A GDPR- and EU AI Act-compliant AI chatbot processes personal data on a valid legal basis and exclusively within the EU, transparently informs users that they are talking to an AI, and provides only traceable, source-based answers. In 2026, both frameworks will apply in parallel: the GDPR regulates the handling of personal data, while the EU AI Act (Regulation (EU) 2024/1689) regulates the use of the AI system itself. Anyone deploying a chatbot in customer service, HR, or sales must comply with both simultaneously.
This guide explains what this means in practice and provides a checklist to evaluate any vendor against.
At a Glance
Two regulatory frameworks, in parallel: GDPR (data protection) and EU AI Act (AI system) apply at the same time. One does not replace the other.
Most service chatbots are not high-risk systems under the EU AI Act. However, the operator remains responsible for classifying the specific use case.
Transparency obligation (Art. 50 EU AI Act): Users must be able to recognize that they are interacting with an AI.
Data location is critical: Processing outside the EU, for instance via US clouds, is vulnerable from a data protection perspective. In regulated industries and the public sector, it is often a disqualifying criterion.
Hallucinations are a compliance risk: Incorrect or fabricated information can violate liability and information disclosure obligations.
What to look for: Legal basis, EU hosting, DPA according to Art. 28, no training with your data, transparency labeling, deletion concept, and traceable answers.
What does "GDPR- and EU AI Act-compliant" mean for an AI chatbot?
An AI chatbot touches on two legal areas at once. It processes personal data such as names, inquiries, contact details, and chat histories, thereby falling under the GDPR. At the same time, it is an AI system that interacts with natural persons, and is therefore subject to the EU AI Act (Regulation (EU) 2024/1689).
Compliance therefore requires both together:
GDPR: Lawful, transparent, and purpose-bound processing of personal data, data minimization, data subject rights, data processing agreements, and security of processing.
EU AI Act: Risk-based obligations for the AI system, ranging from transparency and labeling to competence requirements, governance, and human oversight.
Both frameworks interlock. A chatbot can be hosted in a technically GDPR-compliant manner and still violate the transparency obligations of the EU AI Act. Conversely, it can be correctly labeled as an AI and still unlawfully transfer data to a third country.
The EU AI Act 2026: The Timeline for Chatbots
The EU AI Act has been in force since August 2024 and is being implemented in phases. Three points are essential for chatbots:
Prohibited practices and AI literacy are among the obligations that apply early on. Manipulative or unacceptable AI applications are prohibited; employees operating AI systems must possess sufficient AI literacy (Art. 4).
Transparency obligations (Art. 50) are key for dialogue-oriented systems: Users must be able to recognize that they are speaking with an AI and not a human.
The stricter high-risk obligations will take effect last. The Digital Omnibus (2026) adjusted requirements and deadlines; parts of these will only apply progressively until 2027/2028.
Even if individual deadlines lie further in the future, 2026 is the year in which companies should align their chatbots. Those who only establish compliance by the final deadline will be retrofitting data protection and transparency into an active system. This is more expensive and prone to errors than sound planning from the beginning.
Is an AI chatbot a high-risk system?
In most cases, no. A chatbot that answers recurring service, HR, or sales questions does not make automated decisions about individuals in sensitive areas and is therefore not a high-risk system within the meaning of the EU AI Act.
However, classification depends on the specific use case, and the operator is responsible for this (Art. 3 No. 4 EU AI Act). If you use a bot, for example, for pre-selecting job applications or for creditworthiness communication, the context of use can alter the risk classification. Therefore, clarify the purpose before going live.
“AI must be traceable, controllable, and subject to effective human oversight.”
Dr. Maximilian Panzner, CTO and Co-Founder at Mercury.ai
The Three Pillars of an EU AI Act-Compliant Chatbot
A compliant chatbot rests on three pillars directly derived from the regulation:
1. Transparency (Art. 50). Users must recognize that they are interacting with an AI, for example, through clear labeling and a highly visible bot icon. In the future, this will also include machine-readable metadata for AI-generated content and barrier-free accessibility according to WCAG.
2. AI Literacy (Art. 4). The people who operate and maintain the bot must understand what the system can do, where its limits lie, and when they need to intervene. AI literacy must be built continuously and remains an ongoing task.
3. Governance and Information Security. This is where the EU AI Act and GDPR interlock (Art. 5, 28, 32): documented responsibilities, data processing agreements (DPA), technical and organizational measures, audit trails, and effective human oversight.
GDPR Checklist for AI Chatbots
Every AI chatbot processing personal data should meet these criteria:
Legal Basis (Art. 6): A legal basis must exist for any processing, usually legitimate interest or consent. Clarify the basis on which chat histories are processed and stored.
Transparency and Information Obligations (Art. 13): Users must know which data is processed for what purpose. Privacy policy links should be placed directly at the chat window, accessible with a single click.
Data Minimization (Art. 5): The bot should only collect data that it actually needs for the request. "We store everything, we might need it later" is not a permissible principle.
Data Processing Agreement (Art. 28): A Data Processing Agreement (DPA) must be in place with the vendor. Check the list of sub-processors. The shorter and the more localized to the EU, the easier the proof.
Data Location and Third-Country Transfer (Art. 44 et seq.): If data is transferred to a US provider, you need a robust transfer mechanism. Processing exclusively within the EU avoids this risk entirely.
Special Categories (Art. 9): If the bot processes health, religious, or other sensitive data, higher requirements apply. When in doubt, the bot should avoid capturing such entries altogether.
Data Subject Rights: Access, rectification, and deletion must be practically executable, ideally with configurable retention periods and the option for users to delete their own data.
No Unreviewed Automated Individual Decisions (Art. 22): Decisions with legal effects must not be made solely in an automated manner. An escalation path to a human is mandatory.
No Training with Your Data: If the content of your conversations is used to train external models, you lose control. Compliant solutions exclude this contractually and technically.
Data Protection Impact Assessment (Art. 35): A DPIA is required if there is likely to be a high risk. A reputable provider will assist you with the necessary documentation.
Why US Cloud Chatbots Become a Compliance Risk
Many popular AI chatbots process data in US data centers or call the API of a US provider in the background. From a data protection perspective, this is the most critical issue: as soon as personal data enters a third country, you require a robust transfer mechanism and bear the risk if its legal basis falls away.
For regulated industries and the public sector, the data location is frequently a **knock-out criterion**. Data sovereignty through architecture solves this problem at its root: data that never leaves the EU prevents third-country transfer issues from arising in the first place.
Therefore, pay attention to both levels: the hosting location and the data flows during operation. A frontend hosted in Germany that queries a US API for every response is not data sovereign. For a deeper look at how data sovereignty can be achieved through architecture, check out the article on Chatbot Hosting in Germany.
Hallucinations Are Also a Compliance Issue
Compliance does not stop with data protection. If a chatbot invents information—for example, regarding contract terms, deadlines, or legal claims—this can violate information disclosure obligations and trigger liability. This is exactly what many companies observe when employees or customers use generic AI tools on their own: the answer sounds plausible, but it is incorrect.
The cause lies in the architecture. A pure large language model chatbot generates answers based on probabilities. It calculates the most likely wording without knowing the facts. A hybrid architecture, however, separates logic from wording. The facts come exclusively from verified, approved sources; the generative AI only handles the linguistic formatting. If the system does not find a proven answer, it handovers the case to a human in a controlled manner.
This approach significantly reduces the risk of hallucinations and makes every response traceable back to its source. This directly contributes to transparency and human oversight as required by the EU AI Act. You can read more about how this works technically under Mercury Intelligence and in the Knowledge Hub.
How Mercury.ai Implements GDPR and EU AI Act Compliance
Mercury.ai is the Conversational AI platform from Germany, designed to meet the requirements of both the GDPR and the EU AI Act (Regulation (EU) 2024/1689). The key building blocks:
Hosting exclusively in Germany (AWS Frankfurt,
eu-central-1). End-user data is processed exclusively there, with no third-country transfers. Encryption in transit and at rest, key management via AWS KMS and HSM, with customer-managed keys as an option.A single sub-processor (Amazon Web Services, Germany branch) keeps the processing chain short and DPA documentation simple.
European, self-hosted models. Mercury.ai uses licensed, self-hosted, and fine-tuned Mistral models. There are no API calls to external providers; the data remains in Germany and under control.
No training with customer data, no cross-client learning. Responses are generated exclusively from your verified, isolated sources; open-world knowledge is excluded.
Hybrid AI against hallucinations. The model orchestration separates facts from wording, verifies the source and permissions, and hands over to a human if no source is found. The risk of hallucinations is significantly reduced, and every answer remains traceable to its source.
Security and Governance. Separation of roles and tenants, two-factor authentication, full audit logging, regular penetration tests, and protection against prompt injection. The data centers used are ISO-27001 certified; Mercury.ai aligns itself with ISO 27001.
EU AI Act compliance based on the three-pillar model of transparency, AI literacy, and governance, documented in the EU AI Act Security Paper.
The fact that this model also holds up in highly regulated environments is shown by Volkswagen Bank: they use Mercury.ai to automate recurring customer inquiries around the clock in an industry where data protection and traceability are non-negotiable.
You can read about the approach to the EU AI Act in the EU AI Act Security Paper.
In 7 Steps to a Compliant Chatbot: The Vendor Checklist
Ask any chatbot vendor these seven questions before making your decision:
Where is the data processed, and where does the bot send data during operation? The answer should be: exclusively in the EU, without third-country APIs.
Who is listed as a sub-processor in the DPA? The shorter and more EU-focused the list, the better.
Are our conversations used to train external models? The only acceptable answer is: no, contractually and technically excluded.
How does the bot identify itself as an AI? Art. 50 requires that users are able to recognize this.
Where do the answers come from, and are they traceable to the source? Source binding is the most effective protection against hallucinations.
How does the handover to a human work? There must be a clear escalation path when the bot reaches its limits.
What documentation do we receive for DPIA, DPA, and EU AI Act evidence? A reputable provider proactively delivers these.
Anyone who receives clear, verifiable answers to these seven questions has the foundation for a chatbot that complies with both GDPR and the EU AI Act in 2026.
Frequently Asked Questions (FAQ)
Is an AI chatbot automatically a high-risk system under the EU AI Act?
No. A chatbot that answers recurring service, HR, or sales questions and does not make automated decisions about individuals in sensitive areas is generally not a high-risk system. However, the classification of the specific use case is the responsibility of the operator (Art. 3 No. 4 EU AI Act).
Do I have to inform users that they are chatting with an AI?
Yes. The transparency obligation under Art. 50 of the EU AI Act requires that users can recognize they are interacting with an AI system and not a human, such as through clear labeling and a recognizable bot icon.
Where can the data of a GDPR-compliant chatbot be stored?
Personal data should be processed within the EU. A transfer to third countries like the US is only permissible with a robust transfer mechanism and remains legally vulnerable. Processing exclusively within the EU, such as in Frankfurt, entirely avoids this risk.
Is a generic AI tool like ChatGPT GDPR-compliant in customer service?
Generic, publicly hosted AI tools frequently process inputs outside the EU and offer no control over data location, deletion, or training usage. They are usually not suitable for processing personal customer data without additional contractual and technical safeguards. An EU-hosted, source-bound platform is the secure path here. The ChatGPT case is explored in detail in the article Is ChatGPT in Customer Service GDPR-compliant?.
Do I need a Data Protection Impact Assessment (DPIA) for a chatbot?
A DPIA is required if the processing is likely to result in a high risk to the rights and freedoms of natural persons (Art. 35 GDPR). Whether this is the case depends on the use case and the categories of data processed. A reputable provider will assist you with the necessary documentation.
Who is liable if the chatbot provides incorrect information?
The deploying company acts as the responsible party to the customer. Therefore, an architecture that binds responses to checked sources is crucial, significantly reducing the risk of hallucinations and handing over to a human in case of uncertainty before incorrect information is delivered.
Conclusion: Compliance Belongs in the Architecture From the Start
In 2026, AI chatbots must comply with two regulatory frameworks simultaneously: the GDPR and the EU AI Act. Both can be complied with most reliably when data location, source binding, transparency, and human oversight are part of the architecture from day one. Businesses that systematically measure vendors against the checklist above will make a decision that also holds up for the later deadlines of the EU AI Act.
Would you like to know what a GDPR- and EU AI Act-compliant chatbot looks like in your company? Talk to us or download the EU AI Act Security Paper.
About the Author: Dr. Maximilian Panzner is CTO and Co-Founder of Mercury.ai. He holds a PhD in Computer Science from the CITEC Institute of Bielefeld University, where he researched multimodal machine learning and intelligent interaction systems. He has been working on Artificial Intelligence, human-computer interaction, and dialogue-oriented enterprise AI platforms for more than 20 years.
