A GDPR- and EU AI Act-compliant AI chatbot processes personal data on a valid legal basis and exclusively within the EU, transparently informs users that they are speaking with an AI, and provides only verifiable, source-based answers. In 2026, both regulatory frameworks apply in parallel: the GDPR governs the handling of personal data, while the EU AI Act (Regulation (EU) 2024/1689) regulates the deployment of the AI system itself. Anyone using a chatbot in customer service, HR, or sales must comply with both simultaneously.
This guide explains what this means in practice and provides a checklist against which you can evaluate any vendor.
At a Glance
Two regulatory frameworks, in parallel: GDPR (data protection) and the EU AI Act (AI system) apply simultaneously. One does not replace the other.
Most service chatbots are not high-risk systems under the EU AI Act. However, the deployer remains responsible for classifying the specific use case.
Transparency obligation (Art. 50 EU AI Act): Users must be able to recognize that they are interacting with an AI.
Data location is critical: Processing outside the EU, such as via US clouds, is vulnerable under data protection law. In regulated industries and the public sector, it is often a knock-out criterion.
Hallucinations are a compliance risk: Incorrect or fabricated information can violate liability and disclosure obligations.
What to look for: Legal basis, EU hosting, DPA under Art. 28, no training on your data, transparency labeling, deletion concept, and verifiable answers.
What Does "GDPR- and EU AI Act-Compliant" Mean for an AI Chatbot?
An AI chatbot touches upon two legal areas at once. It processes personal data such as names, requests, contact details, and conversation histories, thus falling under the GDPR. At the same time, it is an AI system that interacts with natural persons, making it subject to the EU AI Act (Regulation (EU) 2024/1689).
Compliance therefore requires both together:
GDPR: lawful, transparent, and purpose-bound processing of personal data, data minimization, data subject rights, data processing agreements, and security of processing.
EU AI Act: risk-based obligations for the AI system, ranging from transparency and labeling to AI literacy requirements, governance, and human oversight.
Both frameworks are intertwined. A chatbot can be technically hosted in a GDPR-compliant manner and still violate the transparency obligations of the EU AI Act. Conversely, it can be correctly labeled as an AI and yet unlawfully transfer data to a third country.
The EU AI Act in 2026: The Timeline for Chatbots
The EU AI Act has been in force since August 2024 and takes effect in phases. For chatbots, three points are central:
Prohibited practices and AI literacy are among the early obligations. Manipulative or impermissible AI applications are prohibited; personnel operating AI systems must possess sufficient AI literacy (Art. 4).
Transparency obligations (Art. 50) are core for conversational systems: users must be able to recognize that they are speaking with an AI and not a human.
The stricter high-risk obligations take effect last. The Digital Omnibus (2026) has adjusted requirements and deadlines; parts of these will only take effect in phases through 2027/2028.
Even if individual deadlines lie further in the future, 2026 is the year companies should align their chatbots. Those who address compliance only at the final deadline will have to retrofit data protection and transparency into an active system. That will be more costly and error-prone than a well-thought-out design from the start.
Is an AI Chatbot a High-Risk System?
In most cases, no. A chatbot that answers recurring service, HR, or sales questions does not make automated decisions about individuals in sensitive areas and is therefore not a high-risk system within the meaning of the EU AI Act.
However, the classification depends on the specific use case, and the deployer is responsible for this (Art. 3 No. 4 EU AI Act). For example, if you use a bot for pre-selecting job applicants or communicating creditworthiness, the operational context can alter the risk classification. Therefore, clarify the purpose prior to go-live.
"AI must be traceable, controllable, and subject to effective human oversight."
Dr. Maximilian Panzner, CTO and Co-Founder at Mercury.ai
The Three Pillars of an EU AI Act-Compliant Chatbot
A compliant chatbot rests on three pillars derived directly from the regulation:
1. Transparency (Art. 50). Users must recognize that they are interacting with an AI, for instance through clear labeling and an identifiable bot icon. Going forward, this includes machine-readable metadata for AI-generated content as well as accessibility compliant with WCAG.
2. AI Literacy (Art. 4). The individuals who operate and maintain the bot must understand what the system can do, where its limits lie, and when they need to intervene. AI literacy must be continuously developed and remains an ongoing task.
3. Governance and Information Security. This is where the EU AI Act and GDPR (Arts. 5, 28, 32) converge: documented responsibilities, data processing agreements, technical and organizational measures, audit trails, and effective human oversight.
GDPR Checklist for AI Chatbots
Every AI chatbot that processes personal data should fulfill these criteria:
Legal basis (Art. 6): A legal basis must exist for any processing, typically legitimate interest or consent. Clarify the basis on which chat histories are processed and stored.
Transparency and information obligations (Art. 13): Users must know what data is processed for what purpose. Privacy notices belong directly within the chat interface, accessible with a single click.
Data minimization (Art. 5): The bot should collect only the data it actually needs for the request. "We store everything just in case we need it" is not a permissible principle.
Data processing agreement (Art. 28): A Data Processing Agreement (DPA) must be in place with the vendor. Review the list of sub-processors. The shorter and more confined to the EU it is, the easier the verification.
Data location and third-country transfers (Art. 44 et seq.): If data is transferred to a US provider, you need a robust transfer mechanism. Processing exclusively within the EU completely eliminates this risk.
Special categories (Art. 9): If the bot processes health, religious, or other sensitive data, heightened requirements apply. When in doubt, it should not capture such input in the first place.
Data subject rights: Access, rectification, and erasure must be practically implementable—ideally with configurable retention periods and the option for users to delete their data themselves.
No unreviewed automated individual decision-making (Art. 22): Decisions with legal effects must not be made solely on an automated basis. An escalation path to a human is mandatory.
No training on your data: If the contents of your conversations are used to train third-party models, you lose control. Compliant solutions exclude this contractually and technically.
Data Protection Impact Assessment (Art. 35): If processing is likely to result in a high risk, a DPIA is required. A reputable vendor will support you with the necessary documentation.
Why US Cloud Chatbots Become a Compliance Risk
Many popular AI chatbots process data in US data centers or call the API of a US provider in the background. Under data protection law, this is the most critical point: as soon as personal data enters a third country, you need a resilient transfer mechanism and bear the risk should its legal basis fall away.
For regulated industries and the public sector, the data location is frequently a knock-out criterion. Data sovereignty by architecture solves the issue at its root: data that never leaves the EU does not raise the question of third-country transfers at all.
Therefore, pay attention to both levels: the hosting location and the runtime data flows. A frontend hosted in Germany that calls a US API for every response is not data sovereign. To learn more about how data sovereignty can be achieved through architecture, read our article on Chatbot Hosting in Germany. The article on AI in Citizen Services illustrates the role data sovereignty plays for municipalities.
Hallucinations Are Also a Compliance Issue
Compliance does not end with data protection. When a chatbot fabricates information—such as contractual terms, deadlines, or legal claims—this can breach disclosure obligations and trigger liability. This is precisely what many companies observe when employees or customers use generic AI tools on their own: the answer sounds plausible, but it is simply not true.
The root cause lies in the architecture. A pure large language model chatbot generates answers based on probabilities. It computes the most likely phrasing without knowing the facts. A hybrid architecture, by contrast, separates logic from phrasing. The facts stem exclusively from verified, approved sources; the generative AI is only responsible for the linguistic composition. If the system does not find a substantiated answer, it hands the case over to a human in a controlled manner.
This approach significantly reduces hallucination risk and makes every answer traceable back to its source. This directly contributes to the transparency and human oversight required by the EU AI Act. Learn how this works technically under Mercury Intelligence and in the Knowledge Hub.
How Mercury.ai Implements GDPR and EU AI Act Compliance
Mercury.ai is the Conversational AI platform from Germany designed to meet the requirements of both the GDPR and the EU AI Act (Regulation (EU) 2024/1689). The core components include:
Hosting exclusively in Germany (AWS Frankfurt,
eu-central-1). End-user data is processed exclusively there, without third-country transfers. Encryption in transit and at rest, key management via AWS KMS and HSM.A single sub-processor (Amazon Web Services, Germany branch) keeps the processing chain short and DPA documentation straightforward.
European, self-hosted models. Mercury.ai utilizes licensed, self-hosted, and fine-tuned Mistral models. There are no API calls to external providers; data remains in Germany and under control.
No training on customer data, no cross-client learning. Answers are generated exclusively from your verified, segmented sources; generic world knowledge remains excluded.
Hybrid AI to prevent hallucinations. The model orchestration separates facts from phrasing, verifies sources and permissions, and hands over to a human if a source is missing. The hallucination risk is substantially reduced, and every answer remains traceable back to its source.
Security and governance. Role-based access and tenant isolation, two-factor authentication, comprehensive audit logging, regular penetration testing, and protection against prompt injection. The utilized data centers are ISO 27001-certified; Mercury.ai aligns with ISO 27001.
EU AI Act compliance based on the three-pillar model of transparency, AI literacy, and governance, documented in the EU AI Act Security Paper.
That this model holds up even in strictly regulated environments is demonstrated by Volkswagen Bank: they use Mercury.ai to automate recurring customer inquiries around the clock in an industry where data protection and auditability are non-negotiable.
You can read about the approach to the EU AI Act in the EU AI Act Security Paper.
7 Steps to a Compliant Chatbot: The Vendor Checklist
Ask every chatbot vendor these seven questions before making your decision:
Where is data processed, and where does the bot send data during operation? The answer should be: exclusively within the EU, with no third-country APIs.
Who is listed as a sub-processor in the DPA? The shorter and more EU-focused the list, the better.
Are our conversations used to train third-party models? The only acceptable answer is: no, excluded both contractually and technically.
How does the bot identify itself as an AI? Art. 50 requires that users be able to recognize this.
Where do the answers come from, and are they traceable to the source? Source grounding is the most effective defense against hallucinations.
How does the handover to a human work? There must be a clear escalation path when the bot reaches its limits.
What documentation do we receive for DPIA, DPA, and EU AI Act compliance? A reputable vendor provides this proactively.
Those who receive clear, verifiable answers to these seven questions establish the foundation for a chatbot that meets both the GDPR and the EU AI Act in 2026.
Frequently Asked Questions (FAQ)
Is an AI chatbot automatically a high-risk system under the EU AI Act?
No. A chatbot that answers recurring service, HR, or sales inquiries and does not make automated decisions about individuals in sensitive areas is generally not a high-risk system. However, the deployer is responsible for the classification of the specific use case (Art. 3 No. 4 EU AI Act).
Do I have to inform users that they are chatting with an AI?
Yes. The transparency obligation under Art. 50 of the EU AI Act requires that users be able to recognize that they are interacting with an AI system and not a human, for instance through clear labeling and an identifiable bot icon.
Where may the data of a GDPR-compliant chatbot be stored?
Personal data should be processed within the EU. A transfer to third countries like the US is only permissible with a resilient transfer mechanism and remains legally vulnerable. Processing exclusively within the EU, for instance in Frankfurt, completely eliminates this risk.
Is a generic AI tool like ChatGPT GDPR-compliant for customer service?
Generic, publicly hosted AI tools often process inputs outside the EU and offer no control over data location, deletion, or use for training. Without additional contractual and technical safeguards, they are generally unsuitable for processing personal customer data. An EU-hosted, source-grounded platform is the secure choice here. For an in-depth look at ChatGPT, see our article Is ChatGPT GDPR-compliant in customer service?.
Do I need a Data Protection Impact Assessment (DPIA) for a chatbot?
A DPIA is required when the processing is likely to result in a high risk to the rights and freedoms of natural persons (Art. 35 GDPR). Whether this applies depends on the use case and the categories of data processed. A reputable vendor will support you with the necessary documentation.
Who is liable if the chatbot provides incorrect information?
The deploying company acts as the controller toward the customer. Therefore, an architecture that grounds answers in verified sources, substantially reduces hallucination risk, and hands over to a human when uncertain before false statements occur is essential.
Conclusion: Compliance Belongs in the Architecture from Day One
In 2026, AI chatbots must comply with two regulatory frameworks simultaneously: the GDPR and the EU AI Act. Both are most reliably observed when data location, source grounding, transparency, and human oversight are part of the architecture from the very beginning. Those who systematically evaluate vendors against the checklist above make a decision that will also withstand the later deadlines of the EU AI Act.
Want to know what a GDPR- and EU AI Act-compliant chatbot looks like for your organization? Talk to us or download the EU AI Act Security Paper.
About the Author
Dr. Maximilian Panzner
Chief Technology Officer @Mercury.ai
Dr. Maximilian Panzner is CTO and co-founder of Mercury.ai. He earned his doctorate in computer science at the CITEC institute of Bielefeld University, where he conducted research on multimodal machine learning and intelligent interaction systems. For over 20 years, he has been working on artificial intelligence, human-machine interaction, and conversational AI platforms for enterprise use.
