small business websites are not in this category.
Limited-risk / Transparency obligations (Article 50) — AI chatbots, AI-generated content, and synthetic media used on websites. This is where the vast majority of small businesses sit.
Minimal risk — spam filters, basic recommendation engines, grammar checkers. No specific obligations.

The scoping self-test: five questions

Work through these five questions:

1.Do you target users in the EU (sell, serve, or communicate with EU residents)? If No → the Act likely does not apply to your website at all.

2.Does your website have a chatbot or automated conversational interface? If Yes → Article 50(1) applies: you must disclose it is AI before each conversation.

3.Does your website generate or publish text intended to inform the public about matters of general interest (news, public affairs)? If Yes → Article 50(4) text-labelling may apply.

4.Does your website publish deepfake-like images or video (realistic synthetic depictions of real people)? If Yes → Article 50(2) deepfake disclosure applies.

5.Does your AI system make significant decisions about people — hiring, credit, healthcare triage, law enforcement? If Yes → you may be in High-Risk territory (Annex III) and need a lawyer.

For most small business owners reading this: the answer to Q1 is Yes, Q2 determines whether you have concrete work to do right now, and Q3–Q5 are likely No.

Scenario A: Your website has no chatbot and no AI features

The EU AI Act's Article 50 obligations are triggered by using AI systems that interact with users. If your site is a static brochure, a simple WooCommerce shop with no AI features, or a blog without AI-generated content, you currently have no specific obligations under Article 50. You are not required to publish an AI statement simply because you have a website.

That said, it is worth checking regularly: many hosting providers and plugins quietly introduce AI features in updates.

Scenario B: Your website has a chatbot

This is the most common situation for small businesses with a customer service widget. Article 50(1) is clear: users must be informed before or at the start of the interaction that they are talking to an AI. A pure rule-based bot (fixed menus only, no language model) falls outside this, but virtually all popular chat platforms now use AI under the hood.

What you need: a visible disclosure in the chatbot's opening message. Details in our chatbot disclosure guide.

Scenario C: Your website uses AI-generated content

For commercial product descriptions, blog posts for marketing, or AI-written service pages, Article 50(4) does not require a per-article label. That obligation applies specifically to content that informs the public about matters of general interest — news, public discourse, political affairs — not ordinary business content.

A general AI transparency statement on your website is advisable and covers most scenarios without requiring per-piece labelling.

Scenario D: Your website uses AI images

The AI tool provider that generated the image carries the primary marking obligation. As a website deployer, your additional obligation is limited to deepfakes — realistic synthetic depictions intended to pass as genuine images of real people. Typical AI product photos or illustrations do not trigger the deepfake rule. More in our guide on AI image labelling.

What about the Digital Omnibus Act and 2027–2028 delays?

EU institutions provisionally agreed in May 2026 to delay some high-risk AI obligations to 2027–2028. This does not affect Article 50 transparency obligations. The 2 August 2026 deadline for chatbot disclosures and AI content transparency stands.

What you actually need to do

For the average small business website, compliance typically comes down to three actions:

Add an AI disclosure to any chatbot widget
Publish an AI transparency statement page (one page, plain language)
Consider whether any AI imagery requires additional labelling

That is it for most sites. The Legibright checker scans your site URL in seconds and tells you where you stand: legibright.eu.

This article is intended for general information purposes only and does not constitute legal advice. For advice specific to your situation, consult a qualified legal professional.