To conduct an AI Act compliance check for your contact center, you should first identify all AI systems, classify each system by risk level, determine the corresponding obligations, and then assess whether your current situation meets those requirements. This applies to any organization that uses AI systems in customer interactions, regardless of whether you developed those systems yourself or purchased them from a vendor. In this article, we answer the most frequently asked questions about AI compliance in contact centers, from classification to concrete action steps.
Which AI systems in a contact center are covered by the AI Act?
The AI Act applies to any system that uses machine learning, logic, or statistics to generate outputs—such as text, decisions, recommendations, or predictions—and that is deployed in or for the EU. In a contact center, this quickly adds up to a wide range of tools that you use on a daily basis.
Specific examples of systems covered by the AI Act include:
- Chatbots and virtual assistants that handle customer interactions
- Speech Recognition and Automatic Transcription of Phone Calls
- Intelligent routing systems that determine which employee receives a call
- Systems that predict customer satisfaction or churn risk
- AI-driven quality assurance that analyzes conversations and evaluates employees
- Agentic AI assistants that independently perform actions within customer processes
Important: The law applies not only to providers who develop AI, but also to deployers—that is, organizations that use AI systems developed by others under their own authority. If your contact center uses a chatbot from a vendor, you are the deployer and have your own obligations. So you don’t have to build the software yourself to be subject to the law.
How do you determine the risk level of your contact center AI?
You determine the risk level of an AI system by assessing it against the risk classification in the AI Act, which has four levels: prohibited, high risk, limited risk, and minimal risk. Most contact center AI falls into the limited-risk or high-risk category, depending on what the system does and which decisions it influences.
When is contact center AI considered high-risk?
High-risk AI is defined in Article 6 of the AI Act. In a contact center context, a system is considered high-risk if it falls under one of the eight domains listed in Annex III. Of particular relevance to contact centers are: access to essential services (such as systems that determine whether someone is eligible for insurance or credit) and employment or human resources management (such as systems that evaluate employees or monitor performance). Systems that perform profiling of natural persons are always high-risk, regardless of the purpose.
When is contact center AI considered to be a limited risk?
AI systems that interact with people without making significant decisions are considered to pose a limited risk. A chatbot that answers questions about business hours or an order status typically falls into this category. The main requirement here is transparency: the user must know that he or she is communicating with an AI system, not a human.
What requirements apply for each risk category?
The obligations under the AI Act depend heavily on the risk level and on your role—whether as a provider or a deployer. As a contact center, you are typically a deployer, which means you have fewer obligations than the party that developed the system, but you are by no means free of responsibilities.
As a deployer of a high-risk system, you must:
- Use the system in accordance with the provider’s instructions for use
- Assign human supervision to qualified and trained employees
- Retain log files for at least six months
- Informing employees before the system is put into use (Article 26(7))
- Conduct a data protection impact assessment (DPIA) where applicable
For low-risk AI, the primary obligation is transparency toward the end user: people must know that they are interacting with an AI system. There are no specific obligations for AI with minimal risk, although the GDPR continues to apply to personal data that is processed.
How do you perform an AI Act compliance check step by step?
You can conduct an AI Act compliance check in five steps: identify all AI systems, classify each system by risk level, identify the corresponding obligations, assess the current situation against these obligations, and develop an action plan to address any gaps found. This is not a one-time exercise, but an ongoing process.
- Take inventory of all AI systems: Create a comprehensive overview of all tools and systems in your contact center that include AI functionality. These include chatbots, routing software, analytics dashboards, and quality monitoring. Also, check with vendors to find out which AI components are included in their products.
- Determine the risk level: Assess each system against the AI Act’s risk classification. Use the Annex III domains as a checklist for high-risk AI. Document your reasoning for each system.
- Determine your role: Are you a provider or a deployer? For most contact centers, the term “deployer” applies, but if you customize systems yourself or offer them under your own name, provider obligations may arise.
- Identify obligations: For each system, determine which obligations apply based on risk level and role. Pay particular attention to human oversight, logging, employee notification, and DPIA requirements.
- Assess and document: Compare the current situation with the requirements and record your findings. Set priorities based on risk level and deadlines from the implementation timeline.
What are the most common compliance gaps in contact centers?
The most common compliance gaps in contact centers include insufficient documentation of AI systems, a lack of human oversight of automated decisions, and a failure to inform employees about the use of AI. These gaps are not always apparent in day-to-day operations, but become immediately evident during an audit or incident.
Specific challenges you frequently encounter:
- Lack of system inventory: Organizations do not know exactly which AI components are active, especially in the case of SaaS tools that are regularly updated by vendors.
- Lack of logging: Log files are not retained at all or are retained for an insufficient period, even though the law requires a six-month retention period for high-risk systems.
- Lack of employee notification: Employees have not been informed about AI systems that support or monitor their work, which is a direct obligation under Article 26(7).
- Unclear human oversight: There is no designated person responsible for monitoring AI decisions and intervening when necessary.
- There is a lack of transparency toward customers: Customers do not know that they are talking to an AI chatbot, which is already a violation in the case of limited-risk systems.
When do you need to be AI Act compliant, and what are the consequences if you aren’t?
For most contact center AI, you must be fully compliant with the requirements for high-risk Annex III systems as of August 2, 2026. The transparency requirements for low-risk AI and the prohibitions under Article 5 have already taken effect, on August 2, 2025, and February 2, 2025, respectively.
The penalty structure has three tiers. Violations of prohibited practices can result in a fine of up to 35 million euros or 7% of global annual revenue. Noncompliance with other obligations may be penalized with a fine of up to 15 million euros or 3%. Providing false information to regulators may result in a fine of up to 7.5 million euros or 1%. For smaller organizations, the lower of the fixed amount or the percentage applies in all cases.
In addition to financial risks, there are also operational and reputational consequences. Regulators can shut down the use of a non-compliant system, which has a direct impact on your customer contact operations. Furthermore, customer awareness of AI usage is growing, and organizations that do not take transparency seriously risk reputational damage.
Don’t start too late. The implementation timeline may seem generous, but conducting a thorough assessment, adapting processes, and training employees take more time than expected.
How Pegamento Helps Ensure AI Act Compliance in Your Contact Center
AI Act compliance is not a one-time project, but an ongoing part of responsible AI use. We help contact centers at every step of that process—from assessment to implementation and management—all under one roof, without complex vendor arrangements.
What we specifically do for you:
- Inventory of all AI systems in your contact center and classification by risk level
- Establishing human oversight, logging, and documentation processes that align with the AI Act requirements
- Implementing Agentic AI for customer service, which is designed from the ground up with transparency and control as its guiding principles. Agentic AI represents the evolution from traditional RPA bots to self-thinking assistants that not only follow instructions but also take the initiative and act independently within the parameters you define.
- Advice on combining proven modules that fit your situation, without the need for costly customization
- Support for employee communication and establishing AI literacy within your team
Our approach is built on ISO 27001-certified information security, supplemented by ISO 9001 and ISO 26000, ensuring that compliance isn’t just on paper but is also guaranteed in practice. Would you like to know where your contact center currently stands in terms of AI compliance? Get in touch, and we’ll work together to determine the next step.
Frequently Asked Questions
Does the AI Act apply even if my contact center is located outside the EU but serves EU customers?
Yes, the AI Act has extraterritorial effect. If your contact center uses AI systems that generate outputs for individuals located in the EU, you are subject to the law, regardless of where your organization is based. This means that offshore or nearshore contact centers working for European clients must also comply with the AI Act’s requirements.
How do I know if a supplier’s SaaS tool contains AI components that fall under the AI Act?
Explicitly ask your vendor for an AI system description or technical documentation that specifies which AI functionality is incorporated into the product. Reliable suppliers are required to provide transparency about their systems and to give you, as the deployer, the necessary information to fulfill your obligations. Also, ensure this is contractually agreed upon: make sure vendors actively inform you of updates that introduce new AI functionality, as SaaS tools are regularly updated without explicit notification.
What is the difference between an AI Act compliance check and a DPIA, and do I need both?
An AI Act compliance check assesses whether your AI systems comply with the obligations under the AI Act, such as risk classification, human oversight, and transparency. A DPIA (Data Protection Impact Assessment) is a GDPR tool that identifies the risks of data processing for data subjects. You need both if you use high-risk AI that also processes personal data, which is almost always the case in a contact center. The two processes overlap to some extent, but they complement each other and must both be carried out.
How do I properly inform my employees about AI systems that monitor their work, such as quality control?
Article 26(7) of the AI Act requires you to inform employees before an AI system that supports or monitors their work is put into use. In practice, this means: communicate in writing which system is being used, what it does, what data it collects, and how the results are used. Combine this with a brief training session on AI literacy so that employees understand what the AI can and cannot do, and how they can object or escalate the matter if they disagree with an AI-generated assessment.
Can I continue to use an existing chatbot if it isn’t yet AI Act-compliant?
That depends on the risk level and the specific requirement. The transparency requirement for low-risk chatbots takes effect on August 2, 2025, so if your chatbot doesn’t inform customers that they’re communicating with AI, that’s already a violation. For high-risk obligations, the deadline is August 2, 2026. Don’t use the time until that deadline as an excuse to do nothing: start your assessment now and tackle the easiest adjustments—such as providing transparency notifications to customers—right away.
What should I do if my contact center is both a deployer and a provider, for example, because we’ve customized a standard chatbot?
As soon as you make substantial modifications to an AI system—such as retraining a model, changing its intended use, or integrating additional functionality—you become the provider of that system from a legal standpoint. This entails significantly more stringent obligations, including conformity assessment, technical documentation, and CE marking for high-risk systems. Have a legal or compliance specialist assess whether your modifications cross the threshold of “substantial,” as this distinction has major implications for your responsibilities.
How do I keep my AI Act compliance up to date if suppliers regularly update their systems?
Establish an internal management process whereby every significant update to an AI system automatically triggers a reclassification and compliance check. Specify in your supplier contracts that the provider must inform you in a timely manner about updates that could affect the AI functionality or the system’s risk level. In addition, schedule a full review of your AI inventory at least once a year, so that new tools introduced in the meantime are also included in your compliance overview.
