EU AI Act for WordPress: The Complete Checklist Before 2 August 2026

• The EU AI Act's transparency rules apply from 2 August 2026. They reach ordinary websites, including WordPress sites, not just AI companies.
• If your site shows an AI chatbot, you must disclose it (Article 50(1)).
• If you publish AI-generated text or images, you must label them (Article 50(4)).
• If people in your organisation operate AI, you owe a basic AI literacy effort (Article 4), already in force since 2 February 2025.
• Your risk tier and any high-risk duties depend on what your AI does; no plugin can decide that for you. Confirm it with the free assessment.
• Transparency and high-risk breaches carry fines up to EUR 15 million or 3% of global turnover (Article 99(4)).
• On WordPress, most of the transparency work is free and local with the EU AI Act WordPress plugin.

Does the EU AI Act apply to my WordPress site?

Probably, if you use AI in any visitor-facing way. The Act applies to organisations established in the EU, and to organisations outside the EU whose AI output is used in the EU or who target EU users. You do not have to be an "AI company." A chatbot, AI-written blog posts, AI-generated images, or an AI personalisation tool all count. In AI Act terms you are a deployer (Article 3), and Article 50 puts transparency duties on deployers from 2 August 2026.

If your site has no AI at all, most of this does not apply, though it is worth confirming, because "no AI" is easy to assume and wrong (an AI writing assistant or an AI-enhanced SEO or translation plugin counts).

The dates that matter

The AI Act phases in over several years. For a website operator, these are the milestones:

Two of these already bind you today: Article 4 literacy and Article 5 prohibitions. The big one on the horizon for websites is 2 August 2026 and Article 50.

The WordPress checklist

Work through these in order. The first four are the duties most WordPress sites actually have; the last three are due diligence.

1. Inventory the AI on your site

You cannot disclose or classify what you have not found. List every AI tool your site uses:

• Chatbots and live-chat widgets (Intercom, Tidio, Drift, Crisp, Zendesk, Tawk.to, HubSpot chat, and similar)
• AI content or writing plugins (AI Engine, Bertha, ContentBot, Jetpack AI, and similar)
• AI image or media tools
• AI-enhanced SEO plugins, translation tools, personalisation and recommendation engines

On WordPress, an AI-tool detection scan checks your active plugins and enqueued scripts against a list of known AI tools and tells you what it found and why, so you are not relying on memory. Treat its result as a starting inventory, not a guarantee: a curated list cannot catch everything, and it cannot see AI-generated content at all.

2. Disclose your AI chatbot (Article 50(1))

If visitors can talk to an AI, tell them, at the first interaction, in plain language, in every language you serve. A short notice such as "You are chatting with an AI assistant. Responses are AI-generated" is enough if it is clear and shown up front. The full detail, including the narrow "obvious from the circumstances" exception and who bears the duty when you use a third-party bot, is in do I need to disclose my AI chatbot?. To implement it, see how to add an Article 50 AI disclosure to WordPress.

3. Label AI-generated content (Article 50(4))

If you publish AI-written text or AI-generated images, mark them as artificially generated. This is the most-missed duty on the list, because generated content is visually identical to human content, so nothing "detects" it. If AI drafts your posts or creates your images, add a visible label at publication.

4. Address AI literacy (Article 4)

Article 4 has applied since 2 February 2025 and is routinely forgotten. If people in your organisation operate AI, you must take measures to ensure they have a sufficient level of AI literacy for their role and context. A short training module with a dated completion record is a practical, defensible way to show you addressed it. The WordPress plugin includes an Article 4 literacy checklist for exactly this. See Article 4 for the requirement.

5. Confirm your risk tier and any duties beyond transparency

Transparency is the floor, not the ceiling. Depending on what your AI does, you may have obligations that go further: risk classification under Article 6, technical documentation, a fundamental-rights impact assessment, or registration. No WordPress plugin can determine this. Run the free EU AI Act assessment to classify your systems and map your specific obligations, with no account needed.

6. Check you are not doing anything prohibited (Article 5)

A quick but important step. Article 5 bans certain AI uses outright, including manipulative or subliminal techniques and some profiling. Review any personalisation, dynamic-pricing, or recommendation tooling to be sure none of it crosses those lines. Prohibited practices sit in the highest penalty tier.

7. Keep a simple record

You should be able to answer, plainly, how AI works on your site and what you did about it. Keep a short record: what AI you use, what you disclosed, what training you ran, and when. It does not need to be elaborate; it needs to exist. Documentation is what turns "we think we are fine" into "we can show it."

What most WordPress sites actually need

For the majority of WordPress sites, the AI they use is limited-risk: a support chatbot, some AI-assisted content, maybe AI images. For that profile, the real obligations are the transparency ones (disclose the chatbot, label AI content) plus Article 4 literacy. You are unlikely to be operating high-risk AI simply by running a website, but you should confirm that with the assessment rather than assume it.

The penalties, in brief

National authorities apply proportionality for SMEs, but exposure and reputational risk are real. See EU AI Act penalties and fines explained.

The fastest path for a WordPress site

1. Install the EU AI Act WordPress plugin (free, local, no account).
2. Run the detection scan to build your AI inventory and switch on the chatbot disclosure.
3. Complete the Article 4 literacy checklist and keep the dated record.
4. Label any AI-generated content you publish.
5. Run the free assessment to confirm your risk tier and anything beyond transparency.

Do this before 2 August 2026 and you will have handled the transparency obligations most WordPress sites face, with a record to show for it.

I only have a contact form and a newsletter. Does the AI Act apply? If none of your tools use AI, the transparency duties largely do not apply. But confirm: some form, spam-filter, SEO, or translation plugins quietly use AI. When in doubt, run the assessment.

Is Article 4 literacy really in force already? Yes. Article 4 has applied since 2 February 2025, independent of the 2026 transparency date. It is one of the most overlooked obligations.

Does using a third-party chatbot shift the responsibility to the vendor? Not in practice. You are the deployer and are responsible for ensuring the disclosure is shown on your site. If the vendor's notice is adequate, confirm it; if not, add it.

What if I am outside the EU? The Act can still reach you if EU users interact with your AI or you target the EU market. Assume it applies if you have EU visitors.

Does installing a plugin make me compliant? No plugin can make that claim. A plugin helps you implement the transparency measures and keep a record; your risk tier and any further duties come from the assessment. It is not legal advice.

Start now

• Do the transparency work (free, local): EU AI Act WordPress plugin
• Confirm your full obligations: Free EU AI Act assessment
• Track the deadlines: EU AI Act deadline tracker

This article is general information, not legal advice. For your specific situation, consult a qualified professional.