What do the new AI rules mean for a small business?

By Pamela, Founder & CEO at DigiVino · Updated October 1, 2026 · 5 min read

Picture Tomas, who runs a boutique lodge and added an artificial intelligence (AI) assistant to his booking page last spring. It answers questions at two in the morning and never takes a day off. Three sets of rules now bear on that little chat window, one of them new this year, and none of them arrived with a letter.

This is the first post in AI for Good, an occasional Yield & Press series about using AI in ways you would be happy to explain to a customer. We start with the rules, because they are the part most owners have not heard about.

What changed for businesses that use AI in 2026?

The European Union (EU) AI Act started to bite. It entered into force on 1 August 2024 and applies in stages. Its bans on the most harmful uses have applied since 2 February 2025. Most of its transparency rules, the ones that touch ordinary businesses, including the chatbot rule, have applied since 2 August 2026.

The heaviest part, for systems the Act calls high-risk, was pushed back. A package of amendments known as the Digital Omnibus, in force since 27 July 2026, moved those rules to December 2027 and August 2028. High-risk means things like AI that screens job applicants or sits inside a medical device, not the chat window on a lodge’s booking page.

So the part most small businesses meet is the transparency part: people should be told when they are talking to a machine.

Does my website chatbot have to say it is AI?

Under Article 50 of the AI Act, a chatbot must be built so the people using it are told they are dealing with AI, clearly and at the latest at their first interaction, unless that is already obvious. The duty sits mainly with whoever builds the chatbot. The widget sits on your website.

Tomas’s assistant introduced itself as “Sam from the front desk.” Nobody named Sam works at the front desk. Changing one line to “I’m the lodge’s AI assistant” costs nothing and settles the question.

The Act can also reach beyond Europe: it can cover providers and deployers outside the EU when the AI’s output is used in the EU. If you sell to European visitors or customers, that is a question for your lawyer, and a good reason to make the disclosure anyway.

Am I responsible for what my chatbot tells customers?

A Canadian tribunal has said yes. In Moffatt v. Air Canada (February 2024), the airline’s website chatbot told a grieving customer he could claim a bereavement fare after booking. The airline’s actual policy said otherwise, and it argued the chatbot was responsible for its own words.

The tribunal disagreed: “It should be obvious to Air Canada that it is responsible for all the information on its website.” It ordered the airline to pay about C$812. A small sum, and a decision from a small-claims tribunal rather than a high court, but the reasoning is hard to argue with. A chatbot on your site speaks for you.

In practice: check what your assistant says about prices, cancellations, refunds and anything else a customer might rely on. Those are the answers that cost money when they are wrong.

Can I use AI to write reviews or testimonials?

Not reviews from people who do not exist. The US Federal Trade Commission (FTC) finalized a rule in August 2024, in force since that October, that bans fake reviews and testimonials, and it names AI-generated reviews explicitly. It also covers buying reviews that must say something positive or negative. Violations can carry civil penalties per violation.

Asking AI to help you draft a thank-you reply to a real review is fine. Asking it to write the review is not. If a sentence claims to be a customer’s experience, a real customer had it.

Is there a US law like the EU AI Act?

Not yet. As of September 2026, Congress had not passed a comprehensive federal AI law. States have been writing their own rules, several took effect in 2026, and a December 2025 executive order directed federal challenges to some state laws without itself overriding them. The map is moving, so date anything you read about it, including this.

The practical answer does not depend on which rule wins: say when it is AI, check what it tells people, and never invent a customer.

What is the short version for an owner?

• Disclose. Make sure any chatbot on your site introduces itself as AI.
• Check. Read what it says about prices, policies and refunds, because you own those answers.
• Never invent a customer. No AI-written reviews, testimonials or quotes.
• Date what you know. These rules changed more than once in 2026. Put a reminder in the calendar to look again.

This is general information, not legal advice. If a rule here might apply to you, a lawyer who knows your market is worth the hour.

Editorial. Sources: the EU AI Act and Regulation (EU) 2026/1744; Moffatt v. Air Canada, 2024 BCCRT 149; the FTC Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (2024). DigiVino, September 2026. General information, not legal advice.

← Back to Yield & Press