A hotel or restaurant that brings in AI usually does so in three places: an assistant that answers questions and takes bookings, a tool that adjusts prices and, more and more, a camera that recognises faces. For the AI Act these are three different cases, and none of them is high-risk because it happens in hospitality. This piece classifies them one by one.
Classification, case by case
| Case | Where it falls | Who holds the obligation | From when |
|---|---|---|---|
| Chatbot that answers and books | Article 50(1): transparency | The provider of the system | 2 August 2026 |
| Dynamic pricing | Minimal risk, unless it falls within an Article 5 prohibition | — | Article 5, from 2 February 2025 |
| Verifying the guest's identity with their face | Outside Annex III, point 1(a); within Article 9 GDPR | The controller (GDPR) | The GDPR, already |
| Identifying guests or customers at a distance | Annex III, point 1(a): high-risk | The deployer (Article 26) and the controller (GDPR) | Article 26: see below |
| Inferring staff emotions | Prohibited, Article 5(1)(f) | Anyone using it in the workplace | 2 February 2025 |
The chatbot
Article 50(1) provides that "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system", unless this is obvious to a reasonably well-informed person.
The obligation belongs to whoever designs the system, not to the hotel that installs it on its website. What the hotel can do is check, before contracting it, that the assistant discloses that it is an AI. That is an internal due diligence check, not a legal obligation of its own. The detail is in who must warn that your chatbot is an AI.
Dynamic pricing
No point of Annex III covers setting the price of a room, a menu or a table. The only pricing Annex III treats as high-risk is life and health insurance (point 5(c)), which is not the case here. A dynamic pricing system in hospitality is, to begin with, minimal risk.
The line that would change that is not dynamic pricing itself: it is Article 5. Its point (a) prohibits "purposefully manipulative or deceptive techniques" that materially distort a person's behaviour and cause, or are likely to cause, significant harm. Its point (b) prohibits exploiting vulnerabilities due to age, disability or a specific social or economic situation with the same effect. A price that rises with demand is not that. A price designed to exploit someone who cannot compare could be.
If the price is calculated with data on identified customers, the GDPR also applies.
Facial recognition
Here the deciding word is a distinction that Annex III itself writes down.
Verifying —confirming that the arriving guest is the person who made the booking— is outside: Annex III, point 1(a), excludes from remote biometric identification "AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be".
Identifying —recognising a regular customer or a banned person in the lobby by comparing their face against a database— is a remote biometric identification system under Annex III, point 1(a): high-risk. Whoever deploys it takes on Article 26. Article 26 applies from 2 December 2027 for high-risk systems under Annex III and from 2 August 2028 for those under Annex I; it does not reach products under Annex I, Section B.
In both cases, the GDPR comes before the AI Act. A face processed to identify a person is biometric data, and Article 9 GDPR prohibits processing it unless one of its exceptions applies. The Spanish data protection authority (AEPD) has already brought penalty proceedings over facial recognition in retail premises, and the costliest part was the lack of a legal basis. The difference between verifying and identifying is developed in this piece on biometrics.
And one red line that does not depend on the customer: inferring the emotions of staff —for example, analysing the faces of waiting staff to measure their attitude— is prohibited by Article 5(1)(f) in the workplace, except for medical or safety reasons.
What this piece does not cover
Tourism and consumer protection rules, which regulate aspects of pricing and customer information in their own right. And the penalty regime.
Content in accordance with Article 5(1), Article 26, Article 50(1) and Annex III, points 1 and 5, of Regulation (EU) 2024/1689, and with Article 9 of Regulation (EU) 2016/679.
This article is for information purposes only and does not constitute legal advice.