AI Act compliance for WordPress sites
Written for any WordPress site running AI features, whichever plugin does the work: a chatbot, a writing assistant, an image generator, a translation tool, an AI SEO plugin. What the Regulation asks of that setup, and what it does not.
The plugin is not the question, the system is
The AI Act does not ask which plugin you installed. It asks what the resulting system does, who it affects, and whose name is on it. A chatbot, a content generator and an AI SEO tool all raise the same three questions.
You are usually the deployer
Running an AI feature on your own site, under your own authority, in a professional capacity puts you in the deployer role, with duties on oversight, input data and telling people what they are dealing with.
Sometimes you become the provider
Shipping a site you built to a client under their name, or substantially changing what an AI feature is meant to do, can move you into the provider role, with a materially heavier set of obligations.
Location is not the test
If the system, or what it produces, is used in the Union, the Regulation can reach you wherever the site is hosted and wherever you are established.
Risk first, then role
Start with what the AI feature can do to people. The risk tier decides how much is at stake; the role decides who carries it. Doing it the other way round is how sites get misclassified.
Risk
Most WordPress AI features sit at limited risk: they interact with people or generate content, so Article 50 transparency applies. A few, typically where the output feeds hiring, credit, education or access to services, sit higher.
Role
Deployer for your own site, provider once it goes out under someone else's name or you change its purpose. Agencies frequently hold both roles across different client sites at the same time.
Compliance score
What you already have: the disclosure where the AI feature appears, who reviews what it produces, what happens when it gets something wrong, and whether any of it is written down.
The routes described on this page are common cases, not conclusions. Every implementation needs its own analysis: the same plugin, configured differently, can land in a different tier with a different role attached.
What a compliant setup looks like
For a typical limited-risk AI feature. Most of it is a plugin setting or a short document, not a new system.
On the site
- A clear disclosure wherever the AI feature is visible: a chat window, a byline, a generated-content notice.
- A defined scope for the feature, with a way for it to decline what falls outside that scope.
- Logging switched on where the plugin supports it, with a retention period you have actually decided.
- Marking on generated images or media, where the feature produces them.
- Limits on any automated action the feature can take unattended.
On paper
- A note of the role and risk classification, and the reasoning behind it.
- Who is responsible for the feature, and who reviews it when it misbehaves.
- Which plugin and provider is in use, and what happens to the data sent to them.
- Evidence that the people operating it have been given guidance, under Article 4.
- For client sites, which of you holds which role, agreed before launch rather than after.
Building specifically on AI Engine Pro? Our AI Engine Pro page goes deeper on that plugin's own settings.
The dates that matter
The Digital Omnibus changed when the high-risk rules arrive. The milestones already in force remain in place.
Updated for Regulation (EU) 2026/1744, published on July 24th, 2026-
AI literacy and prohibited practices The first prohibited-practice rules and the AI literacy framework began to apply.
-
Governance and GPAI obligations EU governance provisions and obligations for providers of general-purpose AI models became applicable.
-
Transparency and wider application Article 50 transparency duties and most remaining AI Act provisions apply, subject to the amended transitions.
-
Content marking transition and new prohibited practices The transition point for certain pre-existing generative systems and the new prohibited-practice provisions applies.
-
Stand-alone high-risk systems The high-risk rules for systems classified under Article 6(2) and Annex III apply.
-
High-risk systems in regulated products The high-risk rules for systems classified under Article 6(1) and Annex I apply.
Qualified EU lawyers, specialised in AI
Most AI features shipped on WordPress sites today are not compliant, and the exposure is not only regulatory. European visitors have become genuinely attentive to how AI is disclosed, and a site that hides it carries a reputational cost as well as a legal one.
- Role and risk classification, argued and documented
- Gap analysis against the obligations that actually apply
- Transparency notices under Article 50
- AI literacy training for the teams operating the site
Find out where your site actually sits
Seven short steps. It asks what the AI feature does, not which plugin runs it.