AI and the AI Act
Added in Thelia 3.3.
It explains in plain words what the European AI Act asks of a shop that uses artificial intelligence, and what Thelia does to help. It reflects the texts as read in October 2026. For your own situation, ask a lawyer.
What Thelia's AI layer is
Thelia 3.3 lets modules use a language model: a chat that answers visitors, a tool that writes a page, a job that compares prices. You connect your own account with a provider, give each kind of use a budget, and Thelia keeps a log of every call and what it cost.
Each thing a module does with a model is called a usage. A usage has a name such as commerceagents.shopping_assistant, an audience (visitors, customers, administrators or no one in particular) and a purpose in one sentence. You switch usages on and off one by one.
The settings are under Configuration > Artificial intelligence. They are described in AI settings and MCP.
Open Configuration > Artificial intelligence. The page shows nine tabs under its title: Connections (the one that opens first), Models, Ranges, Usages, Register, Consumption, Tools, Approvals and MCP tokens. The Add a connection button sits at the top right.
What the AI Act says about transparency
The AI Act is the European regulation (EU) 2024/1689. Its article 50 is about transparency and has applied since 2 August 2026. For a shop it comes down to four situations.
| Situation | What is asked |
|---|---|
| A visitor talks with a chatbot (article 50(1)) | Tell the person, from the first exchange, that they are talking with an AI. A line in the terms and conditions is not enough. |
| A system generates content (article 50(2)) | The content is marked as generated, in a form a machine can read (metadata, for example). Plain assistance with editing, or a change that does not alter the content substantially, is left out. |
| You publish AI-generated text to inform the public on matters of public interest (article 50(4)) | Either a label saying it was generated by an AI, or a human review with someone editorially responsible for the text. |
| Product descriptions and advertising | Outside this duty. The exception is a claim about health, safety or sustainability: then the previous line applies. |
Dates:
- Article 50 has applied since 2 August 2026.
- For a system that was already on the market before that date, the marking of generated content (50(2)) is due on 2 December 2026.
The regulation sets a fine of up to 15 million euros or 3 % of turnover for a breach of article 50 (article 99(4)). In France the authority in charge has not been settled: the law is not yet promulgated.
Two more points:
- Open source does not exempt a system from article 50. The Commission guidelines on article 50 say it explicitly.
- Whoever puts a system into service under their own name or brand is its provider, free of charge or not. A shop that publishes a chat under its own name is in that position.
What Thelia gives you
Thelia supplies tools and explanations. It never stops an AI usage because of the AI Act, and the decisions stay with you.
| Tool | How it works |
|---|---|
| Notice "you are talking with an AI" (Article 50(1)) | On by default for every usage that declares a conversation with a person. The Flexy theme shows it above the first message of the chat, through its Molecules:AiNotice:Base component, in the language of the visitor. You can turn it off per usage. |
| Provenance mark (Article 50(2)) | On by default for every usage that generates published content. Each generated content carries a record: that it is AI-generated, which usage, which model, when, and the number of the log row. The module stores it with the content and exposes it as machine-readable metadata. You can turn it off per usage. |
| Compliance status per usage | Each usage shows whether its duty is met, not met (you turned the tool off) or to be reviewed (a usage open to visitors or customers whose module did not say whether people talk with it). The status informs; the usage keeps running. |
| Register of AI usages | A list of every usage in the shop: module, purpose, audience, provider, model, obligations and status. It can be exported, and it is the record of how AI is used in your shop. |
| Log | Every call is logged with its usage, provider, model, tokens, cost and a hashed identifier of who made it. The text of the prompts is not stored unless you turn that on for a usage, with a retention period. |
The register is in Configuration > Artificial intelligence > Register. The table has the columns Module, Purpose (with the identifier of the usage under it), Audience, Provider, Model, Tools, Obligations and Status. The buttons Export as CSV and Export as JSON are at the top right of the page.
To change the duties of a usage, open Configuration > Artificial intelligence > Usages and click Configure on its row. At the bottom of the form, the section Transparency (Article 50) holds two switches: Tell people they are talking to an AI and Mark generated content as made by an AI. The Article 50 column of the Usages list shows the status of each usage: Respects Article 50, Does not respect Article 50, To review or No duty.
What your visitors see
The notice. On the storefront, a chat whose usage talks with a person shows a short message above the first exchange. In English it reads "You are talking with an AI assistant. Its answers can contain mistakes." Thelia has it in French and English. The text and the choice to show it come from the core: the theme holds no setting of its own. The notice does not appear when the usage is off, when you turned the notice off for it, or when the usage does not declare a conversation. The module that provides the chat has to include it on every state of its interface.
On the storefront the notice is a short informative message, with an information icon, placed above the first message of the chat.
The mark. The mark is metadata, not a visible label. The module stores it with the content and writes it in the page: the attributes data-ai-generated, data-ai-usage, data-ai-model and data-ai-generated-at on the element that holds the generated content. A module can also print a sentence such as "Content generated by an AI (model) on 2026-10-28." Thelia chose this form; the regulation does not fix a format. Check the guidance in force, and ask the author of your module whether it exposes the mark. It does not replace the label of Article 50(4) for text published to inform the public.
You switch the notice and the mark per usage, on the edit page of the usage in the Usages tab, under Transparency (Article 50). The status of a usage whose tool you turned off reads, in substance: this usage does not comply with article 50(1) or 50(2), people are no longer told, or generated content is no longer marked; turn the notice or the mark back on.
Providers and where data goes
Each connection to a provider shows where the provider processes the data: in the European Union or outside it.
| Provider | Jurisdiction shown by default |
|---|---|
| Mistral | European Union |
| Scaleway | European Union |
| OVHcloud | European Union |
| Albert (French State) | European Union |
| Thelia AI preset | European Union |
| OpenAI | Outside the EU, unless the connection uses the European endpoint https://eu.api.openai.com |
| Anthropic | Outside the EU |
| Ollama, compatible endpoint | You declare it: it is where you host the server |
European providers are the defaults Thelia proposes, and the others are allowed. A connection outside the EU works and shows a notice about the transfer of data outside the EU.
If you want to rule them out, an option "EU only" refuses any connection and any outside service that processes data outside the EU. It is off by default. With it on, a module that depends on such a service stops working until you turn the option off.
You find the option in Configuration > Artificial intelligence > Connections, in the block European Union only under the list: tick Refuse providers outside the European Union and click Save. The list has the columns Name, Identifier, Provider, Data processed, API key, Status, Last test and Actions; Data processed shows the jurisdiction of each connection. When at least one connection processes data outside the EU, a blue notice above the list says it is allowed, and the edit page of that connection starts with "This connection processes the data outside the European Union."
Your part
The tools do not make a shop compliant by themselves. What stays with you:
- Leave the notice and the mark on, or accept that the status shows the usage as not compliant.
- Check that the module you use displays the notice on every state of its interface. A module has to do it; the notice comes from Thelia.
- For text you publish to inform the public (news, guides, public-interest pages), add a label or have a person review it and answer for it. The mark in the metadata does not replace this.
- Check any claim on health, safety or sustainability in a description or an advertisement, because those fall back under the duty.
- Review what a chat tells visitors: no promise it cannot keep, no false urgency.
- Set budgets and the monthly cap, and read the log. A usage open to anonymous visitors stays inactive until you give it a budget above zero.
- Keep the register of AI usages up to date for your own records. It documents what you deploy.
- Say in your privacy policy that visitors' messages go to the provider you chose, and choose that provider knowing where it processes data.
One case the AI Act treats more strictly is not supported by Thelia: usages that rank people for access to credit, for instance an automatic assessment of the solvency of a customer for payment in several instalments, fall in the high-risk category. Do not build such a usage on the AI layer.
For developers
How a module declares a usage and shows the notice: see Calling an AI model from a module. The settings screens and the tools are in AI settings and MCP.