AI disclosures in your legal and policy pages
Your legal pages should describe every AI system your visitors encounter, what it processes and who provides it. This corroborates your Article 50 disclosures — it does not replace them, because the obligation is to inform people at the point of interaction.
What the law requires
Article 50 obligations are about informing people where the interaction happens. A privacy policy is not the place someone learns they are talking to a bot.
Legal pages still matter, for two reasons. Under the GDPR you already owe an explanation of processing, including AI-driven processing. And a policy page is the first thing a careful buyer, a partner's procurement team or a regulator reads when they want to understand your posture.
A dedicated AI-use page is not required by the Act. It has become the practical convention for organisations that want one answer to point at instead of scattered paragraphs.
What our scanner looks for
- Your privacy policy, terms, imprint, and any AI-policy or responsible-AI page — found by URL patterns across several languages, including datenschutz, confidentialité and privacidad.
- Whether those pages describe AI systems, and whether the description matches the AI we detected elsewhere on the site.
- Quotes are captured in the original language, with an English summary, so a multilingual site is assessed on what it actually says.
How to fix it
- 1List each AI system a visitor can encounter: chat assistant, search, recommendations, generated media.
- 2For each, say what it processes, which provider runs it, and whether inputs are used for training.
- 3Explain how to reach a human, and whether any automated decisions affect the visitor.
- 4Link this page from the footer and from the AI features themselves, so it is reachable from the point of interaction.
Deadlines and penalties
Not directly enforceable as a standalone obligation under Art. 50 — this check is informational. It corroborates the chatbot-disclosure finding and shows a regulator or buyer that the disclosure was deliberate rather than incidental.
Free, no account needed. We'll show you every page where this applies, with the evidence.
Common questions
Do we need a separate AI policy page?
Not legally. It is a convention worth adopting because it gives you a single URL to cite in security reviews, RFPs and support replies.
Our chatbot vendor has its own privacy policy. Is that enough?
No. Your visitors interact with your site. Linking the vendor's policy is useful, but the explanation of what runs on your domain has to be yours.
Related
This page describes technical indicators and the obligations they relate to. It is not legal advice. A website scan detects indicators, not legal compliance — which is why our reports say “no issues detected” and never “compliant”.