{
  "schema_version": 1,
  "lang": "en",
  "page_type": "guide",
  "source_file": "transparence-chatbot-ia-belgique-en.html",
  "context_url": "https://hebora.be/contexts/transparence-chatbot-ia-belgique-en.en.json",
  "url": "https://hebora.be/transparence-chatbot-ia-belgique-en.html",
  "title": "AI chatbot in Belgium: transparency, GDPR and risks | Hebora",
  "meta_description": "AI chatbot on a Belgian website: first-contact disclosure, GDPR, sensitive data, retention, fines and a technical audit Check the practical steps.",
  "h1": "AI chatbot on a Belgian website: what must you disclose and check since 2 August 2026?",
  "lead_paragraph": "A useful chatbot can also collect free-form and sometimes sensitive stories. Since 2 August 2026, the AI Act adds transparency duties; the GDPR still applies to the data actually processed.",
  "structured_data_types": [
    "Article",
    "Organization",
    "ImageObject",
    "GovernmentOrganization",
    "WebPage",
    "CreativeWork",
    "BreadcrumbList",
    "ListItem"
  ],
  "entities_mentioned": [
    {
      "name": "Hebora",
      "type": "Organization"
    },
    {
      "name": "Belgian Data Protection Authority",
      "type": "GovernmentOrganization"
    },
    {
      "name": "FPS Economy Belgium",
      "type": "GovernmentOrganization"
    },
    {
      "name": "European Commission",
      "type": "GovernmentOrganization"
    }
  ],
  "headings": [
    {
      "level": 2,
      "text": "Users must know they are talking to AI at the first interaction"
    },
    {
      "level": 2,
      "text": "When and how to disclose an AI chatbot"
    },
    {
      "level": 2,
      "text": "The GDPR still applies behind the chat window"
    },
    {
      "level": 2,
      "text": "The AI Act ceiling is not a small website’s invoice"
    },
    {
      "level": 2,
      "text": "What Hebora tests on the published chatbot"
    },
    {
      "level": 2,
      "text": "Verified official sources"
    },
    {
      "level": 2,
      "text": "Check my chatbot before launch"
    },
    {
      "level": 2,
      "text": "Continue the review"
    },
    {
      "level": 3,
      "text": "AI-built website: what still needs checking in Belgium"
    },
    {
      "level": 3,
      "text": "Lovable Cloud and GDPR: who is responsible for what in Belgium?"
    },
    {
      "level": 3,
      "text": "Cookie banner in Belgium: what must be blocked before consent"
    }
  ],
  "sections": [
    {
      "heading": "Users must know they are talking to AI at the first interaction",
      "intro": "Article 50 of the AI Act requires providers to design direct-interaction systems so people are informed that they are interacting with AI, unless that is obvious. The website owner must also check its own duties as deployer and data controller."
    },
    {
      "heading": "When and how to disclose an AI chatbot",
      "intro": "The information must be clear, visible and accessible no later than the first interaction. A label such as “AI assistant” in the chat header and a short sentence before the input are stronger than a disclosure buried in general terms."
    },
    {
      "heading": "The GDPR still applies behind the chat window",
      "intro": "The Belgian DPA notes that free text makes it hard to predict all data people may send. Limit what is requested, warn against unnecessary sensitive information, define purposes, recipients and retention, and provide access and deletion paths."
    },
    {
      "heading": "The AI Act ceiling is not a small website’s invoice",
      "intro": "Article 99 provides up to €15 million or 3% of worldwide annual turnover for certain breaches of operator duties, including Article 50. For SMEs and start-ups, the applicable maximum is the lower of those amounts. Nature, severity, duration, responsibility, cooperation and corrective action are assessed."
    },
    {
      "heading": "What Hebora tests on the published chatbot",
      "intro": "Hebora performs technical audits and corrections. This content is not legal advice, does not certify compliance and does not replace a lawyer or DPO when your situation needs legal interpretation."
    },
    {
      "heading": "Verified official sources",
      "intro": "Sources checked on 15 August 2026."
    },
    {
      "heading": "Check my chatbot before launch",
      "intro": "Hebora tests first-contact disclosure, data sent, retention, deletion and human escalation, then delivers the evidence."
    },
    {
      "heading": "Continue the review",
      "intro": "The website owner must still check business disclosures, legal grounds, notices to individuals, cookies, security, supplier contracts and — when applicable — e-commerce and accessibility rules. The platform helps build; it does not make those decisions for you."
    }
  ],
  "proof_points": [
    {
      "label": "Article 50 transparency obligations apply.",
      "value": "2 August 2026"
    },
    {
      "label": "Information must be clear and accessible no later than the first interaction.",
      "value": "First interaction"
    },
    {
      "label": "AI Act ceiling for certain operator breaches; lower SME rule and case-by-case decision.",
      "value": "€15m / 3%"
    },
    {
      "label": "A message may unexpectedly contain health, financial, identity or other personal data.",
      "value": "Free text"
    }
  ],
  "internal_links": [
    {
      "label": "Home",
      "url": "https://hebora.be/en.html"
    },
    {
      "label": "SEO & GEO in Belgium",
      "url": "https://hebora.be/seo-bruxelles-en.html"
    },
    {
      "label": "Audit my chatbot",
      "url": "https://hebora.be/diagnostic-en.html"
    },
    {
      "label": "AI-built website: what still needs checking in Belgium The website owner must still check business disclosures, legal grounds, notices to individuals, cookies, security, supplier contracts and — when applicable — e-commerce and accessibility rules. The platform helps build; it does not make those decisions for you.",
      "url": "https://hebora.be/conformite-site-ia-belgique-en.html"
    },
    {
      "label": "Lovable Cloud and GDPR: who is responsible for what in Belgium? Lovable’s DPA generally describes the customer as controller and Lovable as processor for data handled on the customer’s behalf. The customer still configures the app, informs users, chooses data and integrations, and handles requests to exercise data rights.",
      "url": "https://hebora.be/lovable-cloud-rgpd-belgique-en.html"
    },
    {
      "label": "Cookie banner in Belgium: what must be blocked before consent The Belgian Data Protection Authority requires prior consent for cookies that are not strictly necessary, a genuine choice, refusal as accessible as acceptance and easy withdrawal. Necessary cookies may operate without consent, but they must genuinely be necessary.",
      "url": "https://hebora.be/banniere-cookies-rgpd-belgique-en.html"
    }
  ],
  "open_graph_image": "https://hebora.be/images/legal/transparence-chatbot-ia-belgique-og.png",
  "images": [
    {
      "src": "https://hebora.be/images/legal/transparence-chatbot-ia-belgique-1536.webp",
      "alt": "Business owner and adviser testing AI chatbot transparency on a laptop and phone in Brussels"
    }
  ],
  "answer_summary": "Article 50 of the AI Act requires providers to design direct-interaction systems so people are informed that they are interacting with AI, unless that is obvious. The website owner must also check its own duties as deployer and data controller.",
  "services_provided": "Hebora tests first-contact disclosure, data sent, retention, deletion and human escalation, then delivers the evidence.",
  "source_urls": [
    "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
    "https://eur-lex.europa.eu/eli/reg/2026/1744/oj",
    "https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems",
    "https://economie.fgov.be/en/themes/enterprises/ai-act/you-use-ai-your-company",
    "https://www.gegevensbeschermingsautoriteit.be/burger/nieuws/2026/05/29/onder-de-loep-chatbots-innovatie-en-gegevensbescherming",
    "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  ],
  "last_verified": "2026-08-15",
  "legal_boundary": "Hebora performs technical audits and corrections. This content is not legal advice, does not certify compliance and does not replace a lawyer or DPO when your situation needs legal interpretation."
}