The VIFLY guide France · European Union
A useful assistant, a clear framework.
Before adding a chatbot to your website or an agent to your team, define what it can read, answer and do. Visitors should understand whom they are talking to.
Sources checked on 23 October 2026
The short answer
Chatbots and business use
For systems intended to interact directly with people, Article 50 provides for information that they are interacting with AI, unless that is obvious in the circumstances. This duty addresses the provider; a business integrating the service should clarify responsibilities and check the information actually displayed, GDPR and permitted actions.
These guideposts distinguish the status of a rule; 'Pause and check' calls for review before acting.
Read, suggest, act: three access levels
Read
Authorised, separated sources.
Suggest
A verifiable response.
Act
Defined permissions and approvals.
From rule to practice
What does that look like in practice?
A frequently asked questions chatbot
The assistant answers your website visitors.
Check transparency at the start and data processing; test its answers against actual offers.
An agent can make unlimited purchases
It has a payment method and very broad instructions.
Reduce permissions and require appropriate approval before launch.
A policy with job-specific examples
The team learns what to send and when to request review.
Combine the policy with practical awareness work and a contact person.
Informing people at the start
Clearly identify the assistant and its artificial nature in the interface, at the latest on first interaction where the duty applies. A human name and photo should not imply a real adviser. A disclosure hidden in terms and conditions may not meet the need for immediate information.
State what the assistant can do, its limits and a way to reach a person. This is good service practice, adapted to sector duties. If you market the assistant under your name or change its intended purpose, check whether your role goes beyond that of a simple user.
Defining data and access
A chatbot may receive personal data spontaneously. Inform users about processing, limit requested information and organise retention, security and rights requests. Avoid requesting sensitive information unnecessary for the query.
Check provider contracts and settings, including possible reuse of conversations. In a knowledge base, separate public, internal and confidential documents: an agent's ability to read a file does not mean it should reveal it to everyone.
Limiting consequential actions
An assistant suggesting an email and an agent sending it do not present the same risk. List permitted actions, any limits, required confirmations and cancellation options. Provide appropriate approval for purchases, record changes and external messages.
Test errors, malicious instructions embedded in documents, out-of-scope requests and outages. Do not let the model invent a price, warranty, diagnosis or decision affecting a person. Plan human escalation and a service stop where needed.
A short policy people can actually use
Write down permitted tools and accounts, excluded data, outputs needing review and incident owners. Adapt examples to the job: a public draft, client file, job application or sales response needs different checks.
Support these rules with appropriate explanations and exercises. Article 4 requires measures supporting AI literacy; a signed policy alone does not replace that support. Keep versions and review guidance when tools, access or uses change.
Wording to get started
Disclosures to adapt to your case.
These examples are neither official forms nor a compliance guarantee. Check the wording, placement and display duration required. French statutory disclosures are retained in the examples.
Starting point for a chatbot greeting
You are interacting with an assistant using artificial intelligence. It can make mistakes. For consequential requests or to contact our team: [contact]. Information about your data: [link].
Text copied. Adapt it before use.Copy unavailable: select the text to copy it.
Before taking action
Your essential checks.
A preparation aid, with no automatic compliance verdict.
Getting to the point
Questions people often ask.
Is a disclosure in the terms enough?
Article 50 requires clear information at the latest on first interaction where the duty applies. A disclosure distant from the interface may therefore be insufficient.
Can we give an agent every internal document?
Define access according to need and authorised people. Check secrets, personal data, contracts and disclosure risks. Start with a limited, tested scope.
Sources and method
The sources behind the answers.
Editorial team: VIFLY. Documentary checks on 23 October 2026. This guide is an educational summary without individual legal validation. The links let you consult the text and its conditions.
- European CommissionAI Act — Article 50: transparency Legal text
- European CommissionGuidelines on transparency obligations Official explanation
- European CommissionAI Act — Article 4: AI literacy Legal text
- European CommissionEuropean artificial intelligence framework Official explanation
- CNILUsing a generative AI system: questions and answers Official explanation
- CNILAI: informing affected people Official explanation
- CNIL / CIANumAgentic AI and data protection — July 2026 Report / analysis
Understand, then practise
Clear rules. Useful applications.
Explore AI courses and VIFLY resources to build a more considered practice.