HubSpot and the EU AI Act: does your chat widget tell people it's AI?
HubSpot's chatflows increasingly run on Breeze, its AI layer, and live inside a platform where marketing owns the widget, sales owns the routing, and no one owns 'compliance of the first message.' On a HubSpot site the Article 50(1) exposure is usually organizational: the setting exists, but the team that would toggle it doesn't know the deadline exists.
The rule itself is short. Article 50(1) of the EU AI Act requires AI systems that interact directly with people to be designed so users know they're dealing with AI — no later than the first interaction, in a clear and distinguishable way. The exception for cases where it's "obvious" is narrow: a natural-language customer-service bot doesn't qualify just because it has a robot icon. A line in your terms of service doesn't satisfy it either. And it's easy to enforce, because a regulator can simply open your site and start a chat.
Where the disclosure lives in HubSpot
In a typical HubSpot setup, the surfaces that can carry (or fail to carry) the AI disclosure are:
- The chatflow widget and its welcome message on each targeted page
- The bot's display name and avatar configured in the chatflow
- AI-generated responses inside the flow before any human in the inbox replies
- The handoff step where the conversation is assigned to a live team member
Your HubSpot disclosure checklist
- Inventory every live chatflow (different pages often run different flows) and check each one's first message for an AI statement
- Name AI-driven flows honestly — an AI descriptor next to the bot name, not a teammate's headshot
- Add the disclosure line to the welcome message template so new chatflows inherit it
- Check knowledge-base and Breeze-answer flows separately from lead-capture flows
- Make inbox-assignment handoffs visible to the visitor as a participant change
- Keep dated screenshots of each live chatflow's opening state in your evidence file
Watch out for
HubSpot portals accumulate chatflows the way attics accumulate boxes — campaign-specific flows built by different people over years, many still live on forgotten landing pages. A single compliant main-site widget means little if a 2024 campaign page still runs an undisclosed bot. The audit unit is the flow, not the site.
Common questions
We have a dozen chatflows — do we really need to check each one?
Yes, because each flow controls its own first message. The efficient path is fixing the shared template, then sweeping live flows once and archiving the list — after that, new flows inherit the disclosure.
Some of our flows are pure rule-based menus, not AI — are those in scope?
Article 50(1) targets AI systems interacting with people. Pure deterministic menu bots are a weaker case, but the moment Breeze or any generative answering is in the loop, disclose. If you're unsure which flows use AI, that uncertainty is itself the finding.
Check it in one scan.
DisclosureProof opens your site the way a regulator would, triggers your HubSpot widget, and records whether the AI disclosure actually appears — with timestamped evidence either way. Free scan at launch.
Join the launch list