Your Shop Chatbot Must Say It's a Bot: AI Act Article 50 for Shopware Merchants

• by Tobias Schäfer • 12 min read
#Shopware #Shopware 6 #Recht #E-Commerce #AI

If your shop has a chatbot that answers customers with an LLM, it has to tell them so. That has been the law since 2 August 2026, under Article 50 of the AI Act, and it applies to bots that were already live before that date too.

The Digital Omnibus on AI was widely read as buying everyone time. For high-risk systems it did. The transparency rules weren’t moved, so a chat widget that greets customers with “Hi, I’m Lisa, how can I help?” next to a stock photo of a smiling person has been a compliance problem for two months now.

This post covers what Article 50 requires from an online shop, who carries the duty when the chatbot is bought rather than built, and where AI shows up in a Shopware 6.6 or 6.7 installation. Status: 7 October 2026.

I’m a developer, not a lawyer, and this post is not legal advice. It’s my reading of the regulation, the Commission’s guidelines and what a handful of law firms have published. Several points are still open, and the guidelines themselves are non-binding. Check your own setup against the sources at the end, and have the legal assessment for your shop done by someone who is qualified and liable for it.

What the Digital Omnibus changed, and what it didn’t

The Omnibus is now Regulation (EU) 2026/1744. It was published in the Official Journal on 24 July 2026 and has been in force since 27 July. For shops, three changes matter:

  • High-risk systems under Annex III (credit scoring, recruiting and so on) now have until 2 December 2027, those under Annex I until 2 August 2028.
  • Providers of generative systems that were on the market before 2 August 2026 get until 2 December 2026 for the machine-readable marking of their output (Article 50(2)). Some older articles still say 2 February 2027. That was the Commission’s proposal, not the adopted text.
  • The SME fine cap now also covers small mid-caps.

Article 50(1), the chatbot disclosure, and Article 50(4), the labelling of deepfakes and certain texts, weren’t touched. The Commission’s guidelines on Article 50 (C(2026) 5054, published 20 July 2026) are explicit about it: the four-month grace period covers only the marking duty, and the disclosure for interactive systems “must be ensured as of 2 August 2026”.

What Article 50 requires from a chatbot

The rule itself is one sentence. Providers have to design AI systems that interact directly with people “in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious”. Article 50(5) adds that this has to happen “in a clear and distinguishable manner at the latest at the time of the first interaction”.

The guidelines fill in the rest, and they’re stricter than I expected.

Customer service and e-commerce bots are named as in scope, and so are voice assistants. Rule-based bots that only click through predefined answers are not, and neither are recommender systems or AI search that only finds products without generating text. If your support team uses AI to draft replies and a person reviews and sends them, that’s out of scope too. The mere possibility of a human stepping in, on the other hand, doesn’t take a bot out of scope.

The exception for cases where the AI nature is “obvious” won’t save a shop bot. It’s based on the average consumer from EU consumer law and is to be “interpreted restrictively”. The guidelines say the general awareness that chatbots exist “does not imply that they recognise them in interactions”, and they list “AI chatbots embedded in online platforms or assistance support tools (helpdesks)” as a case where the exception does not apply. A human profile picture makes it less obvious still. If your audience includes vulnerable people, and a consumer shop’s audience does, the exception “cannot be relied upon” at all.

As for the disclosure itself, the guidelines give a first-turn greeting that says the assistant is AI as the standard example, ideally combined with a persistent badge or “AI” label near the input field. The notice should sit close to the chat interface. These are explicitly insufficient on their own:

  • a mention in the terms and conditions, the privacy policy or other documentation,
  • a site-wide line like “Services on this website use AI”,
  • calling the bot an “assistant” without saying it’s AI,
  • “this system uses LLMs”,
  • invisible metadata or watermarks.

One prominent notice at the start of the session is “likely to suffice in most instances”. For complaints handling the guidelines expect periodic reminders during the conversation, which is relevant if your bot handles returns and complaints. And the bot has to answer truthfully when a customer asks whether it’s a person. Voice bots need a spoken statement at the beginning; a jingle or tone alone isn’t enough.

In practice, a greeting like this should do the job:

Hi, I’m the AI assistant of [shop name]. My answers are generated automatically. If you’d rather talk to a person, write “team”.

Plus a small “AI” badge in the chat header that stays visible. Drop the human avatar and the human first name. Neither is forbidden as such, but both work against the disclosure, and the guidelines say so.

If the bot can place orders or start returns on the customer’s behalf, it has to disclose both that it’s AI and on whose behalf it is acting.

Who is responsible: you or your chatbot vendor

Article 50(1) is addressed to the provider. That’s whoever develops an AI system, or has it developed, and puts it into service “under its own name or trademark”. The deployer, meaning you as the shop using the system, has no direct duty under 50(1). Some agency articles get this wrong when they say the merchant is “on the hook as a deployer”.

Who the provider is depends on how you got the bot.

You use a SaaS chat widget as delivered. The vendor is the provider and has to make sure the system informs users, according to the guidelines “irrespective of who the deployers” are. That’s good news on paper. In practice you configure the greeting, the bot name and the avatar. If you rename the bot “Lisa” and give it a stock photo, you’ve undone whatever the vendor built in. I’m not aware of any decision on who is liable then. I wouldn’t want to be the test case.

You built the bot yourself on an LLM API. Then you’re the provider. The guidelines have exactly this example: a company that “has developed an interactive AI system (e.g. chatbot) in-house and puts it into service in the Union for its own use and under its name or trademark”. The fact that OpenAI, Anthropic or Mistral supplies the model doesn’t change that. They’re providers of the general-purpose model, you’re the provider of the chatbot. The Austrian regulator RTR classifies its own Mistral-based chatbot the same way.

A white-label bot under your brand is probably a provider case too, but I haven’t found a solid source for it. Several blogs base it on Article 25, which is about high-risk systems.

Independent of the AI Act role, German competition law stays with you. Whether Article 50 is a market conduct rule under § 3a UWG, so that competitors can send a warning letter (Abmahnung), hasn’t been decided by any court. The guidelines also point out that consumer protection law applies regardless of whether the AI nature is obvious. A bot that passes itself off as human is a candidate for a misleading commercial practice either way.

Product descriptions and product images

Article 50(4) only requires labelling of AI text “published with the purpose of informing the public on matters of public interest”. The guidelines list “AI-manipulated text that is part of a company’s advertisement or product descriptions” as an example of what falls outside. The exception to the exception: claims about health, consumer safety or sustainability. If your AI writes that a product is “climate-neutral” or “free of harmful substances”, that text is closer to public interest, and the human review exemption only applies if someone actually checked the facts. Spell-checking or a quick approval click explicitly doesn’t count. (I wrote about generating product descriptions with AI earlier this year. The fact-checking step in there has turned from good practice into the thing that keeps you out of Article 50(4).)

Images are different. A deployer who uses AI to generate a deepfake has to disclose it, and the definition covers objects, including consumer goods. The guidelines draw the line at misleading: an AI-generated product image that makes the product look better or different than the real one is a deepfake. A real product photographed and placed on an AI-generated background isn’t, as long as it doesn’t mislead. Colour correction, background extensions and rescaling have only a “minor impact”. A realistic synthetic model presenting your product is a deepfake.

Content generated and published before 2 August 2026 doesn’t need retroactive labelling.

The machine-readable watermarks of Article 50(2) are the provider’s job, meaning the image generator, not the shop. If you use a third-party tool, you don’t have to watermark anything yourself.

Where AI runs in a Shopware shop

Shopware doesn’t ship a storefront chatbot. Its AI features fall into two groups, and only a few of them reach the customer.

The Copilot assistant in the Administration (from 6.7.1.0, including Community Edition) and the paid Shopware Intelligence+ add-on are admin tools. Customers never interact with them. The same goes for most of the classic AI Copilot features in the Commercial extension: product descriptions, customer classification, the export assistant, property extraction and Shopping Experiences content. They produce text that customers read, but as discussed above, product and marketing text is outside Article 50(4).

These Commercial features reach the storefront:

FeatureWhat the customer seesMy assessment
Search by contextA star icon next to the search field that opens a search wizardBorderline. The guidelines exclude AI search that only retrieves. If the wizard generates answers, treat it like a chatbot.
Search by imageUpload an image, get matching productsRetrieval, most likely out of scope
Review summaryAn AI summary above the reviewsNot public-interest text. I’d label it anyway, see below.
Custom checkout messageAn AI-written text on the order confirmation pageMarketing text, out of scope
Review translation”Translate review” buttonOut of scope

I couldn’t check what the Commercial extension shows customers for these, because its source is closed. In the Administration, Shopware itself warns the merchant that the review summary “can be inaccurate or misleading”. Showing customers an AI summary of what other customers wrote, without saying it’s AI, isn’t an Article 50 problem as far as I can see. It’s still a summary of reviews written by a machine, and I’d put a line of text above it saying so.

On the roadmap, Shopware has an item “Tag AI-Generated Images” for EU AI Act transparency, with C2PA metadata and configurable storefront notices. It’s not scheduled yet, and it covers images only. Until then, ACRIS sells a plugin for labelling AI-generated and AI-modified images.

Chatbot plugins: what to check

Most chatbots in Shopware shops come from the Store or are embedded third-party widgets. Their disclosure options vary a lot:

  • Biloba’s “All-in-One AI Shop Assistant” added an AI badge and a notice that answers come from an AI in version 5.22.0, explicitly referring to Article 50. It can be switched on and off per assistant, so check that it’s actually on.
  • Deepware AI Chat has a configurable greeting message but no dedicated disclosure setting. The greeting is where the disclosure goes.
  • Lime Connect (formerly Userlike) only embeds the widget in Shopware. Greetings and AI agents are configured on the Lime Connect platform, so that’s where you have to look.

If a plugin outputs its texts as snippets, you can adjust them under Settings > Shop > Snippets per language. If it has neither a setting nor a snippet for the greeting, the remaining route is a Twig override in your theme, and at that point I’d ask the vendor first. A vendor who hasn’t added a disclosure option two months after the deadline is telling you something.

Checklist

Use this as a starting point for the conversation with your lawyer, not as a substitute for it.

  1. List every place where an LLM talks to customers: chat widget, voice bot, WhatsApp bot, AI search, the email auto-responder you forgot about.
  2. Open each one in every storefront language as a customer would. Does the first message say it’s AI? Is there a visible label while chatting?
  3. Remove human names and human photos from bots, or make sure the AI disclosure is unmistakable next to them.
  4. Ask the bot “Am I talking to a person?” and read the answer.
  5. Check the vendor contract: who is named as the provider, and what disclosure functions are promised?
  6. If you built the bot yourself, you’re the provider. Document how the disclosure works and when it was added.
  7. Go through AI-generated product images. Anything that makes the product look different from reality gets a label or gets replaced.
  8. Check AI product texts for health, safety and sustainability claims. Those need a real fact check by a person.

The Bundesnetzagentur has been the competent authority in Germany since the KI-MIG came into force on 29 July 2026. Fines under Article 99(4) go up to €15 million or 3% of worldwide turnover (for SMEs, whichever is lower). I haven’t found a single public enforcement action on Article 50 anywhere in the EU so far. A competitor’s warning letter is the likelier first contact, and fixing a greeting text takes ten minutes.

Sources

Related Posts