Most omnichannel AI applications in contact centers fall under the “low-risk ” category or are completely unregulated under the EU AI Act. Only systems that perform profiling, make decisions regarding access to essential services, or serve vulnerable groups are classified as “high-risk.” In this article, you’ll learn exactly how the risk categories work, which AI applications for customer service are used in which countries, and what your organization needs to do right now.
What are the risk categories under the AI Act?
The AI Act classifies all AI systems into four risk levels: prohibited, high risk, limited risk, and minimal risk. Most AI applications in the business sector fall into the minimal-risk category and are therefore completely unregulated. The higher the potential risk to fundamental rights or safety, the more stringent the obligations.
The four levels work as follows:
- Prohibited (unacceptable risk): Applications that are completely prohibited, such as social scoring by governments, manipulative techniques that influence behavior without a person’s awareness, emotion recognition in the workplace outside of medical or safety exceptions, and real-time biometric identification in public spaces for law enforcement. These prohibitions have been in effect since February 2, 2025.
- High risk: Systems that fall under the eight domains listed in Annex III, including biometrics, critical infrastructure, employment, access to essential services, and law enforcement. Strict requirements apply to these systems.
- Limited risk: Systems such as chatbots and AI that generate synthetic content. These are subject to less stringent transparency requirements, such as the obligation to inform users that they are communicating with an AI.
- Minimal or no risk: The vast majority of current AI applications, such as spam filters or recommendation algorithms. No specific obligations apply.
In addition to these four levels, the law introduces a separate regime for General Purpose AI (GPAI) models, such as large language models. All providers of such models must maintain technical documentation and inform downstream providers about the models’ capabilities and limitations. Models that exceed a certain computational capacity threshold (more than1,025 FLOPs of training compute) are classified as models posing a systemic risk and are subject to additional obligations.
Which omnichannel AI applications are classified as “low risk”?
Omnichannel AI applications that communicate directly with customers generally fall into the “limited risk” category. Specifically, these include chatbots, virtual assistants, and AI-generated content. The primary requirement is transparency: users must know that they are communicating with an AI system, unless this is self-evident from the context.
Typical examples from the omnichannel contact center environment that are considered low-risk:
- Chatbots on websites, WhatsApp, or other channels that answer customer questions
- Virtual phone assistants that answer or route calls
- AI systems that automatically generate email replies for review by an employee
- Sentiment analysis that supports employees during a conversation, without making decisions on its own
- Agentic AI assistants that automate repetitive tasks within a predefined framework
For these applications, you do not need to submit a conformity assessment or set up a risk management system. However, you must make it clear in the user interface that the customer is interacting with an AI system. This applies to all channels within your omnichannel setup, whether it’s chat, phone, or email.
When is a contact center AI system classified as high risk?
A contact center AI system is classified as high-risk if it falls under one of the eight domains listed in Annex III of the AI Act, or if it performs profiling of individuals. Systems that support or make decisions regarding access to essential services, creditworthiness, or insurance are always considered high-risk, regardless of the sector.
Specifically, for omnichannel contact centers, this means you need to be extra vigilant in the following situations:
- Customer profiling: Any system that profiles individuals is automatically classified as high-risk. This applies even if the primary purpose is a different task.
- Access to essential services: AI that plays a role in determining whether a customer is granted access to emergency shelter, social benefits, or similar services is considered high-risk.
- Credit and insurance decisions: Contact center AI that provides input for creditworthiness assessments or insurance premiums also falls into this category.
- Employment and Human Resources: Using AI to screen job applicants or evaluate employees based on their performance in the contact center is high-risk.
An Annex III system may be excluded from the high-risk category if it performs only a narrow procedural or preparatory task and does not pose a significant risk to fundamental rights. However, the provider must provide substantiated documentation to support this. Systems that perform profiling are never eligible for this exception.
Most of the requirements for high-risk Annex III systems take effect on August 2, 2026. That may seem far off, but given the scope of the required documentation and processes, it’s wise to start identifying now which systems in your environment might fall into this category.
What are the obligations of AI providers versus AI users?
The AI Act draws a clear distinction between providers (the party that develops and markets an AI system) and deployers (the organization that uses the system under its own authority). Providers bear the heaviest obligations; deployers have fewer obligations, but they are by no means free from responsibility.
Requirements for Providers of High-Risk AI
As a provider of a high-risk AI system, you must, among other things:
- Establish and maintain a continuous risk management system throughout the entire lifecycle
- Working with training, validation, and test data that are representative and as free from bias as possible
- Prepare technical documentation in accordance with Annex IV of the AI Act
- Enable automatic event logging
- Adopt a design that effectively enables human oversight
- Conduct a conformity assessment, issue an EU declaration of conformity, and register the system in the EU database
Requirements for Deployers (Those Responsible for Use)
As a deployer—that is, an organization that deploys an AI system from a third-party provider in its contact center—you are subject to less stringent but specific obligations:
- Use the system in accordance with the provider’s instructions for use
- Assign human supervision to qualified and trained individuals
- Retain logs for at least six months
- Informing employees before the system is put into use (Article 26(7))
- Conduct a data protection impact assessment (DPIA) where applicable
Please note: If your organization registers its name on a system, makes a substantial change to it, or alters its intended purpose in such a way that the system becomes high-risk, you will become a provider yourself, with all the associated obligations. This is a point that is often overlooked in practice.
How do you prepare your organization for AI Act compliance?
Preparing for AI Act compliance begins with a comprehensive inventory of all AI systems your organization uses or is considering implementing. Next, classify each system based on the risk categories, determine whether you are a provider or a deployer, and set up the necessary processes. Start well in advance of the deadlines, because high-risk systems in particular require substantial documentation and governance.
A practical step-by-step approach:
- Create an AI inventory: Identify all AI applications, including chatbots, routing systems, sentiment analysis, and automation tools across all channels.
- Classify each system: For each application, determine the risk level based on the Annex III domains and whether profiling occurs.
- Determine your role: Are you a provider or a deployer? This determines what obligations you have.
- Check transparency requirements: Make sure customers know when they are interacting with AI, on every channel within your omnichannel setup.
- Establish logging and oversight: Determine who will provide human oversight of AI decisions and ensure that logs are retained for at least six months.
- Train employees: AI literacy has been mandatory since February 2, 2025. Employees who work with AI systems must understand what the system does and what its limitations are.
- Keep an eye on the timeline: Most requirements for high-risk Annex III systems take effect on August 2, 2026. For GPAI models, the requirements take effect as early as August 2, 2025.
The penalty structure reflects how seriously the legislature takes this: violations of the prohibited practices can result in fines of up to 35 million euros or 7% of global annual revenue. Noncompliance with other obligations can result in fines of up to 15 million euros or 3%. For smaller organizations, the lower of the percentage or the fixed amount applies in each case, but even that can be substantial.
How Pegamento Helps Ensure AI Act Compliance in Your Contact Center
Navigating the AI Act while simultaneously improving your customer interactions requires a partner who understands both worlds. At Pegamento, we combine AI-driven intelligence with an approach that prioritizes transparency and human oversight. This allows you to deliver a better customer experience without unnecessary compliance risks.
What we specifically offer:
- Omnichannel AI solutions that comply with transparency requirements for low-risk systems by default
- Agentic AI assistants that take over repetitive tasks within a framework that ensures human oversight, in line with the deployer obligations under the AI Act
- Everything under one roof: from implementation to management and documentation, so you don’t have to coordinate with multiple vendors on compliance issues
- Customized solutions built using standard building blocks, certified under ISO 27001 (information security), ISO 9001, and ISO 26000, so you can operate on a solid foundation
- Understanding which systems in your environment can be classified as high-risk and how to address this in practice
Would you like to know how your current or planned AI applications align with the AI Act? Contact us, and we’d be happy to work with you to develop an approach that suits your organization.
Frequently Asked Questions
Geldt de AI Act ook voor kleine en middelgrote ondernemingen die AI inzetten in hun contactcenter?
Ja, de AI Act is van toepassing op alle organisaties die AI-systemen gebruiken of aanbieden binnen de EU, ongeacht hun omvang. Voor kleinere organisaties geldt bij boetes wel het laagste bedrag van het vaste bedrag of het percentage van de jaaromzet, wat in de praktijk enige bescherming biedt. Toch zijn de basisverplichtingen — zoals transparantie naar klanten en AI-geletterdheid bij medewerkers — ook voor mkb-bedrijven verplicht en al van kracht sinds 2 februari 2025.
Wat als onze AI-leverancier claimt dat hun systeem compliant is — zijn wij dan automatisch ook compliant als deployer?
Nee, de compliance van je leverancier (aanbieder) dekt niet automatisch jouw verplichtingen als deployer. Als deployer blijf je zelf verantwoordelijk voor zaken zoals het inrichten van menselijk toezicht, het bewaren van logs gedurende minimaal zes maanden, het informeren van medewerkers vóór ingebruikname, en het uitvoeren van een DPIA waar vereist. Vraag je leverancier altijd om de benodigde technische documentatie en gebruiksaanwijzing, zodat jij jouw eigen deployer-verplichtingen kunt nakomen.
Hoe weet ik zeker of ons AI-systeem aan profilering doet en daarmee hoog risico is?
Profilering in de zin van de AI Act betekent het geautomatiseerd verwerken van persoonsgegevens om aspecten van een natuurlijk persoon te evalueren, zoals gedrag, voorkeuren of betrouwbaarheid. Als jouw systeem klantdata combineert om voorspellingen of segmentaties per individu te maken — ook als dat een bijproduct is van een andere functie — is er sprake van profilering en geldt automatisch hoog risico. Raadpleeg bij twijfel een juridisch adviseur of neem contact op met je AI-leverancier om de werking van het systeem te toetsen aan deze definitie.
Moeten we klanten ook informeren dat ze met AI communiceren als de AI enkel intern wordt gebruikt, zoals voor het routeren van gesprekken?
De transparantieverplichting voor beperkt-risico systemen geldt specifiek voor AI-systemen die direct met mensen communiceren, zoals chatbots en virtuele assistenten. Puur interne routeringssystemen waarbij de klant geen directe interactie heeft met de AI zelf, vallen hier doorgaans niet onder. Toch is het verstandig om ook interne systemen te documenteren en te beoordelen, zeker als zij input leveren voor beslissingen die de klant raken.
Wat is de grootste praktische fout die organisaties maken bij het voorbereiden op de AI Act?
De meest gemaakte fout is het onderschatten van de scope van de AI-inventarisatie: veel organisaties denken alleen aan hun primaire chatbot, maar vergeten routeringssystemen, sentimentanalysetools, automatische e-mailoplossingen en eventuele AI-functies binnen hun CRM of WFM-platform. Een tweede veelvoorkomende fout is ervan uitgaan dat je als deployer geen eigen verplichtingen hebt. Begin daarom met een brede inventarisatie over alle kanalen en systemen, en betrek zowel IT, juridische zaken als operationele teams bij de classificatie.
Geldt de AI-geletterdheidsplicht voor alle medewerkers in ons contactcenter, of alleen voor specifieke functies?
De AI-geletterdheidsplicht (Artikel 4 van de AI Act, van kracht sinds 2 februari 2025) geldt voor medewerkers die met AI-systemen werken of deze beheren, afgestemd op hun specifieke rol en de systemen waarmee zij in aanraking komen. Dat betekent in de praktijk dat zowel agents die dagelijks met een AI-ondersteund systeem werken als teamleiders en beheerders een passend basisniveau van AI-begrip moeten hebben. Een one-size-fits-all training volstaat niet; stem de inhoud af op wat elke groep medewerkers daadwerkelijk moet begrijpen over het systeem dat zij gebruiken.
Wat gebeurt er als we een bestaand AI-systeem significant aanpassen — moeten we dan opnieuw beoordelen of het nog steeds beperkt risico is?
Ja, een substantiële wijziging aan een AI-systeem vereist een hernieuwde risicoclassificatie. Bovendien kan een significante aanpassing ertoe leiden dat jouw organisatie juridisch gezien van deployer naar aanbieder verschuift, met alle bijbehorende zwaardere verplichtingen. Leg daarom wijzigingen altijd vast in je documentatie en toets elke aanpassing expliciet aan de risicocriteria van de AI Act voordat je deze in productie neemt.
