Digital Fairness Act: what the EU proposes for chatbot customer service and AI shopping agents

On 11 November 2026 the European Commission adopted its proposal for a Digital Fairness Act, reference COM(2026) 1100 (procedure 2026/0356 (COD)). It is a draft regulation: it binds no one until the European Parliament and the Council adopt it, and the press release only says they will now examine it.

Most of the text deals with dark patterns, influencer marketing, virtual currencies in games, subscriptions and pricing (Commission page). This article keeps only what touches AI: automated customer service, agents that buy on a consumer's behalf, personalised pricing and the nudges of conversational assistants. For the rest of EU AI law, see our Society & law section.

A right to reach a human in customer service

Article 25 of the proposal fits in one sentence: where a trader provides online customer service after the conclusion of a contract, it "shall ensure that, upon request of the consumer and when other means are not effective, communication with a human being is made available".

The article never uses the word chatbot. It covers any online customer service, so also one run by an automated assistant. Recital 76 of the proposal describes what is expected:

• the exchange can happen online or by other means, including email or instant messaging;
• in the language used to conclude the contract, free of charge and without undue delay, during the trader's opening hours;
• when assessing a breach, authorities could weigh the difficulties the consumer faced against the burden of human intervention, in particular given the size of the business.

Two limits stand out: the right applies only after the sale, not to a simple pre-purchase question, and investment services are excluded. The Commission's Q&A describes it as a right to access human customer service when a problem arises in an ongoing contract and other means are not enough.

AI shopping agents: mandatory settings and flagged paid suggestions

This is the newest part. The press release announces "clear rights" for consumers who use AI agents to buy on their behalf. The legal text speaks instead of "automated systems" for contracting, and recital 77 of the proposal says this includes the deployment of AI systems, in a technology-neutral way.

Article 26 of the proposal targets traders that make such systems available to consumers. They would have to:

• provide "easily accessible, understandable and effective tools" to set the agent's parameters, which the consumer can change at any time (Article 26(1));
• on first use, make the consumer expressly choose between three options: confirm all contracts the agent proposes, confirm only some types based on criteria the consumer sets ("including a maximum price and a time limit"), or confirm none (Article 26(2));
• send a confirmation of that choice on a durable medium;
• where the consumer confirms, show at least part of the pre-contractual information required by the Consumer Rights Directive (2011/83/EU);
• disclose any payment received for proposing a contract and any conflict of interest with the trader concerned, and in that case require the consumer's confirmation, whatever setting was chosen.

Recital 78 gives two cases of such a conflict: a "sponsored suggestion" by the agent, or an agent promoting the products of the trader that provides it. It adds that using an agent does not mean waiving any consumer right, even with no confirmation selected. Sponsored placements in agents are already appearing: see what Businesses in ChatGPT means for European companies.

For sellers, Article 26 bans designing an interface so that consumers must use an automated system to access it or buy on it (recital 78 mentions access to special offers). The agent would pass on the contact details needed to perform the contract, and the seller would send an order confirmation on a durable medium. Traders and agent providers could identify themselves with the European Digital Identity Wallet or the planned European Business Wallet. Financial services are excluded.

In return, Article 27 of the proposal lightens the rules when a contract is concluded solely between two automated systems, the consumer's agent and the seller's: pre-contractual information could be given only in a commonly used machine-readable format. The Q&A presents this as a simplification for automated contracts.

Personalised prices and ads: what would be banned

Article 13 of the proposal bans personalising a price based on profiling, as defined in the GDPR, in a way reasonably likely to harm the consumer, where the trader knows with reasonable certainty that the consumer is a minor or vulnerable "due to their age, credulity, disability, or any specific misfortune or circumstance of such gravity as to impair the consumer's judgment". It is not a general ban on personalised pricing.

Recital 60 of the proposal sets the reach: the ban mainly targets higher prices, but can cover a lower price that steers someone towards a harmful product. It does not cover personalisation that favours the consumer, such as student or senior discounts, nor differences based on lawful, relevant, objective and transparent factors (the text cites risk in insurance). Traders would not have to process extra personal data to check age or vulnerability.

Article 12 extends to every trader a ban that the Digital Services Act reserves for online platforms: no profiling-based targeted advertising using a minor's data, or using special categories of data under Article 9 of the GDPR, such as health or ethnic origin. According to the Commission's Q&A, these bans would move from platforms alone to all websites and apps.

The nudges of conversational assistants

Article 17 of the proposal, headed "Addictive design", would require digital products designed in a way that can reasonably be foreseen to encourage compulsive or excessive use to offer effective tools to switch off certain features. The list includes "features and system behaviours that encourage continued use by simulating interpersonal relations, such as persistent prompts to continue engaging with an automated system". Recital 66 names AI companions and general-purpose conversational chatbots, which "may simulate interpersonal relations to incentivise prolonged use".

For minors, the proposal defers to the EU KIDS Act, another Commission proposal presented on 17 September 2026 and covered in our piece on France's report on generative AI and vulnerabilities. Traders covered by the relevant KIDS Act articles are carved out of Article 17 for practices concerning minors, to avoid overlap.

How it fits with the AI Act and the DSA

The explanatory memorandum of the proposal says it protects consumers regardless of the technology used, and complements the AI Act by setting certain rules that AI tools must respect when consumers use them. On the Digital Services Act, it says it covers the fairness of commercial practices whatever the business model, without duplicating a regulation that targets only online intermediaries.

Source: proposal COM(2026) 1100 of 11 November 2026, Articles 4, 12, 13, 17, 25, 26 and 30; compiled by Le Latent.

Article 4 settles conflicts: the regulation applies without prejudice to the GDPR, the DMA, the DSA, the AI Act, the Audiovisual Media Services Directive and the future KIDS Act, and where they conflict, those specific rules prevail on the aspects they govern. For Article 17, Article 30 hands enforcement to the authorities designated under the DSA for platforms, and to the AI Act authorities (Articles 70, 74 and 75 of that regulation) for providers and deployers of AI systems. For the AI Act's own deadlines, see the EU AI Act timeline after the 2026 delay.

Timeline: nothing before adoption, then 12 months

The ordinary legislative procedure now begins: the European Parliament and the Council each adopt a position, then agree on a common text. The Commission has announced no adoption date.

Under Article 40 of the proposal, the regulation would enter into force on the twentieth day after publication in the Official Journal of the EU and apply "[12 months after the entry into force]". The square brackets mean the delay can change during negotiations. As a regulation, it would be "directly applicable in all Member States", with no national transposition law, and it would repeal the Unfair Commercial Practices Directive 2005/29/EC, which each country wrote into its own law.

What it means for companies outside the EU

The proposal's explanatory memorandum notes that the directive it would replace already "applies to any trader targeting consumers in the EU, including when these traders are established outside the EU" (proposal). A US or UK retailer, or an agent provider selling to EU consumers, should therefore expect the new rules to reach it as well. The Commission's factsheet also lists action beyond EU borders among its enforcement goals, without details at this stage.

On penalties, Article 35 of the proposal leaves fines to member states, with a maximum of at least 4% of the trader's annual turnover in the member states concerned in coordinated actions between national authorities, or at least EUR 2 million when that turnover is unknown. The factsheet adds that the Commission could impose fines of up to 6% of worldwide annual turnover in major EU-wide cases, a power that depends on the revised Consumer Protection Cooperation Regulation proposed the same day.

What an online seller or agent provider can prepare

Nothing is mandatory as of 13 November 2026, and the text may change. But if you sell online with a customer service assistant or build a shopping agent, the proposal already shows the work, assuming it is adopted as drafted:

• Customer service: plan an escalation to a human, available after the sale, in the language of the contract, at no cost. The point is to show that the chatbot is not a dead end.
• Shopping agent: a choice screen on first use (confirm all, confirm by criteria, confirm none), confirmation of that choice on a durable medium, settings that can be changed at any time, and disclosure of paid placements and conflicts of interest with mandatory confirmation.
• Online shop: do not reserve offers for purchases made through an agent, and be ready to receive orders placed by third-party agents, with a confirmation sent on a durable medium.
• Pricing: check whether a profiling-based pricing engine can reach minors or vulnerable people; student or senior discounts remain possible.
• Consumer chat assistant: plan a setting to turn off prompts that push users to keep chatting.

For obligations already in force on AI agents and assistants, the reference text remains the AI Act. On personal data, the profiling covered by Articles 12 and 13 refers to the GDPR, whose rights can already be used: see how to object to your personal data being used to train AI.

What we checked

We read the official English text of proposal COM(2026) 1100, the press release IP/26/2407, the Q&A QANDA/26/2408, the Consumer Package factsheet and the Commission news article. Quotations come from the English versions.

The press release and the factsheet speak of "AI agents" and a right to human customer service; the legal text speaks of "automated systems" and "communication with a human being", and Article 25 never says "chatbot". We follow the legal text.

What is not known: the adoption date, the positions of the European Parliament and the Council, and the final wording of the articles cited, which may change during negotiations.