UK GDPR and AI chatbot disclosure: a checklist for small businesses (2026)
By Yevhen Lukyanov, founder of Fantastic AI Studio · Updated 26 September 2026
TL;DR — The UK has no chatbot-specific law, but UK GDPR's transparency rules mean people must be told clearly how an AI assistant handles their data. If people in the EU use your chatbot, the EU AI Act's Article 50 has also required you to tell them it is an AI since 2 August 2026. Ten steps cover both.
What UK law requires
A chatbot that collects names, emails, booking details or anything else about a person is processing personal data, so UK GDPR applies in full. The ICO's guidance says information about AI use must be clear and meaningful and explain the processing in everyday language, drawing on UK GDPR articles 5(1)(a), 12–15 and 22. It recommends a layered approach: a short notice at the point of interaction, with a link to fuller information.
Decisions matter as well as data. Since 5 February 2026, the Data (Use and Access) Act 2025's reforms to automated decision-making are in force. If a significant decision about someone — refusing a tenancy application, say — is made solely by automated means, safeguards apply, including the right to have a person reconsider it. The simplest approach for most small businesses is to keep a person in every decision that matters.
More detail is coming. The Data (Use and Access) Act also requires the ICO to produce a statutory code of practice on AI and automated decision-making; the duty came into force in May 2026, and the code is not expected to take effect until 2027.
Where the EU AI Act comes in
Article 50(1) of the EU AI Act requires that AI systems intended to interact directly with people are designed so that people are informed they are interacting with an AI — unless that is obvious. Article 50(5) says the information must be clear and distinguishable, at the latest at the first interaction. Under Article 2(1)(c), the Act reaches providers and deployers outside the EU where the AI system's output is used in the EU, so a Brighton hotel's chatbot answering a guest in Paris is in scope.
The EU's 2026 Digital Omnibus postponed several AI Act deadlines, but not this one: the Article 50 disclosure duties applied on schedule from 2 August 2026. Only the separate marking rules for AI-generated content from systems already on the market were pushed back, to 2 December 2026.
The checklist
| # | What to do | Where it comes from |
|---|---|---|
| 1 | Say it's an AI in the first message of every conversation | EU AI Act Art. 50(1) and (5); ICO transparency expectations |
| 2 | Link to your privacy information from the chat window | UK GDPR Arts 12–13 (layered notice) |
| 3 | Name the AI provider and other sub-processors in your privacy notice | UK GDPR Art. 13 (recipients) |
| 4 | Record your lawful basis for chat data — usually legitimate interests or taking steps towards a contract | UK GDPR Art. 6 |
| 5 | Ask only for what the task needs; no health or payment details in the chat | UK GDPR Art. 5(1)(c) data minimisation |
| 6 | Set and publish a retention period for chat transcripts | UK GDPR Arts 5(1)(e) and 13(2)(a) |
| 7 | Offer a person on request, and make the handover work | ICO guidance; good practice |
| 8 | Keep a person in any decision with significant effects | UK GDPR automated decision-making rules (DUAA 2025) |
| 9 | Sign a Data Processing Agreement with your chatbot vendor | UK GDPR Art. 28 |
| 10 | Keep logs, review conversations and pay the ICO data protection fee | UK GDPR Art. 5(2) accountability; Data Protection (Charges and Information) Regulations 2018 |
This is general information, not legal advice. If your chatbot handles special category data — health, for example — or makes decisions about people, take specific advice.
Our own AI policy follows these steps, and you're welcome to adopt it as a starting point.
Read our AI policy and templateSources
- ICO — Guidance on AI and data protection
- ICO — AI audit toolkit: transparency
- Arnold & Porter — The ICO's new statutory duty to produce an AI code of practice (August 2026)
- EU AI Act — Article 50: transparency obligations
- EU AI Act — Article 2: scope
- Cooley — EU AI Act transparency obligations take effect 2 August 2026