The AI Act has direct implications for automated processes in customer service. Organizations that use AI for customer interactions—from chatbots to automated decisions on service requests—must comply with new European regulations that will take effect in phases between 2025 and 2027. Whether you run a contact center or are responsible for AI-driven solutions within your organization, the law directly affects you. In this article, we answer the most frequently asked questions about the AI Act and what it means for your customer service organization.
Which automated customer service processes fall under the AI Act?
The AI Act applies to any AI system you use in your customer service process, as long as that system produces output—such as predictions, recommendations, decisions, or generated text—that affects customers or employees. This applies to organizations operating in the EU, regardless of where the technology itself originates.
Specifically, the following applications are covered by the law:
- Chatbots and virtual assistants that answer customer questions
- Automated call routing via intelligent IVR systems
- AI systems that predict customer satisfaction or customer behavior
- Automated processing of customer requests or complaints
- Systems that provide real-time guidance to employees during a conversation
- Process automation in which AI makes decisions regarding service requests
Not all of these applications fall into the same risk category. The law makes a clear distinction based on the potential risk posed by a system. Simple FAQ chatbots without decision-making authority are treated differently from systems that determine whether a customer is granted access to an essential service.
What are the risk categories under the AI Act for customer service?
The AI Act identifies four risk levels: prohibited AI, high-risk AI, limited-risk AI, and minimal-risk AI. For customer service, the middle two categories are particularly relevant. Most standard customer service applications fall into the limited-risk or minimal-risk categories, but there are exceptions that require extra attention.
Limited risk: transparency requirement
Most chatbots, virtual assistants, and automated response systems fall into the “limited risk” category. The primary requirement for these is transparency: customers must know that they are communicating with an AI system. Further technical requirements are limited, but the obligation to be honest about the nature of the system is binding.
High risk: strict requirements
A customer service system is classified as high-risk when it makes decisions that affect access to essential services. Examples include AI that determines whether a customer is eligible for a loan, insurance, or utility service. Systems that profile natural persons also always fall into the high-risk category, regardless of the context. This is a point that many customer service organizations underestimate when implementing advanced process automation.
What requirements apply to high-risk AI in contact centers?
If you deploy a high-risk AI system in your contact center, significantly stricter requirements apply. The distinction here is between the provider (the party that develops and markets the system) and the deployer (the organization that uses the system). As a customer service organization, you are, in most cases, the deployer.
As a deployer of a high-risk system, you are required to:
- Use the system only in accordance with the provider’s instructions
- Assign human supervision to competent and trained employees
- Log files must be retained for at least six months
- Informing employees before the system is put into use (Article 26(7))
- Conduct a data protection impact assessment (DPIA) where applicable
A key concern is the risk of automation bias: employees who rely too heavily on AI recommendations without thinking critically. The law explicitly requires that the design of high-risk systems effectively enable human oversight and that employees are trained to actually exercise this oversight. Furthermore, under Article 86, customers who are subject to a decision made by a high-risk system may request an explanation of the factors that determined the decision.
When should a customer know that they are talking to an AI?
A customer must always be aware that they are communicating with an AI system whenever an interaction occurs that could reasonably be perceived as human contact. This is one of the transparency requirements that apply to low-risk AI systems, and the requirement takes effect on August 2, 2026, for most customer service applications.
In practice, this means that your chatbot, voicebot, or virtual assistant must clearly identify itself as AI at the start of a conversation. It must be clear to the customer whether they are communicating with a human or a machine. This also applies when an AI system generates text that is then sent by an employee, if that text is not marked as AI-generated.
There is an exception for situations where the context already makes the use of AI second nature to the average person, but in a customer service setting, it’s wise not to rely on this. Furthermore, transparency regarding the use of AI strengthens customer trust, which contributes to a better customer experience in the long run.
What are the consequences of noncompliance with the AI Act?
The fines for non-compliance with the AI Act are substantial and comparable in scale to those under the GDPR. The amount depends on the nature of the violation and the size of the organization. The provisions regarding fines will take effect on August 2, 2025.
The penalty structure has three levels:
- Prohibited Practices (Article 5): up to 35 million euros or 7% of global annual revenue
- Other liabilities: up to 15 million euros or 3% of global annual revenue
- Providing false information to authorities: up to 7.5 million euros or 1% of annual revenue
For SMEs, the lower of the percentage or the fixed amount applies in each case. In addition to financial penalties, noncompliance also carries reputational risks. Customers and partners increasingly value the responsible use of technology, and enforcement action by a regulator can seriously damage trust in your organization. In January 2026, Finland became the first member state to grant enforcement powers to its national authority, a sign that the law is being taken seriously.
How do you prepare a customer service organization for the AI Act?
Preparing for the AI Act starts with a clear overview of all AI systems you currently use or plan to use in your customer service processes. Without this overview, it is impossible to determine which obligations apply to you.
A practical approach consists of the following steps:
- Take stock of your AI applications: Identify which systems use AI, including process automation, chatbots, and decision-support tools.
- Classify the risk level: Determine which risk category each system falls into based on the criteria set forth in the AI Act.
- Check the vendors’ documentation: Ask vendors whether their systems meet the requirements for your use case and whether the necessary documentation is available.
- Assign human oversight: Ensure that for each high-risk system, a designated, trained employee is responsible for oversight.
- Ensure transparency: Adjust your communication so that customers always know when they are interacting with AI.
- Train your employees: AI literacy will be mandatory starting February 2, 2025. Employees must understand how AI systems work and what their limitations are.
- Retain logs: Establish processes to retain log files from high-risk systems for at least six months.
Be sure to keep an eye on the implementation timeline as well. Most of the requirements for high-risk Annex III systems take effect on August 2, 2026, which is the most relevant deadline for many customer service organizations. So start preparing now to ensure you’re compliant in time.
How Pegamento Helps Ensure AI Act Compliance in Customer Service
We understand that the AI Act can seem complex to many customer service organizations, especially if you’re already struggling with fragmented systems and multiple vendors. Through our “one-stop-shop” approach, we help you not only implement smart technology, but also use it responsibly and in compliance with regulations.
What we specifically offer:
- Customized solutions using standard building blocks: No costly custom development, but smart combinations of proven modules that fit your situation and meet the requirements of the AI Act.
- Agentic AI for Customer Service: Our Agentic AI assistants represent an evolution from task-oriented bots to self-thinking assistants that take the initiative on their own. They are designed with human oversight as a fundamental principle, which is fully in line with legal requirements.
- Transparent architecture: Our systems are documented and traceable, so you can always demonstrate how decisions are made.
- A single point of contact: From implementation to management and support—no complex supplier structures that complicate compliance.
- ISO 27001-certified security: Our information security is certified under ISO 27001, supplemented by ISO 9001 and ISO 26000, which aligns with the security requirements of the AI Act.
Would you like to know how your customer service organization is faring in terms of AI Act compliance? Contact us, and we’d be happy to help you figure it out.
Frequently Asked Questions
Does the AI Act apply even if we use an AI tool from a U.S. or other non-European provider?
Yes, the AI Act applies to all organizations operating in the EU, regardless of where the technology comes from. As a deployer, you are responsible for complying with the obligations that apply to your use of the system. It is therefore essential to check with your supplier to ensure their system meets the AI Act requirements and that the necessary technical documentation is available.
What if our supplier cannot provide the proper documentation for a high-risk system?
As a deployer, you are required to use the system exclusively in accordance with the provider’s instructions, including the accompanying documentation. If that documentation is missing, your organization itself runs the risk of non-compliance. In that case, it is advisable to formally request that your supplier provide the documentation, or to consider switching to a provider that demonstrably complies with the AI Act requirements.
How specific must the notification to customers be regarding their interaction with AI?
The notification must be clear and understandable to the average customer, preferably at the beginning of the interaction. A short sentence such as ‘You are now communicating with a virtual assistant’ is sufficient in most cases. Vague wording or fine print in the terms and conditions is not enough; the transparency requirement mandates that the customer be actively and promptly informed, not after the fact.
Does an AI tool that our employees use internally, but that does not communicate directly with customers, also fall under the AI Act?
That depends on the system’s function. An AI tool that advises employees in real time during customer conversations, or that supports decisions regarding service requests, does fall under the AI Act. The obligation to inform employees about its use (Article 26(7)) and to ensure human oversight also applies to internal systems. Systems used purely for internal productivity without any impact on customers or service decisions generally fall outside the scope.
Our organization is an SME. Do the same rules apply to us as to large companies?
The substantive obligations of the AI Act apply to all organizations, large or small. The difference lies in the fine structure: for SMEs, the lower of a fixed amount or a percentage of annual revenue always applies, which limits the financial impact. The European Commission has also indicated that support measures will be introduced for SMEs, such as access to regulatory sandboxes. Nevertheless, timely preparation is also important for smaller organizations, because the obligations themselves are no less stringent.
What is the biggest practical risk if we don’t take any action now regarding AI Act compliance?
The biggest immediate risk is that, as of August 2, 2025, you will already be liable for fines for violations of the penalty provisions, while the transparency obligations for most customer service applications take effect on August 2, 2026. In addition to financial penalties, the reputational risk is just as significant: customers and business partners increasingly value responsible AI use, and it is difficult to recover from enforcement action by a regulator. Starting early also gives you the flexibility to implement changes in phases without operational disruptions.
How do we ensure our AI systems remain compliant after initial implementation?
Compliance is not a one-time project but an ongoing process. Establish an internal management process in which changes to AI systems—such as updates from a vendor or functionality expansions—are routinely assessed against the AI Act requirements. Systematically retain log files, conduct periodic reviews of human oversight, and monitor guidance from the national regulator, as the practical implementation of the law will be further clarified in the coming years through delegated acts and guidelines.
