From 2 August 2026 Regulation (EU) 2024/1689 applies, known as the AI Act. If an AI assistant answers on WhatsApp, on email or on the phone in the name of your business, the practical question is simple: who has to tell the customer, you or the firm that gave you the assistant?
The short answer is this, and the rest of the page sets it out: The obligation to design the assistant so that a customer learns they are speaking to an artificial intelligence falls on the provider of the system, which is us, under Article 50(1) of Regulation (EU) 2024/1689. The information on this page is general guidance and does not constitute legal advice.
The page is written for an owner with no legal training, and at the end you will find the sources, with links, so you can check every statement yourself.
What is the AI Act and who does it oblige?
The AI Act is the European law on artificial intelligence, directly applicable in every member state, so in Romania too, with no transposing law. The regulation splits responsibility between the provider, whoever builds the AI system and puts it on the market, and the deployer, the business that uses the system in its own activity.
The definitions are in Article 3. Point 3 says a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark. Point 4 says a deployer, the term written as implementator in the Romanian version, is whoever uses an AI system under their own authority, outside a personal non-professional activity. The two roles carry very different lists of obligations, the longest being the provider one, and the small Romanian business that buys a ready-made assistant is almost always a deployer.
Do I have to tell the customer they are speaking to an artificial intelligence?
Yes, the customer has to find out, but the legal obligation to build the system so that the person finds out falls on the provider, not on your business. Article 50(1) opens with the words providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the person is informed they are interacting with an AI system. For the assistant on this site, the provider is ARIA KNOWS.
Paragraph (1) also has a common sense exception: the disclosure is not required where it is obvious to a reasonably well informed, observant and circumspect person, taking the circumstances into account. In practice we do not rely on that exception. A message on WhatsApp looks like a message from a colleague, so obviousness is not assumed.
Article 50(5) adds the rule about timing: the disclosures under paragraphs (1) to (4) are given in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure, and in formats accessible to people with disabilities. That is where the concrete recommendation in the section with texts to copy comes from: the notice sits in the first message, not on a terms page nobody opens.
From when does it apply?
The timetable is in Article 113, but it is no longer the one in the original text. Regulation (EU) 2026/1744, the package called Digital Omnibus on AI, in force from 27 July 2026, pushed back the deadlines for high-risk systems. Article 50 sits in Chapter IV, so it falls under the general rule and applies from 2 August 2026.
The timetable of application, mostly from Article 113, with the changes made so far:
- 2 February 2025, past, Chapters I and II: the prohibited practices in Article 5, in the form they had then, and Article 4 on AI literacy, rewritten since.
- 2 August 2025, past: the rules for general purpose models, governance and the chapter on penalties, except Article 101.
- 2 August 2026, past: the transparency obligations in Article 50 and the rest of the regulation, except the obligations for high-risk systems in Annex III, moved by the Digital Omnibus to 2 December 2027.
- 2 December 2026, ahead, a deadline that comes from Article 111(4), added by the Digital Omnibus, not from Article 113: the machine-readable marking under Article 50(2), for generative systems already on the market before 2 August 2026. It is an obligation of the provider, not of your business. From the same date, the practices newly added to the list of prohibitions in Article 5 also apply.
- 2 December 2027, ahead: the obligations for high-risk systems in Annex III, among them recruitment, education, credit and insurance. The original deadline was 2 August 2026.
- 2 August 2028, ahead: Article 6(1) and the corresponding obligations, for high-risk systems built into regulated products. The original deadline was 2 August 2027.
Who is responsible, the provider or my business?
The split runs paragraph by paragraph, not by intuition. It is the place where the mistake is made most often, including in sales material saying that the duty to disclose falls on the business using the assistant. The text of Article 50(1), quoted above, says otherwise: paragraphs (1) and (2) oblige the provider, and paragraphs (3) and (4) oblige the deployer, meaning your business, but only in specific situations, which as a rule do not arise with a customer service assistant.
| Article | What it requires | Who it obliges |
|---|---|---|
| 50 (1) | The person learns they are interacting with an AI system | The provider |
| 50 (2) | Machine-readable marking of generated content | The provider |
| 50 (3) | Disclosure for emotion recognition and biometric categorisation | The deployer |
| 50 (4) | Declaring deepfakes and text on matters of public interest | The deployer |
| 50 (5) | Clear disclosure, at the latest at the first interaction | Both, each on their own side |
| 4 | Measures to support AI literacy among their own staff | Both |
One balancing point, so you do not walk away thinking none of it concerns you. Article 99(4)(g), which sets the fine, speaks about the Article 50 transparency obligations of providers and of deployers, and Article 50(6) leaves other transparency obligations under Union law and under national law untouched. Separately from the AI Act, Romanian consumer protection law forbids you to mislead the customer about who is answering them. That is why the practical recommendation stays the same: put up the notice, even if the design obligation is not yours.
Two exceptions are worth knowing. If you take an AI system, put your own name or trademark on it and resell it as your own product, or if you modify it substantially, Article 25 can treat you as the provider, with all the obligations that brings; the text concerns high-risk systems, so in principle it does not touch an ordinary WhatsApp assistant, but it is worth checking before you put an AI on the market under your own brand. And if your system did fall into the high-risk category, Article 26 adds a separate list of obligations for the deployer, among them human oversight and keeping logs.
What do I actually have to do if I use an AI assistant?
As a deployer, you have a short list, in the order that matters:
- The notice. The text sits in the first message of the conversation and, on top of that, in the business profile description and on your contact page. See the wording ready to copy below.
- The way out to a human. The customer has to be able to reach a person, and the assistant must not claim to be human if it is asked directly.
- Training the team. Article 4, rewritten by Regulation (EU) 2026/1744, asks providers and deployers to take measures to support AI literacy among their own staff, and says expressly that the obligation does not require guaranteeing any particular level of literacy for any person. In practice: the people who use the assistant have to know what it does and when they take the conversation over.
- Published text. If you publish articles written by AI that inform the public on matters of public interest, the second subparagraph of Article 50(4) requires you to declare it, unless the text has gone through editorial checking or human review and a natural or legal person holds editorial responsibility.
- Personal data. GDPR applies in parallel and was mandatory already. The AI Act does not replace it and does not relax it.
What does not go on your list, if you use an assistant you bought: designing the system so that it declares itself, the technical marking of generated content and the technical documentation of the model. Those belong to the provider.
What text can I use to tell the customer?
The regulation asks for a clear and distinguishable disclosure, not a particular formula. Below are four short options, in English, ready to copy: you replace the company name and use them as they are. They are ordinary disclosure wordings, not texts imposed by law, and they can be adapted to the tone of your business.
Hi! I am the AI assistant of [Company name]. I answer automatically, around the clock. If you want to speak to a colleague, tell me and I will put you through.
In the first message the assistant sends in a new conversation, before the answer itself.
Messages sent to this number are handled by an AI assistant. A colleague can take the conversation over at any time.
In the description field of the business profile, so it is visible even before the first message.
Hello, you have reached [Company name]. You are being answered by an automated assistant with a generated voice. Tell me how I can help, or ask for a colleague and I will put you through.
In the first seconds of the call, before collecting any information from the caller. If your business speaks to customers formally, change the register, the text still holds.
On WhatsApp, on email and on the phone, the first answer may come from an AI assistant. You can ask to speak to a person at any time.
Next to the contact form or next to the WhatsApp number shown on the site.
Where does the notice go in a WhatsApp conversation?
In the first message the assistant sends, before the answer to the question, because Article 50(5) requires the disclosure at the latest at the time of the first interaction. One sentence, then get on with it, so that you do not turn a transparency obligation into a wall of text the customer closes.
Three practical details that are often missed. The WhatsApp Business profile description, on its own, is weak: many people write straight from their chat list and never open the profile. The notice goes up again in every new conversation with someone who has not spoken to the assistant before, not once at launch. And if a colleague takes the conversation over, it is worth telling the customer that a colleague has taken over, because otherwise they carry on believing they are talking to the AI.
On the phone the same logic applies, and more strictly: the opening message says that an automated assistant is answering, before any information is collected. The voice ARIA KNOWS uses is synthetic and is not cloned from the voice of a customer or of one of your employees. As a guide, such a voice does not fall within the definition of a deepfake in Article 3, which concerns content resembling existing persons.
What fines and which authorities, in Romania?
The European ceiling is in Article 99. Paragraph (4)(g) provides, for breach of the Article 50 transparency obligations by providers and by deployers, administrative fines of up to 15,000,000 EUR or, for an undertaking, up to 3 per cent of its total worldwide annual turnover for the preceding financial year, whichever is higher. Paragraph (6) provides that for SMEs, including start-ups, the lower of the percentage and the amount applies. These are maximum ceilings, not typical fines, and the actual amount is set by the competent authority.
The Romanian side is still being built and deserves to be said plainly. Through a memorandum adopted on 12 March 2026, the Government proposed the institutional architecture: ANCOM as market surveillance authority and single point of contact, Autoritatea pentru Digitalizarea României as notifying authority, ASF and BNR on the financial side, ANSPDCP on the sensitive areas. In a press release of 24 July 2026, ANCOM said openly that the competent authorities will be able to check and penalise failure to comply with the obligations in the regulation only after the national act enters into force, which is still being drafted. At the verification on 9 August 2026, that law had not been adopted. The regulation applies directly in any case, but the control and penalty mechanism in Romania is not yet operational.
How we handle the part that falls to us
This section is about the product, not about the law, and it is deliberately kept separate from the rest of the page. ARIA KNOWS is the provider of the system, so the obligations in Article 50(1) and (2) are ours, and your business does not have to do anything technical for them. Concretely:
- The assistant identifies itself explicitly as an AI assistant at the start of a conversation with a customer who has not spoken to it before, and it never claims to be human.
- The identification text is configurable per business, so you can use exactly the wording from the section above, in the tone of your firm.
- The voice on the phone is synthetic, announces itself as such and is not cloned from the voice of anyone in your firm.
- A colleague takes the conversation over from the same screen, and the full history of the conversations stays visible, so if anyone asks you, you have the history to hand.
- The servers sit at Contabo, Lauterbourg, France, the language model is Mistral, every business has its own database, and the conversations are not used to train any model. Data storage and the written side, meaning the messages received and the answers sent, stay in the European Union.
- Voice, only if you switch it on. Answering the phone is not switched on for a business unless you ask for it. When it is on, transcribing what the caller says runs on the European access point of our transcription supplier, and voice synthesis, meaning the sound the caller hears, is processed by a supplier outside the European Union. That transfer is covered by the contract with that supplier, and who the suppliers are is written in the DPA.
- What we do not do yet: the machine-readable marking of the answers, required by Article 50(2), is being worked on. The deadline that applies to us is 2 December 2026 and we will update this page when we put it into operation. The Code of Practice on the transparency of AI generated content is voluntary and we have not signed it.
What we do not do at all: we do not sell you a compliance guarantee, we do not sign a declaration that your business is compliant and we do not stand in for a lawyer. Your compliance also depends on how you use the system, and that stays your decision. You can see what the system looks like in a real firm on the page about our own solar installation firm.
Frequently asked questions
Does the AI Act oblige my business or the provider of the AI assistant?
Article 50(1) of Regulation (EU) 2024/1689 places the obligation to inform a person that they are speaking to an AI system on the provider who builds the system and puts it on the market, not on the business that uses it. For the assistant sold by ARIA KNOWS, we are the provider. Your business remains the deployer and has fewer obligations, but not zero: Article 50(6) leaves other transparency obligations under Union law and under national law untouched.
What does deployer mean in the AI Act?
Deployer, translated as implementator in the Romanian version of Regulation (EU) 2024/1689, is defined in Article 3 point 4: the natural or legal person who uses an AI system under their own authority, in a professional activity. A business that puts a ready-made assistant to work answering customers on WhatsApp is a deployer, not a provider.
From when does the AI Act apply in Romania?
Under Article 113, Regulation (EU) 2024/1689 applies from 2 August 2026, and Chapters I and II, which include Article 4 on AI literacy and the prohibited practices in Article 5, from 2 February 2025. Being a European regulation, it applies directly in Romania. The timetable has since been changed by Regulation (EU) 2026/1744, Digital Omnibus on AI, in force from 27 July 2026, which moved the obligations for high-risk systems in Annex III to 2 December 2027 and those in Annex I to 2 August 2028, rewrote Article 4 and added prohibited practices that apply from 2 December 2026. The transparency obligations in Article 50 apply from 2 August 2026.
Do I have to write on my site that I use an AI assistant?
The regulation requires that the person finds out they are interacting with an AI system, and Article 50(5) says the disclosure is given clearly and distinguishably, at the latest at the first interaction. The practical recommendation is to put the notice in the first message of the conversation, where the customer actually reads it, and, on top of that, on your contact page. Separately from the AI Act, Romanian consumer protection law already forbids you to mislead the customer about who is answering them.
What happens if the AI assistant writes articles on the company blog?
The second subparagraph of Article 50(4) obliges the deployer to declare text generated by AI when it is published in order to inform the public on matters of public interest, unless it has gone through editorial checking or human review and a natural or legal person holds editorial responsibility for the publication.
Is my WhatsApp assistant a high-risk AI system?
Annex III of Regulation (EU) 2024/1689 lists eight high-risk areas, among them biometrics, employment, education, credit and insurance. An assistant that answers questions about opening hours, prices or availability is not, as a rule, found there. If you screen candidates or assess creditworthiness, check your own specific case, but you have time: the obligations for the systems in Annex III were moved by Regulation (EU) 2026/1744 from 2 August 2026 to 2 December 2027.
What fines does the AI Act set for transparency?
Article 99(4)(g) of Regulation (EU) 2024/1689 provides, for breach of the Article 50 transparency obligations by providers and by deployers, fines of up to 15,000,000 EUR or up to 3 per cent of worldwide annual turnover, whichever is higher. For SMEs, paragraph (6) applies the lower ceiling. These are maximum ceilings, not typical fines.
Who enforces the AI Act in Romania?
Through a memorandum of 12 March 2026, the Government proposed ANCOM as market surveillance authority and single point of contact, Autoritatea pentru Digitalizarea României as notifying authority, plus ASF, BNR and ANSPDCP in their own fields. In a press release of 24 July 2026, ANCOM stated that the competent authorities will be able to check and penalise failure to comply with the obligations in the regulation only after the national act enters into force, and that act is still being drafted. At the verification on 9 August 2026, that law had not been adopted.
Does ARIA KNOWS guarantee my compliance with the AI Act?
No. We take on the obligations that fall on the provider, among them identifying the assistant as AI at the start of the conversation, and we give you the disclosure texts, the DPA and the record of the conversations. The machine-readable marking of generated content, required by Article 50(2), is not yet in operation, and the deadline that applies to us is 2 December 2026. The compliance of your business also depends on how you use the system, and for your own specific case the answer comes from a lawyer.
Sources
All the legal statements above were checked on 9 August 2026, directly against the texts below. If you find a discrepancy, write to [email protected] and we will correct the page.
- Regulation (EU) 2024/1689 (AI Act), text on EUR-Lex: the English version. Articles cited: 3, 4, 5, 25, 26, 50, 99, 111, 113 and Annex III.
- Regulation (EU) 2026/1744, Digital Omnibus on AI, in force from 27 July 2026, which rewrote Article 4 and moved the deadlines for high-risk systems: the text in the Official Journal and the European Commission announcement.
- European Commission, the guidelines on transparency obligations, published on 20 July 2026: the guidelines page and the frequently asked questions on Article 50. Signing the Code of Practice on the transparency of AI generated content is voluntary and concerns providers.
- The Government of Romania, the press information from the Government meeting of 12 March 2026, the memorandum on the competent national authorities: gov.ro.
- ANCOM, press release of 24 July 2026 on the state of the implementation framework in Romania: ancom.ro.
Who wrote this page
ARIA KNOWS is the brand operated by Annapolis Tour S.R.L., CUI RO38461850. We recommended above that you check who answers you and who sells you the system, so our own identification details sit here, verifiable in the public registers, just like those of any supplier you compare. This is general information about Regulation (EU) 2024/1689 for small businesses in Romania. It is not legal advice and it does not create a lawyer and client relationship. The situation of your business may differ, and the national enforcement framework is still being built. For a decision that matters, ask a lawyer.
What next
If you want an assistant that introduces itself properly from the first message and leaves the record of the conversations in plain sight: Communication 199 RON per month, Operations 499 RON per month, and Development is quoted on request. The price you see is the amount you pay for the subscription, VAT included. The only things that can be added on top are usage you can see in advance: the Meta WhatsApp fees, rebilled at cost, and phone minutes beyond the ones included. There is no setup cost. On annual payment you pay ten months instead of twelve, 1,990 RON and 4,990 RON per year.
Related pages, if you want to take the decision further:
- The full prices and what an AI assistant actually costs in Romania, with the hidden costs put on the table.
- The comparison with FlowBotic, if you are weighing up several suppliers and want to know what each of them publishes.
- How we use the system ourselves, in our own solar installation firm.
- I do not have time to reply to customers and how much you lose from an unanswered message, if your problem is time, not compliance.