A free clause for updating your privacy policy to cover your use of AI systems. To be clear up front: this is not an Article 50 requirement. It's commonly updated alongside Article 50 work because, where AI processes personal data, the GDPR expects your privacy notice to say so.
Use of artificial intelligence
We use AI systems to [purpose — e.g. answer questions through the chat
assistant on our website / help draft product descriptions].
What we process. When you use [feature], we process [the messages you
send, and any name, email address or order details you include] to
generate a response.
Why, and on what legal basis. We do this to [purpose], on the basis of
[our legitimate interest in providing timely customer support /
performance of our contract with you / your consent].
Who receives it. [Provider name] provides the AI system and processes
this information on our behalf as our processor. [If applicable: This
involves a transfer to (country), which we protect using (adequacy
decision / standard contractual clauses).]
How long we keep it. We keep [chat transcripts] for [period], then
delete them.
Automated decisions. We do not use [feature] to make decisions that
have legal or similarly significant effects on you. [If you do: describe
the logic involved, its significance and the envisaged consequences.]
Your choices. You can [ask for a human instead / avoid entering personal
information in the chat], and you have the rights described in [section]
of this policy. Contact us at [email].Not by Article 50. Article 50's disclosures are about the moment of interaction: people must be told they're interacting with an AI system, or that content is AI-generated, clearly and at the latest at the first interaction or exposure. A privacy policy doesn't do that job, and Article 50 doesn't ask for one.
Often, by the GDPR. If your AI feature processes personal data, Article 13 GDPR requires you to tell people, when you collect it, things like the purposes and legal basis of the processing, the recipients, any transfer outside the EU, how long you keep it, and — for automated decisions with legal or similarly significant effects — meaningful information about the logic involved. An AI chatbot that receives customer names and order details is a typical example. Whether and how that applies to you is a GDPR question; the clause above is a starting point, not a finished policy.
For the disclosure Article 50 actually requires, use the chatbot disclaimer template or the general disclosure template.
No. Article 50 of the EU AI Act doesn't mention privacy policies. Its disclosures have to be given to people clearly at the point of interaction or exposure — beside the chatbot or the content — not in a policy document.
Because if your AI feature processes personal data — a chatbot receiving names, emails or order details, for example — the GDPR expects your privacy notice to explain that processing. Article 13 GDPR requires information such as the purposes and legal basis, the recipients, any transfers outside the EU, retention, and the existence of certain automated decision-making.
Unlikely. Article 50 requires the information to be given in a clear and distinguishable manner at the latest at the time of the first interaction. Use the chatbot disclaimer template for that, and this clause for your privacy policy.
This is a general template. Get language matched exactly to your site's specific findings — run a free scan.
Article50.io is an automated Article 50 transparency assessment platform that scans websites for potential EU AI Act transparency obligations and provides remediation guidance, implementation instructions, and compliance-ready disclosure language.
The free scan shows your single most severe finding in about 30 seconds — no signup, public pages only.
Automated technical guidance, not legal advice. Citations refer to Regulation (EU) 2024/1689.