# Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions > No general UK rule says AI use must be labelled. Where you must tell people: their data, decisions made with no person involved, and anything that misleads. - Page to cite: https://aeolookup.com/ai-for-small-firms/do-you-have-to-tell-customers-you-used-ai-uk-rules/ - Publisher: AEO Lookup (https://aeolookup.com/) - Section: AI for small firms, Data, privacy and the rules - Published 1 October 2026 - Key fact: The ASA said on 29 May 2025 that there is "no blanket legal requirement in the UK to disclose the use of AI in ads". The firm duty to tell people comes from UK GDPR: since 5 February 2026, Articles 22A to 22D require a firm that takes a significant decision about someone with no meaningful human involvement to give them information about it and let them ask for a person to look at it again. - Sources: ASA and CAP, "Disclosure of AI in Advertising: Striking the Balance Between Creativity and Responsibility" (29 May 2025) and "AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit Run" (11 June 2026); ICO, draft guidance "Automated decision-making, including profiling" (updated 31 March 2026), "What privacy information should we provide?" and "How do we ensure transparency in AI?" (15 March 2023); UK GDPR Articles 22A and 22C, and the Digital Markets, Competition and Consumers Act 2024, sections 225 to 227 and Schedule 20 paragraph 13, on legislation.gov.uk; European Commission, "AI Act" policy page; all read in a browser on 2026-10-01. Not legal advice. Mostly no. No general UK rule says an email drafted with AI, a website chatbot or an advert made with AI has to carry a label, and the ASA said on 29 May 2025 that there is "no blanket legal requirement in the UK to disclose the use of AI in ads". A duty to tell people does exist in three places: when their personal data goes to an AI supplier, when a significant decision about them is taken with no meaningful human involvement (Articles 22A to 22D of UK GDPR, fully in force since 5 February 2026), and when staying silent would mislead them. ## Five uses, sorted | Use | Do you have to say AI was used? | The rule that does apply | |---|---|---| | An email or letter drafted with AI and sent by a person | No rule we read requires it | If customer details went into the tool, the privacy notice must say who receives them | | A chatbot on the website | No UK rule we read requires a label | It must not give false information, and privacy information is due when it collects personal data | | An advert or image made with AI | No blanket requirement (ASA, 29 May 2025) | The advert must not mislead, and a label does not rescue one that does | | A customer review written by AI | It cannot lawfully be posted at all | Fake consumer reviews are banned (in force since 6 April 2025) | | A significant decision about a person, with no person involved | Yes | Articles 22A to 22D of UK GDPR | ## Emails and letters UK GDPR is about what happens to a person's data, not about who or what chose the words. The ICO's guidance on the right to be informed says a privacy notice must give the recipients of the data, and that these include "anyone that processes the personal data on your behalf". So a firm that pastes a customer's details into an AI tool owes that customer a line in its privacy notice about the supplier, after the [five checks that come first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). It does not have to mark the email itself. Regulated trades add more. The [SRA's warning notice for solicitors](https://aeolookup.com/solicitors/sra-ai-warning-notice-small-law-firm-ai-policy/) and the [tax bodies' guidance for accountants](https://aeolookup.com/accountants/can-accountants-use-chatgpt-copilot-claude-client-data/) both deal with what clients are told. ## Chatbots We found no rule in the ICO's pages, the ASA's pages or the Digital Markets, Competition and Consumers Act 2024 that says a chatbot must announce itself. Two rules still apply. First, section 226 of the 2024 Act makes it a misleading action to give false or misleading information about a product, a trader "or any other matter relevant to a transactional decision". Section 225 prohibits it where it is likely to change the average consumer's decision. A chatbot that invents a price or a returns right gives false information. One that says it is a person when asked may do the same. That last reading is ours: we found no ruling that tests it. Second, the ICO says a firm that collects personal data directly from people must give them privacy information at the time it collects it. A chatbot that takes a name or an order number is collecting it. The EU differs. The European Commission's page on the AI Act says people using a chatbot "should be made aware that they are interacting with a machine", and gives August 2026 as the date the Act's transparency rules take effect. That is EU law, not UK law. A firm whose chatbot serves EU customers should check whether it applies. ## Adverts and images The ASA's article of 29 May 2025 says the advertising codes contain no AI-specific rules and that the existing rules apply however the content was made. The question it asks is whether the audience is likely to be misled if the use of AI is not disclosed. It also says a label will not rescue a misleading advert. Its example is an AI-generated image of a cosmetic product's effect that does not reflect real results. On 11 June 2026 it added that an AI-generated celebrity endorsement real enough to mislead is likely to breach the code, and that the advertiser stays responsible even when automated tools made the advert. ## Reviews Schedule 20 of the 2024 Act, at paragraph 13, bans submitting a fake consumer review, or commissioning someone else to write one. A fake review is one that "purports to be, but is not, based on a person's genuine experience", and writing "includes creating by any means". An AI-written review posted as a customer's is banned with or without a label. Our guide to [asking for reviews after the ban](https://aeolookup.com/online-shops/how-to-ask-for-customer-review-fake-reviews-ban/) covers what a shop can still do. ## Automated decisions: where you must tell The ICO's draft guidance says the rules apply when three things are present: a system makes a decision about a person, the decision has a legal or similarly significant effect, and there is no meaningful human involvement. Its examples include the automatic refusal of an online credit application. When all three are present, Article 22C says the firm must: 1. give the person information about the decision; 2. let them make representations about it; 3. let them obtain human intervention; 4. let them contest it. The ICO says to explain how at the point the decision is given. The privacy notice must also say that such decisions are made. A person who approves every result unread does not take the firm outside these rules. The ICO says human involvement must be "active and not just a token gesture". The [guide to AI CV screening](https://aeolookup.com/recruitment/ai-cv-screening-ico-rules-recruitment-agencies/) shows what that means for a shortlist. The guidance is a draft under consultation. The Articles are law. ## Wording to copy **Privacy notice.** "We use AI software to help draft letters, emails and summaries. Our suppliers are [names]. They process your information on our instructions under a written contract. [Where the data is held.] A member of staff checks what the software produces before it is used." **Chatbot opening line.** "I am an automated assistant. I can answer questions about [topics]. Ask for a person at any time and we will reply by [time]." **Automated decision.** "This decision was made by software with no person involved. It was based on [factors]. You can tell us why you think it is wrong, ask for a person to look at it again, or contest it, by contacting [name and address]." The first and third meet duties described above. The second is a choice. ## Where there is no rule On the sources read for this page, nothing in UK law requires a label on an AI-drafted email, a chatbot or an AI-made advert. That may change: the ASA says it is ready to alter its approach, and the ICO has said it will develop a statutory code of practice on AI and automated decision-making. Whether to tell customers anyway is the owner's decision. A [one-page AI policy](https://aeolookup.com/ai-for-small-firms/ai-policy-template-small-uk-firm-one-page/) is the place to record it. Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) is an AI agency that sets up AI office assistants for ten trades: they are set up in the firm's own office for a fixed price agreed after an audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer. This page is general information, not legal advice. ## Short answers from this page **Do I have to tell customers that an email or advert was made with AI?** No general UK rule requires it. The ASA said on 29 May 2025 that UK law has no blanket requirement to disclose the use of AI in adverts. The advert must still not mislead, and if customer details went into an AI tool the privacy notice must name the supplier or its category. **When must a UK firm tell someone that a decision about them was automated?** When a significant decision is taken with no meaningful human involvement. Articles 22A to 22D of UK GDPR, fully in force since 5 February 2026, require the firm to give information about the decision and let the person make representations, obtain human intervention and contest it. --- ![](https://aeolookup.com/img/d/owner-line.png) General information for UK small firms, not legal, tax or financial advice.