Yes — if your customer service chatbot talks to people in the EU, the EU AI Act applies. Which rule, whose duty and from when depends on your setup.
TL;DR: The EU AI Act has no customer service carve-out, unlike New York's 30 October chatbot law; most support bots owe only an Article 50 disclosure, while credit, insurance, emergency-triage and agent-scoring uses become high-risk on 2 December 2027.
Methodology & sources
- Legal text: the AI Act as amended by Regulation (EU) 2026/1744 (the Digital Omnibus, 8 July 2026), via the consolidated AI Act Explorer; the Commission's Article 50 guidelines (20 July 2026).
- New York: the sponsor's press release (30 October 2026); the exemption is from its summary, not chaptered text.
- Agent traffic: Arkose Labs, a vendor study of its own customers' traffic, 1 July–30 September 2026; total session count not disclosed.
- Read 2 November 2026. Not legal advice. Disclosure: this is Aissist's blog; Aissist sells AI agents that deploy onto helpdesks, making it a provider in row 2 below.
Does the EU AI Act apply to my customer service chatbot?
The EU AI Act applies to any customer service chatbot that interacts with people in the EU, whoever built it and wherever your company is based. Article 2(1) covers providers selling into the EU, deployers established there, and non-EU companies whose AI output is used there. Your setup decides the role, the rule and the date.
| If your setup is… | You are the | The rule that applies | Applies from |
|---|---|---|---|
| Helpdesk-native AI bot under your brand | Deployer; the helpdesk vendor is the provider | Art. 50(1) disclosure, built by the vendor, kept on by you; Art. 4 AI literacy | 2 Aug 2026 (Art. 4: 2 Feb 2025) |
| Third-party AI agent running on your helpdesk | Deployer; the AI vendor is the provider | Art. 50(1); the vendor owes Art. 50(2) machine-readable marking | 2 Aug 2026; marking for systems already on the market: 2 Dec 2026 |
| Self-hosted or self-built bot on a model you call or fine-tune | Provider and deployer | Art. 50(1) by design, Art. 50(2) marking, Art. 50(5) manner | 2 Aug 2026; legacy marking: 2 Dec 2026 |
| Voice IVR or voice AI agent | Deployer (provider if you built it) | Spoken Art. 50(1) disclosure at the first interaction | 2 Aug 2026 |
| Sentiment analysis on transcripts | Deployer | Text sentiment is not "emotion recognition" under Art. 3(39), which needs biometric data; voice-tone detection is, and needs an Art. 50(3) notice | 2 Aug 2026 (voice tone only) |
| AI that scores human agents or allocates tickets by personal traits | Deployer of a likely high-risk system | Annex III 4(b), Art. 26 deployer duties; emotion inference on staff is banned outright by Art. 5(1)(f) | 2 Dec 2027 (Art. 5: since 2 Feb 2025) |
| Bot that decides credit, life or health insurance pricing, public benefits or emergency triage | Deployer of a high-risk system | Annex III 5(a)–5(d), Art. 26 | 2 Dec 2027 |
| Non-EU company with EU customers, no EU establishment | Same role as the matching row above | Art. 2(1)(c) brings you in because the output is used in the EU | Same dates as above |
New York took the opposite route. S9051B/A10379C, announced by Senator Kristen Gonzalez's office on 30 October and effective 1 June 2027, restricts AI companions for minors and exempts chatbots used internally or for customer service.
"We have a responsibility to keep children safe online." — Kristen Gonzalez, New York State Senator, NY Senate
New York wrote customer service out. Brussels never wrote it in or out — the Act regulates by function, and "talks to people" is a function.
Are you a provider or a deployer?
A provider develops an AI system, or has one developed, and places it on the market under its own name (Article 3(3)); a deployer uses an AI system under its own authority (Article 3(4)). Most support teams are deployers, and their helpdesk or AI vendor is the provider.
The split decides who owes what. The Commission's guidelines put Article 50(1) disclosure design and Article 50(2) marking on providers, and Article 50(3) emotion-recognition notices on deployers, as Stephenson Harwood's summary sets out. The obligations are cumulative, so one company can hold both roles.
You become a provider faster than you think. Build your own bot on a model API and you are the provider of that system, even though someone else trained the model. Rename a vendor's bot and switch off its AI label, and you have not changed roles — you have broken a compliant design on your own channel.
"Today, privacy decisions are being made inside customer experience platforms, workflows, and journeys" — Joshua Curtis, Customer Care Center Manager, Super Retail Group, quoted by CX Network
The practical test: who can change what the bot says first? If that is you, keeping the disclosure live is on you. The contract decides who pays; it does not move the duty — our AI agent liability guide covers the clauses.
Which Articles apply to customer service, and what do they require?
Six provisions do almost all the work for customer service: Articles 4, 5, 50, 6 with Annex III, 26 and 99. Article 113, amended by Regulation 2026/1744, sets the dates: high-risk rules slipped, Article 50 did not.
| Article | Rule | What support must do | Applies from | Maximum fine |
|---|---|---|---|---|
| 4 | AI literacy | Train the people who configure and supervise the bot; no specific level is required after the omnibus | 2 Feb 2025 | Not capped in Art. 99; set nationally |
| 5(1)(f) | Ban on inferring emotions in the workplace | Never run emotion inference on your own agents, except for medical or safety reasons | 2 Feb 2025 | €35M or 7% of turnover |
| 50(1) | Tell people they are interacting with AI | Keep the AI disclosure live on every channel the bot answers | 2 Aug 2026 | €15M or 3% |
| 50(2) | Machine-readable marking of synthetic text, audio, image or video | Ask your provider how outputs are marked | 2 Aug 2026; 2 Dec 2026 for systems on the market before 2 Aug 2026 (Art. 111(4)) | €15M or 3% |
| 50(3) | Notify people exposed to emotion recognition | Tell callers before voice-tone analysis runs | 2 Aug 2026 | €15M or 3% |
| 50(5) | Clear, distinguishable, accessible, by the first interaction | Disclose in the first message or spoken line, readable by screen readers | 2 Aug 2026 | €15M or 3% |
| 6 + Annex III 4(b), 5(a)–5(d) | High-risk classification | Map every AI use against Annex III; document any Art. 6(3) exemption | 2 Dec 2027 | — |
| 26 | Deployer duties for high-risk systems | Human oversight, log retention, informing workers and affected people | 2 Dec 2027 | €15M or 3% |
Article 99 fines are whichever is higher for large companies and whichever is lower for SMEs. December's deadline is the provider's, not yours — but a vendor that cannot answer "how do you mark outputs?" four weeks out is telling you something.
What does a compliant chatbot disclosure say?
A compliant disclosure tells the customer, in the first message or spoken line, that they are dealing with an AI system — in plain words, on the channel itself. Per the Commission's guidelines, a generic "assistant" label, a machine-readable mark alone, or a line in the terms and conditions is not enough, and an autonomous agent should say on whose behalf it acts.
| Compliant | Not sufficient on its own |
|---|---|
| "Hi, I'm Aria, Acme's AI assistant. I can track your order or connect you to a person." | "Hi, I'm Aria from Acme!" |
| "You're chatting with Acme's AI agent." | A widget titled "Acme Assistant" |
| Voice: "This call is answered by an AI agent. Say 'agent' at any time for a person." | A disclosure inside the terms of service |
| Email footer: "This reply was written by Acme's AI agent." | Machine-readable metadata with no visible notice |
| "I'm an AI agent calling on behalf of Jane Doe about her booking." | Admitting it is AI only when the customer asks |
An exemption exists where AI is "obvious to a reasonably observant person" — a bot with a human name is the opposite. Our AI disclosure guide covers disclosing without hurting resolution.
The rule also runs one way only. Article 50 governs your bot speaking to people, not customers' AI agents speaking to you — and those rarely announce themselves. Arkose Labs' Q3 2026 study of its own customers' traffic found 97.7% of legitimate AI-agent sessions carried no verified disclosure, and 65.2% of its customers saw agents on protected flows.
"…what did the agent come to do? What is its intent?" — Mitchell Davies, Lead Researcher, ACTIR, Arkose Labs
Your bot must say it is a bot. Theirs mostly don't.
When does a customer service bot become high-risk?
A customer service bot becomes high-risk when it makes or shapes a decision listed in Annex III — creditworthiness, life and health insurance pricing, public benefits, emergency triage, or workers' performance and task allocation. Answering "where is my order?" is not on the list; deciding whether the customer gets a payment plan might be.
From 2 December 2027, deployers of those systems take on Article 26: human oversight by trained staff, log retention, and informing the people affected. Article 6(3) exempts systems that only perform a narrow procedural or preparatory task — but any Annex III system that profiles people stays high-risk.
The row most support leaders miss is 4(b): AI used "to monitor and evaluate the performance and behaviour" of workers. When we ran our own product line through the table above, the chatbot rows were easy; the row that stopped us was Agent Insight, our feature that evaluates human agents against role standards. Any deployment that uses it to score people should be planned as likely high-risk from December 2027 — which is why the controls on our reliable AI and security pages matter.
QA scoring is where support AI quietly turns into HR software. Check every tool that rates your team; our AI governance tools roundup and incident reporting guide cover the operating side.
Customer service is in scope — the burden starts when the bot decides
New York's carve-out changes nothing in Europe. For a bot that answers questions, the duty is a first-turn disclosure you keep switched on and a provider who can explain its December marking. The weight arrives only when AI decides something about a person: their credit, their insurance, their emergency, or your agent's review. Find your row, confirm your role, and diary 2 December 2027 for anything in the bottom three.
Frequently asked questions
Does the EU AI Act apply to my customer service chatbot if my company is outside the EU?
Yes, if it serves people in the EU. Article 2(1)(c) covers non-EU providers and deployers whose AI output is used in the Union.
What does Article 50 require for customer service?
Article 50(1) requires that people know they are interacting with an AI system, and Article 50(5) requires that notice to be clear, accessible and given by the first interaction. It has applied since 2 August 2026.
Am I a provider or a deployer under the AI Act?
Using a vendor's chatbot under your own authority makes you a deployer; building the system yourself, even on a third-party model, makes you the provider.
What is the 2 December 2026 deadline?
Article 111(4), inserted by Regulation 2026/1744, gives providers of generative systems on the market before 2 August 2026 until 2 December 2026 to apply Article 50(2) machine-readable marking.
Is sentiment analysis on support tickets emotion recognition?
Not for text. Article 3(39) defines emotion recognition as inference from biometric data, so text sentiment falls outside it, while analysing a caller's voice tone falls inside and requires an Article 50(3) notice.
What are the fines for not disclosing a chatbot?
Up to €15 million or 3% of worldwide annual turnover, whichever is higher; for SMEs, Article 99(6) applies whichever is lower.
Do customer service chatbots count as high-risk AI?
Usually not. Only Annex III uses — creditworthiness, insurance pricing, emergency triage, evaluating workers — are high-risk, from 2 December 2027.
Need a bot that discloses by default? Aissist's AI agents deploy onto the helpdesk you already run. See how it works →
