A chatbot processes personal data. When the type of data and work requires a data processing agreement, or the contract with your company provides for one, I sign it under Art. 28 GDPR, or Art. 28 UK GDPR for companies in the UK. I choose the provider so that the data is processed in the European Union. The assistant asks only for what it needs to answer, which for an order status check means the order number and email address. It does not collect health information, identity documents or payment details and passes such conversations to another channel. I delete conversation logs after the agreed period. The visitor sees clearly that AI is answering, which the EU AI Act has required since August 2026. I prepare the text of the notice for users, and approving it stays with you, because you are the data controller.