Crisp and the EU AI Act: does your chat widget tell people it's AI?
Crisp is a favorite of startups and indie SaaS: one lightweight widget, a shared inbox, and AI answers via its bot and MagicReply features. The same lightness is the compliance trap — Crisp deployments are usually configured once by a founder in an afternoon, and the AI features that shipped afterward were toggled on without anyone re-reading the first message a visitor sees.
The rule itself is short. Article 50(1) of the EU AI Act requires AI systems that interact directly with people to be designed so users know they're dealing with AI — no later than the first interaction, in a clear and distinguishable way. The exception for cases where it's "obvious" is narrow: a natural-language customer-service bot doesn't qualify just because it has a robot icon. A line in your terms of service doesn't satisfy it either. And it's easy to enforce, because a regulator can simply open your site and start a chat.
Where the disclosure lives in Crisp
In a typical Crisp setup, the surfaces that can carry (or fail to carry) the AI disclosure are:
- The chatbox and its default greeting text
- The bot participant's name and avatar when AI scenarios respond
- AI-generated replies (MagicReply-style suggestions sent as answers) in the thread
- The moment a human teammate replies after the bot has been answering
Your Crisp disclosure checklist
- Message your own site: does anything say 'AI' or 'bot' before or in the first response?
- Give the bot an explicitly AI identity rather than the company name alone, which implies a human team
- Add a disclosure line to the greeting or the bot's first scenario message
- If teammates send AI-drafted replies under their own names, decide and document your policy — visitor-facing AI answers should be attributable as AI
- Announce human takeover in-thread when a founder or teammate jumps in
- Save a dated screenshot of the chatbox first-interaction state alongside your Crisp scenario settings
Watch out for
Crisp's blended inbox makes it easy for AI-drafted text to go out under a human teammate's name — helpful for speed, murky for transparency. The clean rule: anything the visitor receives that a human didn't meaningfully author gets an AI attribution. Deciding that policy once, and writing it down, converts an ambiguity into a defensible position.
Common questions
Our bot only runs after-hours — do we need disclosure all the time?
Disclose whenever the AI is the one responding, which for after-hours bots means in that greeting and those replies. Time-based routing is fine; silent identity-swapping between human daytime and AI nighttime is what confuses visitors.
Is a robot emoji in the bot name enough?
Treat icons as decoration, not disclosure. The requirement is a clear, distinguishable statement — one plain sentence outperforms any emoji if it's ever examined.
Check it in one scan.
DisclosureProof opens your site the way a regulator would, triggers your Crisp widget, and records whether the AI disclosure actually appears — with timestamped evidence either way. Free scan at launch.
Join the launch list