Offering an AI service: which rules and terms and conditions apply

A streaming service with series whose images are made by AI. A model agency with models who never existed. An app in which users chat with an AI character. Anyone offering a service like this deals with the AI Act, the GDPR, consumer law and sometimes the Dutch Media Act, all at once.

Which laws and rules does my service have to comply with? That is usually the first question we get. The second is about the terms and conditions for a service that runs on AI output.

Would you like to know what applies to your service? Call 020 675 88 21 or send a message using the form at the bottom of this page.

Which laws apply to an AI service you offer to the public

There is no separate law for AI services, so AI compliance is more than the AI Act alone. The AI Act mainly governs how you use AI and what you have to tell the public. Existing law still applies too, with the GDPR as soon as you process personal data and consumer law as soon as you supply consumers. If you work with someone else’s face or work, image rights and copyright come into play as well.

Which AI Act obligations fall on you depends on your role. If you develop the system yourself, or place it on the market under your own name, you are a provider. If you use someone else’s model in your service, you are a deployer. An app that gives an existing language model its own name and personality can be both. Put that division of roles on paper before you launch, because the disclosure duties below follow from it.

If users can upload content or share it with each other, the Digital Services Act comes in as well. You then have to give users, among other things, a way to report illegal content.

A chatbot or AI character must say that it is AI

Article 50 of the AI Act has applied since 2 August 2026. An AI system that interacts directly with people must be designed so that users know they are talking to AI. That duty lies with the provider. The notice must be there at the latest at the first interaction, clear and distinguishable (Article 50(1) and (5)).

The law makes an exception where it is already obvious to a reasonably well-informed and observant user that they are dealing with AI. For an app that advertises itself as an AI girlfriend, that may well be the case, but we still recommend a standard notice at the start of each conversation. If a character claims to be human or denies being an AI when the user asks, in our view it does not fall under the exception.

Marking generated images, voices and deepfakes of real people

If your service produces images, video, audio or text, the provider of the AI system must mark that output in a machine-readable way, so it can be detected as artificially generated (Article 50(2)). For systems already on the market before 2 August 2026, the Digital Omnibus, Regulation (EU) 2026/1744, postpones that duty to 2 December 2026.

If the output resembles a real person, the deepfake rule applies as well. Whoever distributes the content must disclose that it is artificial (Article 50(4)). For an AI series or other evidently fictional or artistic work, a notice that does not spoil the viewing is enough, although exactly where it should go has not yet been settled.

When you have to label AI content →

For a model agency with AI models, this is where the biggest risk lies. An AI model that recognisably resembles a real model or a Dutch celebrity affects that person’s image rights (Article 21 of the Dutch Copyright Act). If you train your AI on photos of real models, record in writing that they consent, what you use their image for and what they receive for it.

When an AI companion falls under the AI Act prohibitions

Since 2 February 2025, Article 5 of the AI Act has prohibited a number of practices. Two of them concern an app with AI friends or AI partners. A system may not use manipulative or deceptive techniques that materially distort someone’s behaviour and thereby cause significant harm (Article 5(1)(a)). Nor may it exploit a vulnerability arising from someone’s age, disability or specific social or economic situation (point (b)).

If your app targets lonely users, that second prohibition is close at hand. A character that makes people feel guilty when they want to stop or keeps pushing for a more expensive subscription soon runs into it. Do not build in incentives like these. Record which instructions the model is given and keep every version.

A breach of these prohibitions can cost up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. The AI Act has no higher fines.

Personal data from conversations and the GDPR

If a user has an account or tells the service anything about themselves, you are processing personal data and the GDPR applies. Your privacy notice states what happens to conversations and how long you keep them.

In a companion app, users talk about their health, their relationships and their sex life. That is special category data (Article 9 GDPR), which as a rule you may only process with explicit consent. If you want to use the conversations to train the model further, ask for that separately. And make withdrawing consent as easy as giving it.

Age matters too. If a user is under 16, a parent must consent for an online service (Article 8 GDPR). If your service is for adults only, check age at sign-up. We advise on this together with our data protection practice.

Terms and conditions for an AI service: what they should cover

Standard app terms miss what matters for an AI service. Start with the output. What an AI produces on its own is often not protected by copyright, so you cannot assign it either. Set out in a licence what the user may do with the output and what you may do with it.

More about copyright in AI output →

If your service runs on someone else’s model, read that provider’s terms first, because they determine what you can promise your own users. Do not give away more than you received.

Also state what users may not create: deepfakes of real people, sexual images of minors, work that infringes someone else’s. And what happens if someone does it anyway. The content comes down, and on repeat so does the account.

Excluding liability towards consumers only works to a limited extent. Under Dutch law, a clause that releases you from a statutory obligation to pay damages is presumed unreasonably onerous in consumer terms (Article 6:237(f) of the Dutch Civil Code). For products placed on the market after 9 December 2026, the revised product liability rules apply as well, which cover software and AI systems too and cannot be excluded by contract.

Terms only work if you provide them in time. In an app, that means before sign-up, in a form the user can save.

A VOD platform with AI series falls under the Dutch Media Act

If your platform offers a catalogue of series or films for which you make the editorial choices, it is a commercial on-demand media service, even when the series are made with AI. The Dutch Media Authority (Commissariaat voor de Media) supervises it.

If you generate 10 million euros or more in turnover in the Netherlands, the investment obligation applies. You invest 5 percent of that turnover in Dutch films, series and documentaries (Article 3.29e of the Dutch Media Act). At least 60 percent of that goes to independent productions (Article 3.29g). Whether a series made entirely with AI counts towards it has not yet been tested.

How Liaise assists providers of AI services

We check your service against the AI Act, the GDPR and consumer law, so that you know what is required and where your risk lies. Drafting the terms and conditions, the privacy notice and the in-app notices is part of the work too. We put your AI supplier’s terms next to yours.

Liaise works for producers, platforms, agencies and creators in the media and creative sector. Read more about our work on the page on AI law.

Are you launching an AI service, or would you like your terms reviewed? Call 020 675 88 21 or send a message using the form below.