{"id":32840,"date":"2026-07-24T08:00:00","date_gmt":"2026-07-24T06:00:00","guid":{"rendered":"https:\/\/pegamento.nl\/niet-gecategoriseerd\/how-do-you-conduct-an-ai-act-compliance-check-for-your-contact-center\/"},"modified":"2026-07-24T10:00:53","modified_gmt":"2026-07-24T08:00:53","slug":"how-do-you-conduct-an-ai-act-compliance-check-for-your-contact-center","status":"publish","type":"post","link":"https:\/\/pegamento.nl\/en\/contact-center\/how-do-you-conduct-an-ai-act-compliance-check-for-your-contact-center\/","title":{"rendered":"How do you conduct an AI Act compliance check for your contact center?"},"content":{"rendered":"<p>To conduct an AI Act compliance check for your contact center, you should first identify all AI systems, classify each system by risk level, determine the corresponding obligations, and then assess whether your current situation meets those requirements. This applies to any organization that uses AI systems in customer interactions, regardless of whether you developed those systems yourself or purchased them from a vendor. In this article, we answer the most frequently asked questions about <a href=\"https:\/\/pegamento.nl\/en\/ai-powered-intelligence\/\">AI compliance<\/a> in contact centers, from classification to concrete action steps.  <\/p>\n<h2>Which AI systems in a contact center are covered by the AI Act?<\/h2>\n<p>The AI Act applies to any system that uses machine learning, logic, or statistics to generate outputs\u2014such as text, decisions, recommendations, or predictions\u2014and that is deployed in or for the EU. In a contact center, this quickly adds up to a wide range of tools that you use on a daily basis. <\/p>\n<p>Specific examples of systems covered by the AI Act include:<\/p>\n<ul>\n<li>Chatbots and virtual assistants that handle customer interactions<\/li>\n<li>Speech Recognition and Automatic Transcription of Phone Calls<\/li>\n<li>Intelligent routing systems that determine which employee receives a call<\/li>\n<li>Systems that predict customer satisfaction or churn risk<\/li>\n<li>AI-driven quality assurance that analyzes conversations and evaluates employees<\/li>\n<li>Agentic AI assistants that independently perform actions within customer processes<\/li>\n<\/ul>\n<p>Important: The law applies not only to providers who develop AI, but also to deployers\u2014that is, organizations that use AI systems developed by others under their own authority. If your contact center uses a chatbot from a vendor, you are the deployer and have your own obligations. So you don\u2019t have to build the software yourself to be subject to the law.  <\/p>\n<h2>How do you determine the risk level of your contact center AI?<\/h2>\n<p>You determine the risk level of an AI system by assessing it against the risk classification in the AI Act, which has four levels: prohibited, high risk, limited risk, and minimal risk. Most contact center AI falls into the limited-risk or high-risk category, depending on what the system does and which decisions it influences. <\/p>\n<h3>When is contact center AI considered high-risk?<\/h3>\n<p>High-risk AI is defined in Article 6 of the AI Act. In a contact center context, a system is considered high-risk if it falls under one of the eight domains listed in Annex III. Of particular relevance to contact centers are: access to essential services (such as systems that determine whether someone is eligible for insurance or credit) and employment or human resources management (such as systems that evaluate employees or monitor performance). Systems that perform profiling of natural persons are always high-risk, regardless of the purpose.   <\/p>\n<h3>When is contact center AI considered to be a limited risk?<\/h3>\n<p>AI systems that interact with people without making significant decisions are considered to pose a limited risk. A chatbot that answers questions about business hours or an order status typically falls into this category. The main requirement here is transparency: the user must know that he or she is communicating with an AI system, not a human.  <\/p>\n<h2>What requirements apply for each risk category?<\/h2>\n<p>The obligations under the AI Act depend heavily on the risk level and on your role\u2014whether as a provider or a deployer. As a contact center, you are typically a deployer, which means you have fewer obligations than the party that developed the system, but you are by no means free of responsibilities. <\/p>\n<p>As a deployer of a high-risk system, you must:<\/p>\n<ul>\n<li>Use the system in accordance with the provider&#8217;s instructions for use<\/li>\n<li>Assign human supervision to qualified and trained employees<\/li>\n<li>Retain log files for at least six months<\/li>\n<li>Informing employees before the system is put into use (Article 26(7))<\/li>\n<li>Conduct a data protection impact assessment (DPIA) where applicable<\/li>\n<\/ul>\n<p>For low-risk AI, the primary obligation is transparency toward the end user: people must know that they are interacting with an AI system. There are no specific obligations for AI with minimal risk, although the GDPR continues to apply to personal data that is processed. <\/p>\n<h2>How do you perform an AI Act compliance check step by step?<\/h2>\n<p>You can conduct an AI Act compliance check in five steps: identify all AI systems, classify each system by risk level, identify the corresponding obligations, assess the current situation against these obligations, and develop an action plan to address any gaps found. This is not a one-time exercise, but an ongoing process. <\/p>\n<ol>\n<li><strong>Take inventory of all AI systems:<\/strong> Create a comprehensive overview of all tools and systems in your contact center that include AI functionality. These include chatbots, routing software, analytics dashboards, and quality monitoring. Also, check with vendors to find out which AI components are included in their products.  <\/li>\n<li><strong>Determine the risk level:<\/strong> Assess each system against the AI Act\u2019s risk classification. Use the Annex III domains as a checklist for high-risk AI. Document your reasoning for each system.  <\/li>\n<li><strong>Determine your role:<\/strong> Are you a provider or a deployer? For most contact centers, the term \u201cdeployer\u201d applies, but if you customize systems yourself or offer them under your own name, provider obligations may arise. <\/li>\n<li><strong>Identify obligations:<\/strong> For each system, determine which obligations apply based on risk level and role. Pay particular attention to human oversight, logging, employee notification, and DPIA requirements. <\/li>\n<li><strong>Assess and document:<\/strong> Compare the current situation with the requirements and record your findings. Set priorities based on risk level and deadlines from the implementation timeline. <\/li>\n<\/ol>\n<h2>What are the most common compliance gaps in contact centers?<\/h2>\n<p>The most common compliance gaps in contact centers include insufficient documentation of AI systems, a lack of human oversight of automated decisions, and a failure to inform employees about the use of AI. These gaps are not always apparent in day-to-day operations, but become immediately evident during an audit or incident. <\/p>\n<p>Specific challenges you frequently encounter:<\/p>\n<ul>\n<li><strong>Lack of system inventory:<\/strong> Organizations do not know exactly which AI components are active, especially in the case of SaaS tools that are regularly updated by vendors.<\/li>\n<li><strong>Lack of logging:<\/strong> Log files are not retained at all or are retained for an insufficient period, even though the law requires a six-month retention period for high-risk systems.<\/li>\n<li><strong>Lack of employee notification:<\/strong> Employees have not been informed about AI systems that support or monitor their work, which is a direct obligation under Article 26(7).<\/li>\n<li><strong>Unclear human oversight:<\/strong> There is no designated person responsible for monitoring AI decisions and intervening when necessary.<\/li>\n<li><strong>There is a lack of transparency toward customers:<\/strong> Customers do not know that they are talking to an AI chatbot, which is already a violation in the case of limited-risk systems.<\/li>\n<\/ul>\n<h2>When do you need to be AI Act compliant, and what are the consequences if you aren&#8217;t?<\/h2>\n<p>For most contact center AI, you must be fully compliant with the requirements for high-risk Annex III systems as of August 2, 2026. The transparency requirements for low-risk AI and the prohibitions under Article 5 have already taken effect, on August 2, 2025, and February 2, 2025, respectively. <\/p>\n<p>The penalty structure has three tiers. Violations of prohibited practices can result in a fine of up to 35 million euros or 7% of global annual revenue. Noncompliance with other obligations may be penalized with a fine of up to 15 million euros or 3%. Providing false information to regulators may result in a fine of up to 7.5 million euros or 1%. For smaller organizations, the lower of the fixed amount or the percentage applies in all cases.    <\/p>\n<p>In addition to financial risks, there are also operational and reputational consequences. Regulators can shut down the use of a non-compliant system, which has a direct impact on your customer contact operations. Furthermore, customer awareness of AI usage is growing, and organizations that do not take transparency seriously risk reputational damage.  <\/p>\n<p>Don&#8217;t start too late. The implementation timeline may seem generous, but conducting a thorough assessment, adapting processes, and training employees take more time than expected. <\/p>\n<h2>How Pegamento Helps Ensure AI Act Compliance in Your Contact Center<\/h2>\n<p>AI Act compliance is not a one-time project, but an ongoing part of responsible AI use. We help contact centers at every step of that process\u2014from assessment to implementation and management\u2014all under one roof, without complex vendor arrangements. <\/p>\n<p>What we specifically do for you:<\/p>\n<ul>\n<li>Inventory of all AI systems in your contact center and classification by risk level<\/li>\n<li>Establishing human oversight, logging, and documentation processes that align with the AI Act requirements<\/li>\n<li>Implementing <a href=\"https:\/\/pegamento.nl\/en\/agentic-ai-for-customer-service\/\">Agentic AI for customer service<\/a>, which is designed from the ground up with transparency and control as its guiding principles. Agentic AI represents the evolution from traditional RPA bots to self-thinking assistants that not only follow instructions but also take the initiative and act independently within the parameters you define. <\/li>\n<li>Advice on combining proven modules that fit your situation, without the need for costly customization<\/li>\n<li>Support for employee communication and establishing AI literacy within your team<\/li>\n<\/ul>\n<p>Our approach is built on ISO 27001-certified information security, supplemented by ISO 9001 and ISO 26000, ensuring that compliance isn\u2019t just on paper but is also guaranteed in practice. Would you like to know where your contact center currently stands in terms of AI compliance? <a href=\"https:\/\/pegamento.nl\/en\/contact-2\/\">Get in touch<\/a>, and we\u2019ll work together to determine the next step. <\/p>\n<div class=\"wp-block-seoaic-faq-block\">\n    <h2 class=\"seoaic-faq-section-title\">Frequently Asked Questions<\/h2>\n            <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Geldt de AI Act ook als mijn contactcenter buiten de EU is gevestigd maar wel EU-klanten bedient?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Ja, de AI Act heeft een extraterritoriale werking. Als jouw contactcenter AI-systemen inzet die outputs genereren voor personen die zich in de EU bevinden, ben je gebonden aan de wet, ongeacht waar jouw organisatie gevestigd is. Dit betekent dat ook offshore of nearshore contactcenters die voor Europese opdrachtgevers werken, moeten voldoen aan de AI Act-verplichtingen.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Hoe weet ik of een SaaS-tool van een leverancier AI-componenten bevat die onder de AI Act vallen?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Vraag je leverancier expliciet om een AI-systeemkaart of technische documentatie waarin staat welke AI-functionaliteit in het product is verwerkt. Betrouwbare leveranciers zijn verplicht om als aanbieder transparantie te bieden over hun systemen en jou als deployer de benodigde informatie te verstrekken om jouw verplichtingen na te komen. Leg dit ook contractueel vast: zorg dat leveranciers je actief informeren bij updates die nieuwe AI-functionaliteit introduceren, want SaaS-tools worden regelmatig bijgewerkt zonder expliciete melding.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Wat is het verschil tussen een AI Act compliance check en een DPIA, en heb ik beide nodig?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Een AI Act compliance check toetst of je AI-systemen voldoen aan de verplichtingen uit de AI Act, zoals risicoklassificatie, menselijk toezicht en transparantie. Een DPIA (Data Protection Impact Assessment) is een AVG-instrument dat de risico&#8217;s van gegevensverwerking voor betrokkenen in kaart brengt. Je hebt beide nodig als je hoog-risico AI inzet die ook persoonsgegevens verwerkt, wat in een contactcenter vrijwel altijd het geval is. De twee processen overlappen deels, maar vullen elkaar aan en moeten allebei worden uitgevoerd.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Hoe informeer ik mijn medewerkers correct over AI-systemen die hun werk monitoren, zoals kwaliteitsbewaking?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Artikel 26(7) van de AI Act verplicht je om medewerkers te informeren v\u00f3\u00f3rdat een AI-systeem in gebruik wordt genomen dat hun werk ondersteunt of monitort. Dit betekent in de praktijk: communiceer schriftelijk welk systeem wordt ingezet, wat het doet, welke data het verzamelt en hoe de uitkomsten worden gebruikt. Combineer dit met een korte training over AI-geletterdheid zodat medewerkers begrijpen wat de AI wel en niet kan, en hoe ze bezwaar kunnen maken of escaleren als ze het niet eens zijn met een AI-gegenereerde beoordeling.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Kan ik een bestaande chatbot blijven gebruiken als die nog niet AI Act-compliant is?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Dat hangt af van het risiconiveau en de betreffende verplichting. De transparantieverplichting voor beperkt-risico chatbots is al per 2 augustus 2025 van kracht, dus als jouw chatbot klanten niet informeert dat ze met AI communiceren, is dat nu al een overtreding. Voor hoog-risico verplichtingen geldt de deadline van 2 augustus 2026. Gebruik de periode tot die deadline niet als excuus om niets te doen: start nu met de inventarisatie en pak de eenvoudigst te realiseren aanpassingen, zoals transparantiemelding aan klanten, direct op.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Wat moet ik doen als mijn contactcenter zowel deployer als aanbieder is, bijvoorbeeld omdat we een standaard chatbot hebben aangepast?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Zodra je een AI-systeem substantieel aanpast, zoals het hertrainen van een model, het wijzigen van de beoogde toepassing of het integreren van extra functionaliteit, wordt je juridisch gezien aanbieder voor dat systeem. Dit brengt aanzienlijk zwaardere verplichtingen met zich mee, waaronder conformiteitsbeoordeling, technische documentatie en CE-markering voor hoog-risico systemen. Laat een juridisch of compliance-specialist beoordelen of jouw aanpassingen de grens van &#8216;substantieel&#8217; overschrijden, want dit onderscheid heeft grote gevolgen voor je verantwoordelijkheden.            <\/p>\n        <\/div>\n                <div class=\"seoaic-faq-item\">\n            <h3 class=\"seoaic-question\">\n                Hoe houd ik mijn AI Act compliance up-to-date als leveranciers hun systemen regelmatig updaten?            <\/h3>\n            <p class=\"seoaic-answer\">\n                Stel een intern beheerproces in waarbij elke significante update van een AI-systeem automatisch triggert tot een herclassificatie en compliance-check. Leg in je leverancierscontracten vast dat de aanbieder jou tijdig moet informeren over updates die de AI-functionaliteit of het risiconiveau van het systeem kunnen be\u00efnvloeden. Plan daarnaast minimaal \u00e9\u00e9n keer per jaar een volledige herziening van je AI-inventarisatie, zodat nieuwe tools die tussendoor zijn ge\u00efntroduceerd ook worden meegenomen in je compliance-overzicht.            <\/p>\n        <\/div>\n        <\/div>\n","protected":false},"excerpt":{"rendered":"<p>Do you know which AI systems in your contact center are covered by the AI Act? Discover the 5 steps to full compliance by August 2026. <\/p>\n","protected":false},"author":2,"featured_media":32841,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[500],"tags":[],"class_list":["post-32840","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-contact-center"],"_links":{"self":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/32840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/comments?post=32840"}],"version-history":[{"count":2,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/32840\/revisions"}],"predecessor-version":[{"id":32843,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/posts\/32840\/revisions\/32843"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/media\/32841"}],"wp:attachment":[{"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/media?parent=32840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/categories?post=32840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pegamento.nl\/en\/wp-json\/wp\/v2\/tags?post=32840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}