To comply with the reporting requirements of the AI Act, you must determine which risk category your AI chatbot falls into and then comply with the corresponding transparency, registration, and documentation requirements. For most customer service chatbots, at a minimum, the less stringent transparency requirements for low-risk AI apply, while chatbots used in high-risk contexts—such as lending or essential services—must meet stricter requirements. In this article, we answer the most frequently asked questions about AI Act compliance for chatbots, so you know exactly where you stand.
Which AI chatbots are subject to the reporting requirement under the AI Act?
Not every AI chatbot is automatically subject to the same reporting requirements. The AI Act takes a risk-based approach, whereby the context of use determines which obligations apply. Chatbots used for customer service, providing information, or handling simple transactions generally fall under the low-risk category. Chatbots that support decisions regarding access to essential services may fall under the high-risk category.
Specifically, the transparency requirements for AI chatbots apply in any case when:
- The chatbot communicates with people without them realizing they’re talking to an AI system
- The chatbot generates deepfake content or synthetic text
- The chatbot is used for profiling individuals (this is always high-risk)
- The chatbot assists with decisions regarding credit, insurance, emergency calls, or other essential services
Chatbots used exclusively for internal, non-critical processes that do not interact with end users outside the organization are, in most cases, exempt from the strict reporting requirement, but must still comply with the basic AI literacy requirements that have been in effect since February 2, 2025.
What exactly does the reporting requirement under the AI Act entail?
The reporting requirement under the AI Act is not a single obligation, but rather a set of transparency, registration, and notification obligations that depend on the system’s risk category. For low-risk AI chatbots, this means, at a minimum, that users must be clearly informed that they are communicating with an AI system. For high-risk systems, the obligations go considerably further.
The following applies to a low-risk AI chatbot:
- Proactively notifying users that they are interacting with an AI system
- Transparency regarding the system’s capabilities and limitations
The following additional requirements apply to a high-risk AI chatbot:
- Registration in the EU database for high-risk AI systems
- Comprehensive technical documentation and conformity assessment
- Establishing and maintaining a risk management system
- Ensuring Human Oversight in the System
- Activity Logging for Traceability
Most of the requirements for high-risk Annex III systems will take effect on August 2, 2026. That may seem far off, but the preparation time is considerable, especially if you still need to complete documentation and technical adjustments.
How do you determine whether your chatbot is classified as high-risk?
An AI chatbot is classified as high-risk if it falls under one of the eight domains listed in Annex III of the AI Act, or if it constitutes a safety component of a product that is already covered by existing European harmonization legislation. The most relevant domains for chatbots in customer service are access to essential services, employment, and human resources management.
When does a customer service chatbot fall under Annex III?
A chatbot falls under the high-risk category of Annex III when it plays a role in decisions regarding creditworthiness, life and health insurance, emergency calls, or other essential services. If your chatbot helps customers apply for services that involve approval or denial, a thorough assessment is necessary.
When is a chatbot not considered high-risk?
An Annex III system may fall outside the high-risk category if it performs only a narrow procedural or preparatory task and does not pose a significant risk to fundamental rights. However, the provider must document this with supporting evidence. Please note: Chatbots that profile natural persons are always high-risk, without exception.
What are the technical and organizational requirements for a compliant AI chatbot?
A compliant AI chatbot requires both technical measures and organizational processes. The technical requirements focus on traceability, reliability, and transparency, while the organizational requirements ensure human oversight, documentation, and continuous monitoring. Together, they form the foundation of AI Act compliance.
From a technical standpoint, you need to ensure the following:
- Automatic logging of interactions for traceability and audits
- Mechanisms for human oversight and the ability to interrupt or correct the system
- Robustness and cybersecurity to prevent tampering or misuse
- Accuracy and reliability of the information provided
From an organizational standpoint, the following steps are essential:
- Preparing technical documentation on the system, its operation, and its limitations
- Implementing a risk management system that remains active throughout the entire lifecycle
- Training Employees in AI Literacy (Mandatory as of February 2, 2025)
- Appointing a person responsible for AI compliance within the organization
- Establishing Procedures for Reporting Serious Incidents
For organizations that use GPAI models (large language models) as the basis for their chatbot, the provider of the underlying model is required to provide documentation and information about the model’s capabilities and limitations. As the deployer, you are responsible for using that model appropriately within your context.
What are the consequences of failing to comply with the AI Act’s reporting requirement?
The consequences of non-compliance with the AI Act are significant. The penalty structure has three tiers and has been in effect since August 2, 2025. The amount of the penalty depends on the nature of the violation and the size of the organization.
- Violations of prohibited practices (Article 5): up to 35 million euros or 7% of global annual revenue, whichever is higher
- Non-compliance with other obligations: up to 15 million euros or 3% of global annual revenue
- Inaccurate or misleading information provided to authorities: up to 7.5 million euros or 1% of annual revenue
For small and medium-sized enterprises, the lower of the percentage or the fixed amount applies in each case, which offers some protection. Nevertheless, the damage to reputation and the loss of customer trust resulting from a public enforcement proceeding are often more severe than the financial fine itself. In January 2026, Finland became the first EU member state to officially grant enforcement powers to its national authority, a sign that enforcement is becoming increasingly concrete.
How can you prepare your organization for AI Act compliance, step by step?
The most effective way to prepare your AI chatbot for compliance with the AI Act is through a structured approach that begins with an assessment and ends with ongoing monitoring. Don’t wait until the deadlines are approaching, because the documentation and technical adjustments take more time than most organizations expect.
- Take inventory of all AI applications: Identify which chatbots and other AI systems you use, who the provider is, and what their intended purpose is.
- Classify the risk level: For each system, assess whether it falls under minimal risk, limited risk, or high risk based on the context of use and the Annex III domains.
- Prepare documentation: Provide technical documentation for each system, including its operation, training data, limitations, and risk analysis.
- Implement transparency measures: Ensure that users always know they are interacting with an AI system.
- Train your employees: AI literacy is a must. Make sure everyone who works with AI systems understands what they do and what the risks are.
- Establish human oversight: Define who is responsible for monitoring and correcting AI behavior.
- Monitor Continuously: Compliance is not a one-time exercise. Establish processes for ongoing evaluation and update documentation as changes occur.
In addition, for high-risk systems, registration in the EU database and a formal conformity assessment are required before the system is put into service. Be sure to plan for this well in advance of the August 2, 2026, deadline.
How Pegamento Helps Ensure AI Act Compliance for Your Chatbot
If you want to deploy your AI chatbot for customer service without the risks of non-compliance, Pegamento offers concrete support. We combine in-depth knowledge of AI regulations with practical implementation experience, ensuring that you’re not only technically compliant but also deliver real value to your customers.
What we do for you:
- Risk Analysis and Classification: Together, we’ll assess which risk category your chatbot falls into and what obligations result from that.
- Technical Implementation: We provide logging, human oversight, and transparency mechanisms that comply with the requirements of the AI Act.
- Documentation and Governance: We assist with preparing the required technical documentation and setting up a risk management system.
- Customized solutions using standard building blocks: No costly custom work, but a smart combination of proven modules that can be deployed quickly and are fully tailored to your situation.
- Everything under one roof: From development and implementation to management and compliance monitoring—a single point of contact for the complete package.
Our chatbot solutions are built on Agentic AI: an evolution from task-oriented bots to self-thinking assistants that not only follow instructions but also take the initiative and act independently within the parameters you set. This makes them both powerful and responsible to use. Pegamento is certified to ISO 27001 (information security), ISO 9001, and ISO 26000, which means that compliance and corporate social responsibility are deeply embedded in our approach. Want to know how to make your AI chatbot compliant? Get in touch, and we’d be happy to help you figure it out.
Frequently Asked Questions
Does the AI Act apply even if I use a chatbot from a third-party provider, such as a SaaS solution?
Yes, even as a deployer—the party that deploys an AI system from a third-party provider—you have your own obligations under the AI Act. You are responsible for the proper use of the system within your context, informing users, and ensuring human oversight. So always check whether your provider makes the required technical documentation and information about capabilities and limitations available, because without that information, you cannot meet your own compliance obligations.
What is the difference between the provider and the deployer of an AI chatbot under the AI Act?
The provider is the party that develops or markets the AI system, while the deployer is the party that deploys the system in a specific context for end users. In practice, as an organization, you’re often the deployer when you use an existing language model or chatbot platform for your customer service. Both parties have their own obligations: the provider is responsible for technical documentation and the conformity of the system itself, while the deployer is responsible for its proper and transparent deployment.
What should the mandatory notification to users look like in practice?
The AI Act requires an active, clear notification—it is not sufficient to hide this in fine print or terms and conditions. In practice, this means a visible notification at the start of the conversation, such as ‘You are chatting with an AI assistant’ or a clearly recognizable chatbot icon combined with a textual explanation. The notification must be understandable to the average user and must leave no doubt that there is no human on the other end.
My chatbot is still under development. When should I start preparing for AI Act compliance?
Immediately—and preferably before the system goes live. The AI Act follows the principle of ‘compliance by design,’ which means that requirements such as logging, human oversight, and transparency mechanisms must be built in during the development phase. Making changes to a system that’s already in operation is significantly more expensive and time-consuming. Furthermore, for high-risk systems, the conformity assessment and EU registration must be completed before the system is put into service.
What exactly is meant by 'AI literacy' as a requirement for employees?
Under the AI Act (in effect since February 2, 2025), organizations are required to provide employees who work with AI systems with an appropriate level of AI literacy. This means they must understand how the AI system works, what its limitations are, what risks exist, and how to intervene when the system exhibits incorrect or undesirable behavior. The level of detail required varies by role: a customer service representative who monitors chatbot conversations has different training needs than an IT administrator who maintains the system.
Can a chatbot currently classified as low-risk later be reclassified as high-risk?
Yes, that is certainly possible. If the context of use for your chatbot changes—for example, because you start using it for credit applications, insurance consultations, or other essential services—the risk category may change. Changes to the underlying AI model or the addition of new functionalities can also influence the classification. It is therefore important not to conduct risk assessments as a one-time event, but to repeat them as part of an ongoing compliance process whenever a significant change occurs.
What is the minimum documentation I need to maintain for a low-risk chatbot?
For a low-risk chatbot, the documentation requirements are less stringent than for high-risk systems, but you are not completely exempt. At a minimum, provide a description of the system and its intended purpose, an overview of the transparency measures you have implemented, evidence of the risk classification performed, and a record of AI literacy training for employees. This documentation serves as justification for your classification choice and may be requested during a potential audit by the national regulator.
