AI Act and customer service what the regulation really requires of a conversational agent

I

A risk-based regulation, and a customer-relations agent in the middle of the scale

Regulation (EU) 2024/1689 entered into force on August 1, 2024¹. The Commission presents its approach in four risk levels: prohibited practices, high-risk systems, systems subject to transparency obligations, and the rest, with no specific obligation³⁵.

An AI agent that answers questions, tracks an order or books an appointment generally falls under the third level. The Commission’s guidelines on Article 50 explicitly cite conversational agents for customer support, complaint handling and e-commerce, as well as voice assistants⁵. The agent is neither prohibited nor high-risk by nature, but it must identify itself as an AI.

Cases that push an agent into high risk

Classification depends on purpose, not on technology. Point 5 of Annex III, on access to essential services, directly touches customer relations¹ :

An agent that merely explains a credit offer produces, in principle, neither the decision nor the score. Article 6, paragraph 3, rules out the high-risk classification where the system does not pose a significant risk of harm, including because it does not materially influence the outcome of the decision, for example if it performs a narrow procedural task or a preparatory task. This derogation never applies where natural persons are profiled¹.

Voice agents call for particular vigilance. An emotion recognition system identifies or infers emotions or intentions from biometric data (Article 3, point 39)¹, and the Commission’s guidelines cite voice among this data⁷. An agent that infers a caller’s emotional state from their voice is therefore likely to fall under Annex III, point 1(c), and its deployer must inform the people exposed (Article 50, paragraph 3)¹.

II

Article 50: identifying as an AI from the very first exchange

Article 50, paragraph 1, requires providers to design systems that interact directly with people so that they know they are interacting with an AI. Under paragraph 5, the information is provided in a clear and recognizable way, at the latest at the time of the first interaction, and meets accessibility requirements¹. These obligations have applied since August 2, 2026⁵.

What the Commission’s guidelines say

The Commission approved the content of its guidelines on July 20, 2026 (C(2026) 5054), announcing their formal adoption once all language versions are available⁵. Though non-binding, they give concrete benchmarks

• Form. A welcome message that mentions the AI, a plain-language banner, a persistent badge near the input field, or, by phone, a sentence spoken at the start of the call. A sound signal alone is not enough⁵.
• What isn’t enough. A mention placed only in the terms and conditions, a marking readable only by a machine, the generic term “assistant”, a global mention such as “the services on this site use AI” or a purely technical reference to language models⁵.
• Frequency. A single, visible notification before the first interaction is usually enough. Reminders are expected in more sensitive contexts: financial advice, insurance, health, complaint handling, vulnerable audiences⁵.
• Agents that act. An agent that books, buys or manages correspondence must state its artificial nature and the person on whose behalf it acts⁵.

The “obvious interaction” exception is interpreted strictly: agents built into helpdesk tools are among the examples where it does not apply⁵. Out of scope, on the other hand, are rule-based automatic replies and the tool that helps a human advisor draft a reply, as long as the advisor remains the person the customer deals with⁵.

Marking of generated content

Article 50, paragraph 2, requires providers of systems that generate audio, image, video or text to apply machine-readable marking¹. It can target the content of an AI agent that a person perceives, not its intermediate reasoning steps⁵. For generative systems placed on the market before August 2, 2026, the AI Omnibus grants a delay until December 2, 2026, limited to marking: the user information requirement is not postponed²⁵.

A voluntary code of practice, published in June 2026, covers paragraphs 2 and 4⁶. Paragraph 4 requires the deployer to flag deepfakes, that is, AI-generated or manipulated images, audio or video content that resembles existing persons, objects, places, entities or events and could falsely appear authentic (Article 3, point 60)¹. Some marketing content may be affected.

III

Article 5: where commercial persuasion stops

Prohibited practices have applied since February 2, 2025. Two concern an agent that advises and sells. Article 5, paragraph 1, point (a), prohibits subliminal, deliberately manipulative or deceptive techniques that materially distort a person’s behavior and cause, or are likely to cause, significant harm. Point (b) prohibits, under the same conditions, exploiting vulnerabilities linked to age, disability or a specific social or economic situation¹.

Recital 29 clarifies that legitimate commercial practices, such as advertising that complies with the law, are not in themselves manipulative¹. The Commission’s guidelines on prohibited practices (C(2025) 5052) distinguish “lawful persuasion”, which operates transparently, with accurate information and respect for choice, from manipulation, which relies on hidden techniques exploiting biases⁷. Their examples are telling: personalized recommendations based on transparent algorithms count as persuasion; secretly inferring consumers’ emotions to offer higher prices when they are inclined to buy is manipulation⁷. The difference lies in the methods used and their consequences for the person, not in the fact of trying to sell.

The AI Omnibus adds a prohibition applicable from December 2, 2026, targeting systems that generate non-consensual sexual or intimate content and child sexual abuse material (Article 5, paragraph 1, points b bis and b ter)²³. It does not concern normal use in customer relations.

IV

Provider or deployer: who bears which obligation

The provider develops a system and places it on the market or puts it into service under its own name or trademark (Article 3, point 3). The deployer uses it under its authority, in a professional capacity (Article 3, point 4)¹. For a limited-risk agent

• The provider designs the Article 50(1) information and the Article 50(2) marking. The guidelines state that it must guarantee this transparency whoever the deployers are⁵.
• The deployer bears the obligations of Article 50(3), if the system recognizes emotions, and of Article 50(4), for deepfakes and certain texts of public interest¹⁵.
• Both are subject to the AI literacy obligation of Article 4⁵.

Classification depends on the facts: a company that develops an agent in-house, or modifies an existing system, and puts it into service under its own name is a provider⁵. For high-risk systems, Article 25 also makes a deployer a provider, notably if it markets the system under its own name or trademark, substantially modifies it or changes its intended purpose¹.

If the agent is high-risk, Article 26 requires the deployer to use it in accordance with the instructions, apply competent human oversight, monitor operation, keep logs for at least six months and inform the people concerned by a decision. Article 27 adds a fundamental rights impact assessment, notably for credit and life or health insurance¹. These rules will apply from December 2, 2027³.

V

Article 4: AI literacy, an organizational obligation

Article 4 has applied since February 2, 2025. Its initial version asked providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among their staff¹. The AI Omnibus simplified this obligation and strengthened the role of the Commission and the Member States⁴. The amended text asks them to take measures to encourage the development of this literacy, with no obligation to guarantee a given level for each person². In practice, the teams who configure the agent, read its conversations and step in must understand what it does and what its limits are.

VI

General-purpose AI models: what stays with the model provider

Most agents are built on a general-purpose AI model. The obligations on these models (Article 53 and following) have applied since August 2, 2025 and fall on their provider: technical documentation, information for downstream providers, a copyright policy, a summary of the training data¹³. A code of practice was published on July 10, 2025⁹. Models placed on the market before August 2, 2025 have until August 2, 2027¹.

Fine-tuning a model does not automatically make you its provider. Guidelines C(2025) 7719 use an indicative criterion: the downstream modifier becomes its provider when the computing power used for the modification exceeds a third of that used to train the original model⁸. The agent built on the model remains subject to Article 50⁵.

VII

The timeline after the AI Omnibus

Proposed by the Commission on November 19, 2025, the AI Omnibus was the subject of a political agreement on May 7, 2026 and entered into force on July 27, 2026³⁴. It is Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24, 2026². The postponement of high-risk rules is therefore adopted, and no longer merely proposed.

The “Digital Omnibus” proposed the same day, which aims in particular to amend the GDPR, is a separate text. According to the European Parliament’s Legislative Observatory, it is still awaiting the decision of the parliamentary committees¹⁰: its proposals are not applicable law.

VIII

Penalties: three tiers

Article 99 sets ceilings for administrative fines¹ :

• up to €35 million or 7% of total worldwide annual turnover for the prohibited practices of Article 5;
• up to €15 million or 3% for the other listed breaches, including deployer obligations (Art. 26) and transparency (Art. 50);
• up to €7.5 million or 1% for supplying inaccurate information to the authorities.

The higher amount applies, except for SMEs and start-ups, for which it is the lower¹. The AI Omnibus extends this reduced cap to small mid-cap companies for the last two tiers (Article 99, paragraph 6a)².

IX

GDPR and consumer law: the texts that continue to apply

The AI regulation does not replace the GDPR. According to the CNIL, the deployer is most often the data controller during use, and the data protection impact assessment will be presumed to be required of the provider and the deployer of high-risk systems¹¹.

GDPR Article 22 protects against decisions based solely on automated processing, including profiling, that produce legal effects or significantly affect the person. The exceptions are contract, law or explicit consent; in the case of contract or consent, the person keeps the right to obtain human intervention, to express their point of view and to contest the decision¹². In its SCHUFA judgment of December 7, 2023 (C-634/21), the Court of Justice held that the automated establishment of a credit score falls under Article 22 when it plays a determining role in a third party’s decision¹³. An agent that alone refuses an installment payment must be examined from this angle, regardless of the AI regulation.

Consumer law applies in addition: the guidelines recall that Directives 2005/29/EC (unfair commercial practices) and 2011/83/EU (consumer rights) apply in parallel⁵. For distance financial services contracts, Directive (EU) 2023/2673, whose national transposition rules have applied since June 19, 2026, gives consumers the right to request and obtain human intervention when the professional uses online tools, such as conversational agents¹⁴.

X

What this means for your organization

For a deployer, compliance comes down to ten checks, in the order they arise.

1. Map the uses. List what each agent does (inform, sell, book, refund, decide). Flag any use close to Annex III, point 5, and any analysis of voice or face.
2. Determine your role. Deployer or provider, notably if the agent is developed in-house or put into service under your brand.
3. Check the Article 50 disclosure. AI mention in the first message and at the start of calls, legible, accessible, on every channel. Reminders in sensitive journeys.
4. Check the commercial limits. Review the agent’s rules against Article 5: accurate information on prices and terms, no exploitation of a customer’s vulnerability.
5. Set up the human handoff. A handoff to an advisor for any decision that significantly affects the customer and for distance financial services.
6. Train the teams. Document the actions taken under Article 4.
7. Flag generated content. Identify the visuals, sounds and videos produced by AI that constitute deepfakes within the meaning of Article 50(4).
8. Ask the provider. Its commitments on Article 50(1) and (2), the model used, where processing takes place.
9. Align with the GDPR. Record of processing activities and, if necessary, an impact assessment.
10. Prepare for December 2027. If a use falls under high risk, anticipate Articles 26 and 27.

XI

Where QLOA stands

XII

Frequently asked questions

Is a customer service AI agent high-risk under the AI Act?

As a general rule, no. An agent that informs, tracks orders or books appointments falls under the transparency obligations of Article 50. It becomes high-risk if its purpose is listed in Annex III, for example creditworthiness assessment or pricing in life and health insurance, subject to the derogation in Article 6(3). The high-risk rules apply from December 2, 2027.

Do you have to tell customers they are talking to an AI?

Yes, since August 2, 2026. Article 50(1) requires that the person be informed that they are interacting with an AI, clearly and at the latest at the first interaction. According to the Commission’s guidelines, a mention in the terms and conditions alone or the simple word “assistant” is not enough; by phone, they recommend a spoken mention at the start of the call.

Did the AI Omnibus postpone Article 50?

No. Regulation (EU) 2026/1744, in force since July 27, 2026, postpones the high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). For Article 50, it grants only a delay until December 2, 2026 for the marking of content by generative systems already on the market. The user information requirement has applied since August 2, 2026.

What fine applies for failing the AI transparency obligation?

Article 99 of the AI regulation provides for up to €15 million or 3% of total worldwide annual turnover, whichever is higher, for a breach of Article 50. For SMEs and, since the AI Omnibus, small mid-cap companies, the lower amount applies. The prohibited practices of Article 5 are penalized by up to €35 million or 7%.

Can an AI agent sell without breaching Article 5?

Yes. Recital 29 and the Commission’s guidelines distinguish lawful persuasion from manipulation. Recommending products transparently, based on accurate information and the customer’s preferences, is lawful. Hidden or deceptive techniques, or the exploitation of vulnerabilities, that distort the decision and cause significant harm are prohibited.

Does the GDPR apply in addition to the AI regulation?

Yes. The CNIL reminds us that the AI regulation does not replace the GDPR and that the deployer is most often the data controller during use. GDPR Article 22 governs decisions based solely on automated processing: the person can obtain human intervention, express their point of view and contest the decision.

XIII

Sources

1. 1

   European Parliament and Council, “Regulation (EU) 2024/1689 of June 13, 2024 laying down harmonised rules on artificial intelligence”, OJ L of 12.7.2024. eur-lex.europa.eu

2. 2

   European Parliament and Council, “Regulation (EU) 2026/1744 of July 8, 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of the harmonised rules on artificial intelligence (Digital Omnibus on AI)”, OJ L of 24.7.2026. eur-lex.europa.eu

3. 3

   European Commission, “AI Act”, Shaping Europe’s digital future page, accessed October 23, 2026. digital-strategy.ec.europa.eu

4. 4

   European Commission, “AI Omnibus enters into force”, July 27, 2026. digital-strategy.ec.europa.eu

5. 5

   European Commission, “Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (the ‘AI Act’)”, annex to communication C(2026) 5054 approving their content, July 20, 2026. digital-strategy.ec.europa.eu

6. 6

   European Commission, “Signing the Code of Practice on Transparency of AI-generated Content”, 2026. digital-strategy.ec.europa.eu

7. 7

   European Commission, “Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act)”, C(2025) 5052, July 29, 2025. digital-strategy.ec.europa.eu

8. 8

   European Commission, “Guidelines on the scope of the obligations for providers of general-purpose AI models under Regulation (EU) 2024/1689 (AI Act)”, C(2025) 7719, November 19, 2025. digital-strategy.ec.europa.eu

9. 9

   European Commission, “General-Purpose AI Code of Practice now available”, July 10, 2025. digital-strategy.ec.europa.eu

10. 10

    European Parliament, Legislative Observatory, procedure 2025/0360(COD) “Simplification of the digital legislative framework – Digital Omnibus (Omnibus VII)”, accessed October 23, 2026. oeil.europarl.europa.eu

11. 11

    CNIL, “Entry into force of the European AI regulation: CNIL’s first questions and answers”, updated August 17, 2026. cnil.fr

12. 12

    European Parliament and Council, “Regulation (EU) 2016/679 (GDPR)”, Article 22, OJ L 119 of 4.5.2016. eur-lex.europa.eu

13. 13

    Court of Justice of the European Union, judgment of December 7, 2023, SCHUFA Holding (Scoring), C-634/21. curia.europa.eu

14. 14

    European Parliament and Council, “Directive (EU) 2023/2673 of November 22, 2023 amending Directive 2011/83/EU as regards financial services contracts concluded at a distance and repealing Directive 2002/65/EC”, OJ L of 28.11.2023. eur-lex.europa.eu