If your website has a chat window, your WhatsApp line answers itself, or a voice assistant picks up the phone after hours, you are running a conversational AI system. Since August 2026 that brings a clear obligation on anyone whose customers include people in the EU, and Swiss data protection law points in the same direction. The good news is that doing it properly is cheap. The risk is in doing it half-heartedly.

This article covers what both regimes expect and how to get it right. It is general information, not legal advice.

The Swiss baseline

Switzerland has no chatbot-specific statute, but it does not need one. The FDPIC's position is that the Federal Act on Data Protection applies directly to AI, and its guidance on AI and data protection states that users have a legal right to know whether they are communicating with a machine. It goes further than the bare disclosure: people should also be told whether what they type is used to improve self-learning systems or for other purposes.

Voice adds another layer. In October 2026 the Federal Administrative Court upheld the FDPIC's position that PostFinance needed express consent before creating voiceprints of callers, and that a caller who simply keeps talking after an announcement has not given it. If your phone assistant does anything more than transcribe, for example recognising returning callers by voice, that ruling is directly relevant.

The EU rule that has applied since 2 August 2026

Article 50 of the EU AI Act requires providers to design systems that interact with people so that those people are informed they are dealing with an AI system, unless that is obvious. The information has to be given in a clear and distinguishable way, at the latest at the first interaction, as the AI Act Service Desk sets out. The European Commission published guidelines on these obligations on 20 July 2026, ahead of the 2 August start date.

The scope is broader than the word "chatbot" suggests. As Euronews summarised, the rules cover voice assistants, AI hotlines, avatars, bots and AI agents that interact with people in real or near-real time. They apply to non-EU businesses when their systems or content are used in the EU market, and within a company it is the employer, not the individual employee, that carries the deployer's responsibility.

Penalties for breaching these transparency rules can reach €15 million or 3% of worldwide turnover, according to the same Euronews report.

What does not count as disclosure

This is where many existing implementations fall short. Drawing on the Commission's guidelines, Euronews lists approaches that are not enough on their own:

  • A mention buried in the terms and conditions or documentation.
  • Watermarks or metadata the user cannot see.
  • Vague labels such as "assistant".
  • Blanket statements that services on the website use AI.
  • Technical descriptions that ordinary users will not understand.

The test, in other words, is whether a normal customer actually realises they are talking to software at the moment it matters.

Beyond the chat window

Article 50 also covers content. Businesses that publish deepfakes, or AI-generated text on matters of public interest without human editorial control, must disclose it, and anyone using emotion recognition or biometric categorisation must tell the people exposed to it, as the Commission explains. Providers of generative tools that were already on the market before August 2026 have a short transition for machine-readable marking, which runs to 2 December 2026, as Euronews reported. Most SMEs are users rather than providers of those tools, but it is worth confirming that your suppliers have a plan.

A practical checklist

  1. Open with a plain statement. The first message should say, in the customer's language, that they are chatting with an AI assistant. One sentence is enough.
  2. Do the same on the phone. A voice assistant should say what it is before the conversation starts, not after.
  3. Avoid a human persona. A friendly name is fine. A name, photo and tone designed to pass as a member of staff works against the whole point.
  4. Say what happens to the conversation. Whether chats are stored, for how long, and whether they are used to train or improve the system.
  5. Offer a way to reach a person. This is also how you honour the right to request human review under Swiss law.
  6. Get explicit consent for voice or face recognition. An announcement followed by silence is not consent.
  7. Label AI-generated images in marketing where they show people, places or events that could pass as real.
  8. Keep a record. A dated screenshot of each disclosure, kept with your AI register, is simple evidence if questions arise.

The bottom line

Transparency is the cheapest compliance obligation in AI and the one customers notice most. A clear opening line, an honest description of what happens to their data and an easy route to a human cover the Swiss expectation and the EU rule at the same time, and they tend to improve trust in the tool as well.

Planning a customer-facing assistant? The free AI Readiness Audit checks where automation helps and what it needs to disclose.

Sources

  • Federal Data Protection and Information Commissioner (FDPIC), "AI and data protection", 24 September 2025. link
  • FDPIC, "Authentication by means of voice recognition: Federal Administrative Court upholds the FDPIC's position on obtaining explicit consent", 21 October 2026. link
  • European Commission AI Act Service Desk, "Article 50: Transparency obligations for providers and deployers of certain AI systems", accessed 7 November 2026. link
  • European Commission, "Commission publishes guidelines on transparency obligations for providers and deployers of certain AI systems", 20 July 2026. link
  • Euronews, "New EU AI transparency rules apply to everyday users too, not just Big Tech", 7 August 2026. link
  • Euronews, "AI-generated label becomes mandatory in the EU for companies", 2 August 2026. link