EU AI Act in customer service: what companies must implement by August 2026

EU AI Act in customer service: what companies must implement by August 2026

TL;DR — The essentials in 30 seconds

• August deadline: from August 2, 2026, the EU AI Act's labeling obligations apply to chatbots, voicebots and AI-powered email automation.
• Fines: violations of the transparency obligation (Art. 50) can cost up to €15 million or 3% of global annual turnover. Violations of prohibited practices (Art. 5) can cost up to €35 million or 7%.
• Risk class: customer service AI generally falls under “limited risk” — the concrete obligation: users must know they're interacting with an AI.
• Integrated compliance framework: the GDPR and the EU AI Act must be considered together from now on — managing them separately risks gaps.
• Hosting advantage: providers with European hosting make compliance much easier — no third-country transfer, no additional risk assessment.
• 8-point checklist for IT managers further down in this article.

Definition:
‍The EU AI Act is the world's first comprehensive regulation of artificial intelligence. It classifies AI systems into four levels based on their risk potential: unacceptable risk (prohibited), high risk, limited risk and minimal risk. Each level comes with different obligations — from bans to transparency and documentation requirements to no requirements at all. The regulation has been in force since August 2024 and applies in stages.

EU AI Act timeline: what applies when?

The EU AI Act comes into force in stages. For a detailed overview of what the regulation means for companies in general, see The EU AI Act: what does it mean for AI in companies? For customer service teams, three dates matter.

February 2025 — the ban on unacceptable risks already applies. AI systems that manipulate people or operate social scoring systems have been prohibited since then. This doesn't affect standard customer service AI.

August 2, 2026 — transparency obligations for “limited risk” systems come into force. Legal basis: Art. 50 EU AI Act (Regulation 2024/1689). At the same time, the full high-risk obligations apply — not relevant for FAQ bots, but relevant for AI systems that independently make credit decisions or terminate contracts. If you haven't implemented labeling by then, you risk fines of up to €15 million or 3% of global annual turnover.

August 2027 — high-risk requirements for biometric systems apply in full. Not relevant for standard customer service applications.

The rule of thumb: for 95% of customer service AI implementations, August 2, 2026 is the date that counts.

A note on fine amounts: some sources cite €35 million and 7% in connection with the AI Act — that's correct, but it refers exclusively to violations of prohibited practices under Art. 5. For violations of the labeling obligation under Art. 50, the middle fine tier applies: up to €15 million or 3% of annual turnover. Source: Art. 99 EU AI Act (Regulation 2024/1689).

Risk classes: why customer service chatbots fall under “limited risk”

A standard chatbot that answers FAQs is clearly “limited risk”. An AI agent that independently triggers refunds or makes contract changes could fall into “high risk” — if it acts as an essential decision-making component in a legally relevant process. What AI agents do and how they differ from classic chatbots is explained in the guide AI agents in service: how they change processes — and how to get started. The risk class depends less on the type of system than on its specific function — check this case by case with a legal advisor and your data protection officer.

Practical tip: when in doubt, classify conservatively. A chatbot that only answers is “limited risk”. An agent that terminates contracts or adjusts credit limits needs an individual legal review.

Labeling obligation: how to implement it in practice

Art. 50 of the EU AI Act requires that users are informed “in a clear and distinguishable manner” that they're interacting with an AI system — at the latest at the first interaction.

For chat widgets, the notice must be visible before the user sends their first message. Compliant options: a permanent notice in the chat header (“This chat is handled by an AI”), a greeting in which the AI introduces itself, or a one-time notice when the widget is first opened. A hidden notice in the legal notice or footer isn't enough.

For voicebots, the AI must identify itself as such at the start of the conversation. “Hello, you're speaking with the automated assistant of [company]” is a compliant wording.

For AI-generated emails — when an AI writes and sends email replies on its own rather than just suggesting drafts — the labeling obligation applies too. A note in the signature (“This reply was created by our AI system”) is sufficient.

What isn't enough: general wording in the terms and conditions, a notice only on the privacy page, or a disclaimer that only appears after the first interaction.

The GDPR and the EU AI Act: an integrated compliance framework

From August 2026, EU AI Act labeling obligations apply to AI content. Together with GDPR and NIS2 risks, companies need to realign compliance, documentation and cloud access — that's the conclusion of a recent analysis by IT Boltwise. If you keep treating both sets of rules separately, you risk structural gaps — and double the effort.

If you already work in a GDPR-compliant way, you have a significant head start. The GDPR (Art. 5 and Art. 28) governs the processing of personal data: legal basis, data processing agreement (DPA), data minimization, deletion obligations. The EU AI Act adds a systemic layer: what risk does the AI itself pose — regardless of whether personal data is processed? Transparency and documentation obligations under the AI Act also apply if the AI works with fully anonymized data.

The overlaps are large and should be used actively: a GDPR-compliant DPA often also covers the AI Act's subcontractor transparency. A data protection impact assessment (DPIA) provides much of the information also needed for AI Act documentation. Which concrete GDPR requirements apply to chatbots and AI systems with customer contact is explained, with practical implementation tips, in Using chatbots in your company in a GDPR-compliant way.

The critical gap lies elsewhere: the GDPR doesn't require AI labeling. That's the only point you need to implement anew for August 2026 if you already comply with the GDPR.

Recommendation for IT managers: bring GDPR and AI Act compliance together under one governance framework — same owner, shared documentation structure, shared review cycle. This saves time and reduces the risk of obligations falling between responsibilities.

Checklist: 8 points before August 2026

1. Inventory AI systems with customer contact. List all AI-powered systems that communicate directly with customers: chatbots, voicebots, email AI, AI-powered search. Systems without customer contact — internal analytics AI, spam filters — aren't affected.

2. Determine the risk class for each system. For standard customer service AI, “limited risk” is the rule. Systems that independently make legally relevant decisions (credit approval, contract changes, claims settlement) must be reviewed individually.

3. Implement labeling in the chat widget. The notice must be visible before the first interaction. Test the widget with a fresh browser cache and no cookies.

4. Adapt voicebot scripts. The AI must identify itself as AI at the start of the call. Update existing scripts and run test calls.

5. Check email labeling. If emails are fully AI-generated and sent: add a notice to the signature or footer.

6. Update the DPA with AI Act clauses. Check with your provider whether the existing DPA also covers the AI Act requirements: subprocessor list, hosting location, deletion policy. GDPR and AI Act clauses belong in one document.

7. Create internal documentation. No formal declaration of conformity is needed for “limited risk” systems, but internal documentation is best practice and helpful in audits: system description, risk classification, proof of labeling, data basis.

8. Involve your data protection officer. The DPO should approve the implementation and sign off the documentation — ideally in a joint GDPR/AI Act review.

The hosting question: why European hosting simplifies both sets of rules

Both the GDPR and the EU AI Act set requirements for where data is processed and how traceable AI systems are. European hosting addresses both at once.

If you choose a provider hosting in Germany or the EU, you avoid the complex GDPR third-country transfer procedure under Art. 44 et seq. GDPR — standard contractual clauses and transfer impact assessments are no longer needed. Germany's Federal Office for Information Security (BSI) explicitly recommends hosting in Germany for sensitive industries; this also applies in the AI Act context. If the AI model itself is hosted in Europe, the requirement for traceability and auditability is much easier to meet. For IT managers in insurance, healthcare or the public sector, this isn't a convenience feature but a basic requirement. If you want both out of the box, melibo is a provider with EU hosting, ISO 27001 certification and a 100% GDPR-compliant platform.

Provider comparison: who is demonstrably compliant, and who's just marketing?

Many providers claim AI Act compliance without providing concrete proof. Here are the four questions to ask at your next provider briefing:

First: do you have an updated DPA that explicitly addresses the EU AI Act? Good answer: yes, we provide a DPA with AI Act clauses and a subprocessor list. Bad answer: “We're GDPR-compliant” — that's not the same thing.

Second: where is the AI model that processes our customer requests hosted? Good answer: in Germany or the EU, with the data center and operator named specifically. Bad answer: “In the cloud” or “with a leading cloud provider”.

Third: how is the labeling obligation under Art. 50 EU AI Act implemented in your widget? Good answer: a concrete description with a screenshot or demo. Bad answer: “That's up to our customers.”

Fourth: is our customer data used to train your model? Good answer: no, contractually excluded. Bad answer: evasion or “only in aggregate”.

In the DACH market, there are a handful of relevant providers whose compliance positioning differs clearly. Userlike hosts in Germany, provides standard DPA templates and lets you configure the labeling obligation natively — a solid choice for SMEs focused on live chat. Tidio hosts in Ireland (EU) but offers more limited configurability — a solid entry point for e-commerce SMEs using Shopify or WooCommerce, but not a fully compliant out-of-the-box solution. Intercom and Zendesk AI are relevant for enterprises and offer EU hosting options, usually as a paid add-on. Freshbot is natively integrated into the Freshdesk plan but hardly flexible outside that ecosystem. Botpress is aimed at developer teams — hosting and compliance are entirely your own responsibility.

If you're looking for a DACH-native solution that answers all four questions above with a clear yes: melibo hosts on GDPR-compliant servers within the EU, is certified to ISO 27001 and ISO 9001, encrypts all data in transit and contractually excludes the use of customer data for external model training. Native integrations for Shopware, Zendesk, Freshdesk and GREYHOUND mean no additional middleware is needed.

Practical tip for IT managers: the less you want to document and configure yourself, the more it pays to choose a provider with German hosting, a standardized AI Act DPA and natively implemented labeling. Always ask for a completed DPA and a subprocessor list at the provider briefing.

What comes after August 2026?

The EU AI Act isn't a finished project. From August 2027, the full requirements for high-risk AI systems in biometrics apply. If an AI agent independently makes legally relevant decisions in the future — adjusting credit limits, terminating contracts, deciding on complaints — the risk class may need to be reassessed. The European AI Office is also developing industry-specific codes of practice. The general guidelines for general-purpose AI (GPAI) models will also affect chatbot providers building on models like GPT-4o, Mistral or Llama.

So don't implement the August 2026 requirements as a one-off fix but as an ongoing process: a risk class review every six months, updated documentation when systems change, regular DPA updates with your provider — keeping the GDPR and the AI Act in view together.

Frequently asked questions (FAQ)

What exactly do I need to have implemented by August 2, 2026?

The key obligation from Art. 50 EU AI Act: users must be able to recognize that they're interacting with an AI system — at the latest at the first interaction. Chat widgets need a visible notice before the first user input, voicebots must identify themselves as AI at the start, and fully AI-generated emails need a labeling notice.

Does my customer service chatbot fall under “high risk” or “limited risk”?

Most customer service chatbots fall under “limited risk”. That applies to systems that answer FAQs, provide order status or route requests. “High risk” would come into play if the chatbot made legally relevant decisions independently and without human review. When in doubt, check with your data protection officer and a legal advisor.

What fines apply for violations of the labeling obligation?

For violations of Art. 50, Art. 99 EU AI Act provides for fines of up to €15 million or 3% of global annual turnover. The higher fines of up to €35 million or 7% apply exclusively to violations of prohibited practices under Art. 5. For SMEs and start-ups, Art. 99(6) applies the lower of the two amounts in each case.

I already have a GDPR-compliant DPA. Does that make me AI Act-compliant too?

Partly. A GDPR-compliant DPA is necessary but not sufficient. The EU AI Act also requires: labeling the AI for users, documenting the AI system (intended purpose, risk class) and, for GPAI models, transparency about the infrastructure used. Ask your provider explicitly for an updated DPA with AI Act clauses — and bring GDPR and AI Act compliance together in an integrated framework.

Is a notice in my terms and conditions that I use AI enough?

No. Art. 50 EU AI Act requires active, clear information at the time of the interaction — not a passive clause in the small print. The notice must appear where the interaction takes place: in the chat widget, in the voicebot greeting, in the email signature.

Does the EU AI Act also apply to small companies and start-ups?

Yes, to all companies that use AI systems in the EU — regardless of company size and country of origin. For SMEs and start-ups, Art. 99(6) applies the lower of the two fine amounts in each case. The labeling obligation under Art. 50 applies without exception.