Plain-English guide
Do you have to tell customers
they're talking to a bot?
It's the question I get asked most often once someone has an AI assistant answering their enquiries. The answer people expect is a simple yes or no. The real answer is more interesting than that, and it ends with the same practical advice either way.
No single UK statute requires you to label a chatbot as AI. But UK GDPR requires transparency about personal data the bot collects, and consumer protection law prohibits misleading practices, so a bot that poses as a human is still risky. If you serve EU customers, Article 50 of the EU AI Act has required disclosure since 2 August 2026. One clear opening line satisfies all three.
Published
The short answer
In the UK, there is no law that says the words "you must label your chatbot as AI". If someone has told you otherwise, they are wrong, or they are talking about the EU.
But that is not the same as it being a free-for-all, and this is where most articles on the subject stop too early. Two bits of existing UK law can reach a chatbot that misleads people, neither of them written with AI in mind. And if any of your customers are in the EU, a specific legal duty has applied since August 2026.
So the honest position is: not explicitly required at home, genuinely required abroad, and unwise everywhere. Since the fix is one sentence, the legal analysis is more interesting than the decision.
At home
What UK law actually says
There is no UK AI Act. The UK regulates AI through the regulators and the statutes it already has, so the question becomes: which existing laws can a deceptive chatbot run into?
Consumer protection law
The Digital Markets, Competition and Consumers Act 2024 prohibits misleading commercial practices. A misleading action broadly covers giving false information, or presenting information in a way that deceives the average consumer, where it causes them to make a decision they would not otherwise have made. The Competition and Markets Authority can now enforce this directly and issue substantial fines without first going to court, which is a meaningful change from how consumer law used to work.
Nobody has yet tested this specifically on chatbots, so anyone claiming certainty is guessing. But you can see the shape of the risk. A bot that introduces itself as a named member of staff, lets a customer believe they have a commitment from a human being, and influences whether they buy, is sitting close to a practice the law already prohibits. A bot that says it is an assistant is nowhere near it.
UK GDPR
This one is not about the label, it is about the data. If your assistant collects a name, a phone number or details of a job, you are processing personal data and you owe the person transparency about it. That duty exists whether or not you tell them the thing collecting it is a robot. Most firms with a chatbot have not updated their privacy notice to mention it.
What is not law yet
You may see mention of a private member's bill on bot transparency, which would require operators to register and disclose. Private members' bills rarely become law, and this one has not. Treat it as a signal of direction rather than something to act on. The direction is clear enough anyway: nobody is legislating towards more secrecy about what is a machine.
Abroad
What EU law now requires
Here it is explicit. Article 50 of the EU AI Act requires that AI systems designed to interact directly with people are built so those people are informed they are dealing with AI, unless it would already be obvious to a reasonably observant and well-informed person. That has applied since 2 August 2026, and the European Commission began enforcing from that date.
The catch for UK readers is reach. The AI Act applies to businesses outside the EU when their AI system is offered into the EU or its output is used there. So a Cornish holiday let with a booking assistant answering enquiries from Germany is potentially in scope, while a domestic electrician taking calls from Bodmin is not.
Whether it catches you is worth thinking about properly rather than assuming.The full guide to whether the EU AI Act applies to your UK business works through the test.
Be careful with the "unless it's obvious" exemption. Assistants have got good. What is obvious to you, having built the thing, is frequently not obvious to a customer on a phone at nine at night. Relying on obviousness is a judgement call you would have to defend. Saying it plainly is not.
What a good disclosure looks like
It is one sentence, and it appears before the customer types anything. That is the whole job.
Works
"Hi — I'm the AI assistant for Trevithick Roofing. I can answer questions and take your details, and one of the team will pick this up in the morning."
Also works
"You're chatting with our AI assistant. Ask it anything — or say 'speak to someone' and we'll call you back."
Doesn't work
"Hi, it's Dave from the office, how can I help?" — with a line in the privacy policy saying some enquiries are handled by automated systems.
Note what is not required. You do not have to apologise for using AI, put a warning banner on your site, or make the assistant sound robotic to prove a point. Naming it is fine. Giving it a personality that matches how you talk to customers is fine, and works better. The only line is claiming to be a person.
Where firms get it wrong
In roughly the order I see it:
Disclosure buried where nobody looks
A line in the privacy policy, or small grey text under the chat window. The test is whether a customer knows before they start typing, not whether the information technically exists somewhere on the site.
A human name and no clue
Usually not malice — someone picked a friendly name in a settings box without thinking. But "Dave" with no qualifier is the version that carries actual legal risk, and it is a two-minute fix.
No way to reach a person
Customers will forgive an assistant that cannot answer something. They will not forgive being trapped with it. This is where complaints come from, far more often than from the AI itself.
A bot that improvises
An assistant running on a general model with no grounding in your actual services will invent prices, invent availability and make promises you did not authorise. You are liable for those. Disclosure does not protect you from it — building it properly does.
The bit everyone forgets
Labelling the bot and disclosing the data processing are two different obligations, and firms routinely do the first while missing the second.
If your assistant takes a name, a number, an email address or the details of a job, that is personal data. Your privacy notice needs to say that you use an AI assistant to handle enquiries, roughly what it collects, and what happens to it afterwards. One short paragraph. If the assistant is provided by a third party, that provider is processing your customers' data on your behalf, which is worth knowing before you find out the hard way.
More on the general picture inthe AI rules UK businesses actually need to follow.
What to do this week
- 01
Open your own chat window as a customer would. Do you know it's AI before you type? If not, that's the fix.
- 02
Check the name. If it's a human first name with nothing else, add "AI assistant" alongside it.
- 03
Add the escape hatch. A clear way to reach a person. This is the one customers actually care about.
- 04
Update the privacy notice to mention the assistant and what it collects. One paragraph.
- 05
Ask it three awkward questions. Price, availability, and something it shouldn't know. If it invents answers, that's a bigger problem than the label.
Twenty minutes, most of it on the last one. And the last one is the one worth doing properly, because disclosure protects your customers from confusion, but grounding protects you from being held to something a machine made up.
Where this comes from
- Section 226, Digital Markets, Competition and Consumers Act 2024 — misleading actions ↗
- Article 50, Regulation (EU) 2024/1689 — transparency obligations ↗
- European Commission — Guidelines on transparency obligations ↗
This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.
Straight answers
- Is there a UK law that says I must label my chatbot?
- There is no single statute that says "label your chatbot". But two existing bits of UK law can still reach you: UK GDPR requires you to be transparent about how personal data is handled, and consumer protection law prohibits misleading commercial practices. A bot that actively pretends to be a named human employee is doing something the law already frowns on, even without an AI-specific rule.
- Does the EU require it?
- Yes. Since 2 August 2026, Article 50 of the EU AI Act requires that people are informed when they are interacting with an AI system, unless it would already be obvious. If you serve EU customers, that is a legal duty rather than good manners.
- What if it is obvious it is a bot?
- The EU rule has an exemption where it would be clear to a reasonably observant person. The trouble is that assistants have got good, and what feels obvious to you as the owner is often not obvious to a customer at 9pm on a phone. Labelling removes the argument for the cost of one sentence.
- Where does the label have to go?
- Before the conversation starts, where someone will actually see it. An opening message from the assistant works well. Buried in a privacy policy does not count, because nobody reads it before typing.
- Can I give my assistant a name?
- Yes, and a personality too. Naming an assistant is not deception. The line is claiming to be a human being. "Hi, I’m Bud, the AI assistant for Trevithick Roofing" is fine. "Hi, I’m Bud from the office" is not.
- Does the bot need a route to a real person?
- Not strictly required by law in the UK, but it is the single thing customers care about most and it heads off complaints. It also does the disclosure job for you: offering a handover makes it plain that whatever they are talking to now is not one.
- What about the privacy notice?
- Separate duty, and easy to miss. If the assistant collects names, numbers, email addresses or job details, that is personal data being processed, and your privacy notice has to say so. Labelling the bot does not cover this; they are two different obligations.
- What happens if the bot gets something wrong?
- You are liable for what it tells your customers. A price it invents is a price you may have to honour, and an assurance it gives is one you gave. That is an argument for building assistants on your actual services and prices rather than letting a general model improvise.
Want an assistant that gets this right by default?
Every AI front desk I build ships with clear disclosure, a route to a real person, and answers based on your actual services rather than whatever a general model invents. It's not an extra — it's how they come.
Ask about an AI front desk