European Union
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
The European Union has the world's most comprehensive enacted AI-behavior legal framework, built on three interlocking pillars. The AI Act (Regulation 2024/1689), in phased application from 2025 through 2027, bans certain public-authority AI uses outright (Article 5), requires bot-disclosure and synthetic-content labeling (Article 50, effective August 2026), and mandates training-data transparency and copyright opt-out compliance for General-Purpose AI providers (Article 53, enforcement from August 2026). The GPAI Code of Practice (published July 2025) operationalizes Article 53's crawler obligations, explicitly requiring signatories to honor robots.txt per RFC 9309. The DSM Directive (2019/790) Article 4 TDM exception underlies the opt-out regime: rights holders may reserve their works against commercial text-and-data mining via machine-readable signals, and GPAI providers must respect those reservations. GDPR Article 22 (Regulation 2016/679, fully in force since 2018) adds a cross-cutting right not to be subject to solely-automated decisions with legal or significant effects, applicable to both government and private actors across all 27 Member States.
Enacted law
Government obligations
| Instrument | Category | Effective | Source |
|---|---|---|---|
| DSM Directive — Article 4 (Text and Data Mining Opt-Out for Commercial Purposes) (Directive (EU) 2019/790, Art. 4) | Crawlers & training data | 2021-06-07 | EUR-Lex official directive text; Kluwer Copyright Blog LAION analysis; IPKat Dutch court ruling February 2025; EATW Article 4 explainer; Stanford CIS TDM analysis |
| EU AI Act — Article 26 / Annex III (High-Risk AI: Public-Authority Deployer Obligations) (Regulation (EU) 2024/1689, Art. 26 and Annex III) | Automated decision-making, Bot / agent disclosure | 2027-12-02 | EUR-Lex official text; EU AI Act Service Desk Art. 26 guidance; Hyperproof Ultimate Guide; artificialintelligenceact.eu Art. 6 and Art. 26; Gibson Dunn Omnibus analysis May 2026 |
| EU Artificial Intelligence Act — Article 50 (Transparency for Bots and Synthetic Content) (Regulation (EU) 2024/1689, Art. 50) | Bot / agent disclosure | 2026-08-02 | EUR-Lex official text (OJ L 2024/1689); European Commission draft guidelines May 2026; Greenberg Traurig analysis June 2026; WilmerHale AI Act blog; artificialintelligenceact.eu |
| EU Artificial Intelligence Act — Article 5 (Prohibited AI Practices, Public Authorities) (Regulation (EU) 2024/1689, Art. 5) | Automated decision-making, Bot / agent disclosure | 2025-02-02 | EUR-Lex official text; Future of Privacy Forum analysis; Bundesnetzagentur guidance; EU AI Act Service Desk; artificialintelligenceact.eu |
| GDPR — Article 22 (Right Against Automated Individual Decision-Making) (Regulation (EU) 2016/679, Art. 22) | Automated decision-making | 2018-05-25 | EUR-Lex official regulation text; CJEU C-634/21 SCHUFA judgment December 2023; TechPolicy.Press right-to-explanation analysis; European Commission ADM guidance; IAPP GDPR/AI Act mapping |
Private sector obligations
| Instrument | Category | Effective | Source |
|---|---|---|---|
| DSM Directive — Article 4 (Text and Data Mining Opt-Out for Commercial Purposes) (Directive (EU) 2019/790, Art. 4) | Crawlers & training data | 2021-06-07 | EUR-Lex official directive text; Kluwer Copyright Blog LAION analysis; IPKat Dutch court ruling February 2025; EATW Article 4 explainer; Stanford CIS TDM analysis |
| EU Artificial Intelligence Act — Article 50 (Transparency for Bots and Synthetic Content) (Regulation (EU) 2024/1689, Art. 50) | Bot / agent disclosure | 2026-08-02 | EUR-Lex official text (OJ L 2024/1689); European Commission draft guidelines May 2026; Greenberg Traurig analysis June 2026; WilmerHale AI Act blog; artificialintelligenceact.eu |
| EU Artificial Intelligence Act — Article 53 (GPAI Training-Data Disclosure and Copyright Opt-Out) (Regulation (EU) 2024/1689, Art. 53) | Crawlers & training data, Bot / agent disclosure | 2026-08-02 | EUR-Lex official text; European Commission GPAI TDS Template July 2025; WilmerHale TDS Template analysis; Paul Weiss client memo; coronium.io August 2026 enforcement briefing |
| GDPR — Article 22 (Right Against Automated Individual Decision-Making) (Regulation (EU) 2016/679, Art. 22) | Automated decision-making | 2018-05-25 | EUR-Lex official regulation text; CJEU C-634/21 SCHUFA judgment December 2023; TechPolicy.Press right-to-explanation analysis; European Commission ADM guidance; IAPP GDPR/AI Act mapping |
| GPAI Code of Practice — Copyright and Crawler Chapter (EU AI Office, General-Purpose AI Code of Practice (Final), Ch. 2 (Copyright), July 10, 2025) | Crawlers & training data | 2025-08-02 | EU AI Office Code of Practice (code-of-practice.ai); Jones Day analysis August 2025; Clifford Chance copyright compliance briefing; Stibbe GPAI overview; artificialintelligenceact.eu Code overview |
Drafted & in discussion
| Instrument | Status | Applies to | Category | Source |
|---|---|---|---|---|
| EU Digital Omnibus — AI Act Amendments (Provisional Agreement) (Provisional political agreement, Council of EU / European Parliament, May 7, 2026 (amending Regulation (EU) 2024/1689)) | Proposed | Both | Bot / agent disclosure, Automated decision-making, Crawlers & training data | Council of the EU press release 2026-05-07; Gibson Dunn analysis; Latham & Watkins EU AI Act Update; Addleshaw Goddard briefing; White & Case Digital Omnibus alert |
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | security mechanism bypass |
| Public-page carve-out | yes |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | tdm dual track |
| Text and data mining — commercial status | with optout |
| Text and data mining — opt-out mechanism | tdmrep |
| robots.txt legal weight | statutory |
| AI training-specific law | binding |
| Privacy regime | GDPR |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-21. Confidence: medium. Fast-moving area — verify before relying. Not legal advice.