EU AI Act compliance for customer service chatbots

Are you a provider or a deployer?

If you use a third-party chatbot platform you are the deployer. If you built the bot and offer it to other companies, you are also a provider and additional duties apply.

How this is classified under the Act

Conversational support does not sit in an Annex III high-risk domain, so it lands in the limited-risk tier where transparency rather than conformity assessment is the obligation. The Act cares that users know they are talking to a machine.

Documents you need

• AI Literacy Policy Article 4

  A written policy covering which AI tools you use, which roles interact with them, what those people need to understand, who owns the document, and how it gets updated. Enforceable since 2 February 2025.

• Risk Classification Memo Articles 6, 9 and Annex III

  A documented assessment placing each AI system in the Act’s risk tiers, including the Article 5 prohibited-practice check and the Article 6(3) exception assessment, with article citations.

• Transparency Disclosure Article 50

  Informs people when they are interacting with an AI system and labels AI-generated or manipulated content. Article 50 applies from 2 August 2026. The narrower Article 50(2) duty on general-purpose models generating synthetic content applies from 2 December 2026.

Obligations that apply

• Article 50(1) Tell people they are talking to AI

  Disclosure has to be clear and come at the first interaction, not buried in a privacy policy. A short line in the chat opener is normally enough.

• Article 50 Label AI-generated content

  Where the bot produces text, images, or audio presented to the user as content rather than conversation, it has to be marked as artificially generated.

• Article 4 Literacy for the support team

  Agents who supervise the bot, take over escalations, or rely on its suggested replies need to understand its limits and when to override it.

• Article 26 Escalation to a human

  Not strictly required outside high-risk use, but documenting a human escalation path is the practical answer to most customer complaints about AI handling.

Common mistakes

• Giving the bot a human name and no disclosure at all, which is exactly the situation Article 50 addresses.
• Assuming the chatbot vendor handles disclosure. The obligation to inform your users sits with you as deployer.
• Treating the deadline move to December 2026 as permission to do nothing, when the Article 4 obligation already applies.
• Letting the bot answer regulated questions about credit, insurance, or eligibility without noticing the classification has changed.

Where the deadlines stand

The AI literacy obligation under Article 4 and the Article 5 prohibitions have been enforceable since 2 February 2025. General-purpose AI model rules applied from 2 August 2025. The Omnibus, published in the Official Journal on 24 July 2026, moved the high-risk dates: standalone high-risk systems under Annex III to 2 December 2027, and high-risk AI embedded in regulated products under Annex I to 2 August 2028. Article 50 transparency obligations still apply from 2 August 2026. Only the narrower Article 50(2) duty on general-purpose models generating synthetic content moved, to 2 December 2026, which is also when the new prohibition on AI-generated intimate imagery and child sexual abuse material takes effect.

The delay applies to the high-risk obligations. It does not move Article 4, which is why a written AI literacy policy is the document most companies are missing today.

This page describes obligations under Regulation (EU) 2024/1689 as amended by the Omnibus published in the Official Journal on 24 July 2026, and was verified on 29 July 2026. It is general information rather than legal advice, and classification depends on your specific configuration and use. Review by qualified legal counsel is recommended before formal adoption of any compliance document.