Tourism & leisure · AI Act

Tourism & leisure — AI Act: recommendation engines and chatbots

The tourism sector uses AI to recommend stays and assist customers via chatbots. Under the AI Act, these uses generally fall under limited risk, with a transparency obligation. This guide clarifies the classification and key points of vigilance.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Tour operators, agencies, and platforms deploying recommendation engines and chatbots are deployers; software publishers are providers.
  • Qualify use cases.
  • Report chatbots.
  • Prohibit manipulation.
  • For limited-risk uses, the AI Act translates primarily into transparency obligations; prohibited manipulative practices expose organisations to up to €35M or 7%.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act requires transparency regarding interactions with AI (chatbots) and generated content. Recommendation without manipulation falls under limited risk. Manipulative techniques are prohibited.

The underlying profiling remains governed by GDPR.

Is the 'Tourism & leisure' sector concerned?

Tour operators, agencies, and platforms deploying recommendation engines and chatbots are deployers; software publishers are providers.

Uses without manipulation fall under limited risk.

Detailed obligations

Qualify use cases

Confirm the limited risk of the recommendation.

Flag chatbots

Disclosing interaction with an AI.

Prohibiting manipulation

Ruling out techniques that exploit vulnerabilities.

Articulate with GDPR

Governing recommendation profiling.

Sanctions & risks

For limited-risk uses, the AI Act translates primarily into transparency obligations; prohibited manipulative practices expose organisations to up to €35M or 7%.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Transparency. Progressive.

Common mistakes in the sector

  • 1Unreported chatbot. Not disclosing AI interaction.
  • 2Manipulation. Exploit vulnerabilities to sell.
  • 3Profiling ignored. Overlooking GDPR compliance.
  • 4Absent qualification. Failing to assess uses.

Practical case

A tour operator deploys a chatbot and a stay recommendation engine. These are limited-risk uses: it discloses AI interaction, prohibits any manipulation, and governs profiling under GDPR.

Compliance roadmap

  1. 1

    Inventory. Map recommendations and chatbots.

  2. 2

    Qualify. Confirm limited risk.

  3. 3

    Report. Chatbot transparency.

  4. 4

    Frame. Prohibit manipulation.

  5. 5

    Articulate. Govern profiling.

Frequently asked questions

Yes: interaction with an AI must be transparent.

Back to the Tourism & leisure guideTourism & leisure & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to tourism & leisure.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the tourism & leisure sector secured their compliance with DCO.

See testimonials