AI Act for hotels and rentals 2026: what applies now

Hardly any hotel, hostel or apartment manager has ever bought “an artificial intelligence system”. What they have done is accumulate tools: a chatbot on the website, a message translator, a text generator for the listing, an assistant that drafts review replies, a demand-forecasting module, perhaps a CV filter. Each arrived on its own, one person configured it, and nobody holds the full list.

That list is now an obligation. Since 2 August 2026 the transparency duties of the EU Artificial Intelligence Act apply, and since that same summer the authorities can supervise the AI literacy the regulation has required since February 2025. In Spain, the market surveillance authority is AESIA (Agencia Española de Supervisión de la Inteligencia Artificial), and the Spanish parliament is processing the organic law that will set national penalties.

This article turns the regulation into an operating map for an accommodation business: which uses you have, which role you play with each, what notices the guest must see, what is prohibited, who needs training and how to set it all up in 30 days. Without declaring that all AI is high-risk, and without the opposite illusion that buying a “compliant” tool shifts responsibility to the vendor.

The dates that matter to an accommodation business

The regulation entered into force on 1 August 2024 and applies in stages. In July 2026 the so-called AI Omnibus (Regulation 2026/1744) moved several dates and rewrote some articles. This is the calendar in force at the time of writing, according to the European Commission’s portal:

Two caveats about this table. The high-risk calendar is the one that has changed most and may change again: check the Commission’s portal on the day you decide, not a 2025 guide. And a date does not wait for a Spanish law: the regulation applies directly, and the organic law before parliament adds authorities, procedure and penalties, not new obligations.

Start with uses, not brands

An AI inventory in an accommodation business is not a vendor list. It is a list of use cases, because the obligation depends on what the system is used for, on whom and with what effect. The usual uses in a hotel, hostel or apartment management company:

1. Guest service and bookings: website chatbot, WhatsApp assistant, automatic replies in OTA messaging.
2. Guest communication: message translation, pre-arrival emails, access instructions.
3. Content and marketing: listing descriptions, retouched or generated photos, social posts.
4. Reputation: draft review replies, sentiment analysis.
5. Revenue and forecasting: dynamic pricing, occupancy prediction, pickup alerts.
6. Fraud and payments: risk scoring of a booking or a card.
7. Security and biometrics: cameras with analytics, facial recognition at entrances, occupancy detection.
8. Staff: CV filtering, automatic rotas, performance evaluation.

For each one, record the same fields in the same order: purpose, vendor and version, input data, people affected, what it produces, which decision it influences, who supervises, and the date of the next review. That row is the working unit for everything that follows.

Provider or deployer: your role with each tool

The regulation splits obligations between two figures. The provider develops the system (or has it developed) and markets it under its own name or trademark. The deployer uses it under its authority in a professional activity. A hotel that contracts a chatbot, a translator or a pricing engine is a deployer; the maker is the provider.

That position is comfortable but not armoured. Article 25 sets out when a user takes on the provider’s obligations for a high-risk system: by putting its own name or trademark on it, by making a substantial modification, or by changing the intended purpose of a system so that it becomes high-risk. Outside high-risk, the same logic works as a compass: the more you customise, retrain or resell a tool as your own, the further you are from the role of a mere user.

What you can and must do as a deployer is demand from the provider what only the provider knows: what the system is designed for, its limits, which version you use, which logs it keeps, how it marks the content it generates and what happens to the data you send it. File that documentation in the inventory row. Asking for it does not replace the analysis of your actual use; not asking for it leaves you without a defence.

Article 50 on the hotel website: the chatbot discloses from the first message

An AI system that interacts directly with people must inform them that it is AI, unless that is obvious to a reasonably well-informed, observant and circumspect person. The Commission clarifies two things in its Article 50 FAQ: the “obvious” exception is interpreted restrictively, and the notice must be given from the start of the first interaction, clearly and distinguishably.

In practice:

• Label the chat: a line next to the conversation box and a first message saying an automated assistant is replying. Do not bury it in the terms and conditions or behind an unexplained icon.
• Offer a route to a person: for incidents, accessibility, payments, complaints and anything the assistant cannot resolve. Spain’s cognitive accessibility regulation asks for the same thing, as we explain in cognitive accessibility in accommodation: visible human help at every step.
• Do not dress it up as human: a person’s name, a photo and “office hours” on top of a bot is exactly what the rule is meant to prevent.
• Configure the widget: the design duty sits with the provider, but the notice is displayed by your website. If the vendor lets you hide it, do not. The Spanish organic law bill also explicitly extends the duty to inform to the entities deploying the system.

Generated content: what to label and what not

This is where a common overreach needs stopping. The regulation does not require a label on every room description, every translation or every retouched photo. The duties are split like this:

For an accommodation business, the heaviest row is the deepfake one. A generated image of “the terrace at sunset” that does not exist, or a video with a synthetic voice imitating a real person, falls within that definition if it could pass as authentic. A photo of a real room with corrected lighting does not. And in the public-interest text row, an AI-written news item about traffic restrictions in your destination published as is does qualify; the same text reviewed by a person with judgement does not. A spell-checker does not count as human review, according to the Commission itself.

Technical marking of what the tool generates belongs to the provider; systems placed on the market before 2 August 2026 have until 2 December 2026 to add it. Ask your vendor whether it already does, and in what format.

None of this replaces consumer law: a listing that promises what a generated photo shows is still misleading advertising. If you retouch or generate images of the property, the simple rule is that they show what the guest will find. How to write a listing that survives comparison with reality is covered in keys to making a hotel listing stand out.

AI literacy: measures by role, no certificate

Article 4 requires providers and deployers to take measures to support the development of AI literacy among their staff and the people operating the systems on their behalf, taking into account their technical knowledge, experience, education, the context of use and the people affected. After the Omnibus, the text adds that no specific level has to be guaranteed for any individual. The Commission’s FAQ settles the rest: no certificate is needed; an internal record of training actions is enough.

That is not a licence to do nothing. It is an invitation to design short, documented micro-training by function:

Record the date, attendees and content of each session. It is the first evidence an authority will ask for, and it takes twenty minutes.

Red lines: what has been prohibited since 2025

Article 5 has applied since 2 February 2025 with no grace period. Three cases sit close to an accommodation business:

• Inferring emotions in the workplace, except for medical or safety reasons. A camera that “measures the attitude” of the front desk or a voice analysis that scores the mood of the phone team falls squarely inside.
• Biometric categorisation to deduce race, political opinions, trade union membership, beliefs, sex life or sexual orientation.
• Manipulative or deceptive techniques, and the exploitation of vulnerabilities due to age, disability or social or economic situation, when they distort behaviour and cause or are likely to cause significant harm.

The trap is the product name. A “smart satisfaction survey”, an “emotion-aware review analysis” or a “team wellbeing camera” is not classified by its headline: it is classified by what it actually infers, about whom and for what. Analysing the tone of public guest reviews is not the same as scoring an employee’s mood during her shift. Check the inventory row before deciding.

Fines for prohibited practices reach 35 million euros or 7% of worldwide turnover, and for the other obligations, transparency included, 15 million or 3%. For SMEs the lower of the two amounts applies. The exact amount for each infringement in Spain will be set by the organic law now before parliament.

Human resources: what applies now and what arrives in 2027

Annex III lists among high-risk systems those intended to recruit and select people, filter applications, evaluate candidates, decide on promotion or dismissal, allocate tasks based on behaviour or personal traits, and monitor or evaluate performance. The deployer duties for those systems (use per instructions, competent human oversight, log retention for at least six months, informing workers and their representatives before putting them into service, informing the person affected by the decision) apply from 2 December 2027.

That postponement does not empty the present:

• GDPR still requires a legal basis, minimisation, information and, where applicable, an impact assessment; and its Article 22 limits decisions based solely on automated processing.
• The Spanish Workers’ Statute (Estatuto de los Trabajadores) has required since 2021 that the workers’ legal representatives be informed about the parameters, rules and instructions of algorithms or AI systems that affect decisions on working conditions, access to and retention of employment.
• The Article 5 prohibitions already apply, including the one on workplace emotions.
• An application filter that discards by age or by name is discrimination today, with or without the AI Act.

If you use an application filter, start now with what will cost more later: asking the vendor for its documentation, defining who reviews each rejection and noting why.

The layer you already had: GDPR, consumer law, accessibility and IP

The regulation replaces none of the above. It sits on top. For an accommodation business, the most frequent overlaps:

• Guest data. Do not upload ID cards, passports, health data, conversations or internal reports to a general-purpose assistant without a documented decision, a processor contract and a configuration that prevents your data being used for training. Which guest data you process and on what basis is detailed in guest data privacy.
• Accuracy. On 21 July 2026 the AEPD (Spain’s data protection authority) published a technical note on quality, accuracy and minimisation in AI processing: accuracy must be adequate to the purpose and extends to what the system produces, including inferences and decisions about people. A price recommendation does not need the same accuracy as a rejected job application.
• Consumer law and advertising. What the assistant promises, you promise. Test the chatbot with questions about cancellations, deposits and pets before publishing it.
• Accessibility. An assistant with no human alternative and a form only the AI understands are cognitive barriers, not improvements.
• Intellectual property and image rights. Generated images with recognisable people, or texts that reproduce someone else’s content, are problems the AI Act neither solves nor excuses.
• Trade and labour confidentiality. Rates, contracts and rotas are also data that should not leave for an assistant without control.

A 30-day implementation cycle

You do not need a consultancy project. You need an owner, the inventory and four weeks. Prioritise guest-facing chatbots, any HR use, any biometrics and decisions that cannot be undone.

The last point is the one that gets forgotten: what happens if the system fails during a check-in. If the assistant goes down at eleven at night or the pricing engine publishes an absurd rate, someone must be able to switch it off and the manual path must be at hand. For traveller registration that path is the usual one: the report goes to SES.Hospedajes (Spain’s national traveller-reporting platform) the same way, with or without an assistant, as we explain in the traveller registration app guide.

Measure more than time saved

For each use case, choose two or three indicators and record them monthly. The most informative ones in an accommodation business:

• Accuracy and corrections: how many replies or texts had to be corrected before use.
• Hallucinations caught: invented answers about prices, policies or services.
• Handovers to a person: how many conversations end at the front desk, and why.
• Complaints and reviews that mention the assistant, the translation or the automated process.
• Conversion of AI-handled conversations versus those handled by people.
• Errors avoided and errors created: an overbooking caught in time counts in favour; a wrong rate published counts against.
• Impact by language and accessibility: if the assistant performs worse in German or with older guests, you will only know if you measure it.

Draft review replies deserve their own metric: how many went out untouched, how many with edits and how many with a factual error. How to reply well, with or without AI, is in how to post and reply to reviews on Booking.

The reusable matrix, with three examples

Copy this table into your inventory. Each column is a decision somebody has to make; an empty cell is where your risk sits.

The three rows often share the same model vendor and share not a single obligation. That is why the inventory is built by use, not by brand.

Frequently asked questions

Does the AI Act require my hotel to appoint an “AI officer”?

It does not require a role with that name. It requires that someone can answer, for each system, what it does, with which data, about whom and who supervises it. In a small property that someone is usually the manager, with the inventory as the tool.

Do I have to label every description and photo made with AI?

No. Technical marking of generated content sits with the tool’s provider. Your job is to disclose deepfakes (images, audio or video that look real but are not) and public-interest texts published without human review. Consumer and advertising rules, on the other hand, apply to everything you publish.

Is a booking chatbot high-risk?

Not by itself. It is subject to Article 50 transparency (disclosing that it is AI) and to all consumer and data rules. It would be different if the same system decided, for instance, access to an essential service or evaluated workers.

Can I keep using a CV filter until December 2027?

The specific high-risk duties for that use apply from 2 December 2027, but GDPR, the Workers’ Statute duty to inform staff representatives, equality law and the Article 5 prohibitions already apply. Using it today requires real human oversight and criteria you can explain.

Who inspects me in Spain?

AESIA is the main market surveillance authority, with other bodies for specific areas (for instance the AEPD for data protection). The organic law that sets the full allocation and the national penalties was still before parliament when this article was published.

Sources

• Regulation (EU) 2024/1689 on Artificial Intelligence, EUR-Lex, primary text: definitions, literacy, prohibitions, high-risk, deployer obligations and transparency.
• European Commission, AI Act application timeline, dates in force after the Omnibus.
• European Commission, AI Omnibus enters into force, changes to literacy, SMEs and high-risk dates.
• European Commission, AI literacy questions and answers, scope of Article 4, no certificate, supervision from August 2026.
• European Commission, Article 50 questions and answers, chatbots, synthetic content, deepfakes, public interest and the marking transition period.
• European Commission, regulatory framework for AI, guidelines on prohibited practices and the AI Act Service Desk.
• Spanish Congress, Organic Law bill on the proper use and governance of AI, Spanish authorities and penalties, in progress.
• AEPD, accuracy and minimisation in AI processing (21 July 2026).
• Hosteltur, the second gap of hotel AI (7 September 2026), sector diagnosis on inventory, ownership and metrics.