EU AI Act and GDPR in hotels: what actually applies from August 2026

Few topics generate more half-knowledge in hospitality right now than the EU AI Act. The good news: for a typical hotel, the situation is far more relaxed than many consultants sell it. The bad news: ignoring it entirely is not an option either. Here is the state of play — July 2026, after the Digital Omnibus agreement.

Note: this article is practical orientation from a hotelier's perspective, not legal advice. For binding questions, get a lawyer at the table.

What applies when? The timeline in short

• Since February 2025: banned AI practices (e.g. social scoring) and the duty to ensure staff working with AI are trained for it (AI literacy, Art. 4).
• From 2 August 2026: general transparency and registration duties. If guests interact with an AI chatbot or voice agent, that must be recognizable.
• From 2 December 2026: labeling duty for AI-generated content (watermark or machine-readable).
• Postponed to 2 December 2027: the strict high-risk obligations. The EU moved this deadline with the Digital Omnibus agreement of late June 2026.

Is the AI in my hotel "high-risk"?

In the vast majority of cases: no. A guest-facing chatbot, an AI-powered handover tool, automatic translation, or a revenue suggestion system are not high-risk systems under the AI Act. They carry transparency and diligence duties, not the heavy compliance program.

The important exception is HR: AI that participates in decisions about hiring, promotion, termination, or performance evaluation of employees counts as high-risk. If you use AI in recruiting or staff evaluation, take that seriously — even though the hard obligations now only bite from late 2027.

What do I concretely have to do as a hotelier?

1. 1

   Take an AI inventory

   A simple list: which tools with AI run in the house — chatbot, channel manager, handover tool, translation? No inventory, no compliance statement.

2. 2

   Be transparent with guests

   Wherever a guest talks to AI (chatbot, voice agent on the phone), that must be recognizable from August 2026. An honest notice is enough — hiding it is no longer an option.

3. 3

   Train the team and document it

   The AI literacy duty already applies. A short, documented briefing on what the tool can and cannot do covers everyday use.

4. 4

   Check your GDPR basics

   The AI Act does not replace the GDPR — it runs in parallel. Every tool touching guest or employee data needs a data processing agreement, a look at server location, and a deletion concept.

5. 5

   Treat HR AI separately

   Anything that evaluates employees or decides about them: either postpone it or set it up properly — half-hearted is the worst option here.

What should I look for in AI vendors?

Three questions separate serious vendors from risky ones: Where does the data live (EU data residency)? Is there a data processing agreement without negotiation? And does the system tell users it is AI? A vendor who cannot answer these three in one sentence has not done their homework.

We built avvicenda™ this way from day one: all data hosted in the EU, a data processing agreement for every customer, voice notes deleted after transcription. AI regulation is not a retrofit for us — it is part of the product.

Do I have to register my hotel anywhere?

As a pure user ("deployer") of standard AI tools, generally no — registration duties mainly target providers and high-risk systems. If in doubt, ask your tool vendor which role your house takes.

Are small hotels really facing fines?

The fine frameworks are high, but enforcement targets providers and gross violations — not the hotel that labels its chatbot honestly. If transparency, training, and GDPR basics are done, you are in good shape for daily operations.

What changed with the Digital Omnibus?

In late June 2026, the EU postponed the high-risk deadlines to December 2027 and agreed on relief for smaller companies. The transparency duties from August 2026 are untouched — those arrive as planned.