The AI Act and a website with AI plugins: what to know

Yes, the AI Act applies to a website with AI plugins if a business uses an artificial intelligence system on its site or store as part of its professional activity. That means a chat, a description generator or recommendations. The owner then becomes a deployer within the meaning of the Artificial Intelligence Regulation 2024/1689. But don’t panic: most of the obligations fall on the tool provider. This article sets out the topic as it stood in May 2025 and is not legal advice.

Is the AI Act a problem for your website with AI plugins?

Most likely yes. Just to a smaller extent than the headlines suggest. The Artificial Intelligence Act splits obligations between those who build systems and those who use them. A store with a chatbot or a description generator does not have to keep technical documentation for the model (that’s the manufacturer’s job). It does, however, need to know which tools it uses, train the people who operate them and not hide from customers that there is a machine on the other side. That’s all, but it matters.

Provider or deployer: what role does a store owner have

Got a ready-made AI plugin in your store? Then you are usually a deployer, not a provider. A provider builds a system or places it on the market under its own name. A deployer uses it under its own authority in its professional activity. The textbook case: you install a WordPress, WooCommerce or PrestaShop module that talks to an external language model. That’s it, you are on the „deployer” side.

The roles can flip, though. All it takes is for a business to commission a plugin and start offering it to others under its own brand, or to significantly change the system’s intended purpose. Oh, and private, non-professional use does not fall under the definition of a deployer at all.

Which AI plugins actually count as an AI system

An AI system is a tool that infers. In other words, it generates content, predictions, recommendations or decisions from the input it receives. In a store that would be a customer service chatbot, a generator of product descriptions and SEO copy, a recommendation module that learns from shopper behaviour, or a bot that replies to reviews. And what usually isn’t one? Rules set directly by a person: a price filter, cross-selling by category, a discount above a certain order value. That’s plain „if-then” logic, not artificial intelligence.

In my view, the simplest approach is to go through your list of installed plugins and ask each one a few questions:

• Does it create text, an image or an answer that nobody wrote beforehand?
• Does it connect to an external model, e.g. via an API key?
• Does its output change based on customer data rather than fixed rules?
• Do customers interact with it directly?
• Who makes it, and do they publish documentation?

AI literacy from 2 February 2025: an obligation that already applies

Article 4 has applied since 2 February 2025. It requires providers and deployers to ensure a sufficient level of AI literacy among the people who operate these systems on their behalf. What does that mean in a small business? That whoever uploads descriptions from a generator or configures a chatbot understands how the tool works, where it can get things wrong and when the output needs checking. The regulation does not prescribe any specific training or certificate. What counts is real knowledge that fits what you actually do.

The bans on prohibited practices also apply from the same date. For a typical store, this is simply a line you don’t cross. For example, manipulation that exploits customers’ vulnerabilities.

AI transparency obligations: chatbots, generated content and deepfakes

Article 50 is clear: people must know they are interacting with an AI system, unless it is obvious from the context. The mechanism is mainly designed by the provider. But the site owner decides how the chat looks on the site, so they can’t tuck that information away in a corner. A deployer also has to disclose deepfakes and AI-generated text published to inform the public on matters of public interest. The exception? Content that has gone through human editorial review, where someone holds editorial responsibility.

The transparency obligations kick in later than the literacy requirement, following the timeline set out in the regulation. So now is a good time to prepare without stress. In practice, a visible notice in the chat window, labels on synthetic images and video, and human editing of product descriptions are enough. Nothing major.

The AI Act, GDPR and other rules that still apply

The new rules do not change GDPR or consumer rights. They add to them. An AI plugin that processes customer data still needs a legal basis, a privacy notice and a data processing agreement with the model provider. Before you switch it on, ask the manufacturer: where does data from the chat and forms go? Is it used to train the model? Which country are the servers in? And responsibility for the content doesn’t shift anywhere. A wrong specification in a generated description is still the seller’s problem towards the buyer, not „the AI’s fault”.

How to prepare your website for the AI Act: a plan for a few hours

The whole thing comes down to six steps. Most small businesses will get through them in one afternoon:

1. List the plugins and services with AI features, including those built into your theme or admin panel.
2. Assign a role to each one: are you a deployer or a provider.
3. Check the provider’s documentation and terms, especially the data clauses.
4. Give the people who operate the tools a short training session.
5. Label the chatbot and synthetic content.
6. Review your privacy policy for new data recipients.

For custom-built solutions, I recommend planning the AI notice and logs right from the start. Adding them later always ends up more expensive and messier. K4.pl sells WordPress and WooCommerce plugins and PrestaShop modules with updates and support, and also builds them to order, so requirements like these can go into the specification from day one.

In short: for a small business website, the AI Act is mostly about keeping your tools in order, a knowledgeable team and being honest with customers. Not an expensive compliance procedure.

Frequently asked questions