Hospitality & catering · AI Act

Hospitality & catering — AI Act: chatbots and recommendation

The establishment uses AI for booking chatbots and offer recommendations. Under the AI Act, these uses generally fall under limited risk, with transparency requirements. This guide clarifies the qualification and key points of vigilance.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Hotels, restaurants and groups deploying chatbots and recommendation systems are deployers; software vendors are providers.
  • Qualify use cases.
  • Report chatbots.
  • Prohibit manipulation.
  • For limited-risk uses, the AI Act translates primarily into transparency obligations; prohibited manipulative practices expose organisations to up to €35M or 7%.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act requires transparency regarding interaction with an AI (chatbots) and generated content. Offer recommendations, without manipulation, fall under limited risk. Manipulative techniques are prohibited.

The underlying profiling remains governed by GDPR.

Is the 'Hospitality & Catering' sector affected?

Hotels, restaurants and groups deploying chatbots and recommendation systems are deployers; software vendors are providers.

Uses without manipulation fall under limited risk.

Detailed obligations

Qualify use cases

Confirm the limited risk of chatbots and recommendation systems.

Flag chatbots

Disclosing interaction with an AI.

Prohibiting manipulation

Ruling out techniques that exploit vulnerabilities.

Articulate with GDPR

Governing recommendation profiling.

Sanctions & risks

For limited-risk uses, the AI Act translates primarily into transparency obligations; prohibited manipulative practices expose organisations to up to €35M or 7%.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Transparency. Progressive.

Common mistakes in the sector

  • 1Unreported chatbot. Not disclosing AI interaction.
  • 2Manipulation. Exploit vulnerabilities to sell.
  • 3Profiling ignored. Overlooking GDPR compliance.
  • 4Absent qualification. Failing to assess uses.

Practical case

A hotel group deploys a booking chatbot and an offer recommendation engine. As limited-risk uses, it discloses AI interaction, prohibits any manipulation and governs profiling under GDPR.

Compliance roadmap

  1. 1

    Inventory. Map chatbots and recommendations.

  2. 2

    Qualify. Confirm limited risk.

  3. 3

    Report. Chatbot transparency.

  4. 4

    Frame. Prohibit manipulation.

  5. 5

    Articulate. Govern profiling.

Frequently asked questions

Yes: interaction with an AI must be transparent.

Back to the Hospitality & catering guideHospitality & catering & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to hospitality & catering.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the hospitality & catering sector secured their compliance with DCO.

See testimonials