EU AI Act: How to Prepare Your Contact Center in 90 Days

The EU AI Act, which came into effect in August 2026, has changed the way businesses in the EU, and those that target customers in the bloc, have to disclose their use of AI. While the new requirements for AI compliance affect almost every business, contact centers should pay extra attention.

If your contact center provides inbound and outbound customer support through voice and text, you need to adjust how you disclose your use of AI. This can include AI auto quality assurance, generative AI responses, agentic AI, and more. The new AI transparency requirements change how contact centers design their call flows, and you’ll most likely need to adapt. In this article, we cover what to change in your contact center and when to start.

Keep reading to learn:

• Whether the EU AI Act applies to your business
• What contact center AI regulation and Article 50 mean for your call flows
• Prohibited and high-risk AI uses in contact centers
• 7 steps to transform your AI governance in the next 90 days

This article is for general guidance only. It’s not legal advice. Requirements may vary by country, state, and industry, so check with your legal team. 

What is the EU AI Act?

The EU AI Act, which came into effect in August 2026, regulates AI use in the European Union by risk level to ensure safe and ethical AI deployment. Some AI uses are banned outright, high-risk uses face strict requirements, and general-purpose models and generative tools carry transparency duties. 

One of the most important parts of the Act for contact centers is Article 50, which establishes transparency obligations for providers and deployers of certain AI systems to prevent deception, impersonation, and unverified synthetic content. This means you need to inform your customers when they’re interacting with AI agents or let your team know when they’re being evaluated by AI auto quality assurance systems. Many more cases exist, and we’ll go over them below. First, let’s look at how the law has rolled out so far and the grace period you still have.

EU AI Act timeline:

• August 2024 – Entry into force
• February 2025 – General provisions
• August 2025 – General-purpose AI rules: Providers of general-purpose AI (GPAI) models take on documentation, transparency, and copyright obligations
• July 2026 – AI Omnibus becomes law
• August 2026 – Enforcement and transparency: The Commission gains powers to enforce the GPAI obligations, including fines, and Article 50 transparency rules become generally applicable. These cover deepfake labels, disclosure of AI interactions, and labels on AI-written public-interest text.

What’s next:

• December 2, 2026 – Marking deadline and new ban: Machine-readable marking of AI-generated content.
• August 2027 – Older models: GPAI models placed on the market before August 2025 must comply.
• December 2027 – High-risk systems: High-risk rules apply in areas such as biometrics, education, employment, and border control.
• August 2028 – AI in products: High-risk rules apply to AI built into regulated products such as elevators and toys.

Does the EU AI Act apply to your contact center?

The EU AI Act likely applies to your contact center, even if you have no office in Europe. Like the GDPR, the Act reaches beyond EU borders. It covers providers and deployers located outside the EU whenever the output of their AI system is used inside the Union. An AI agent answering calls from customers in Spain or Germany is in scope, even if your team and servers are based in the U.S.

For example, the law requires contact centers to make sure their chatbots tell customers they’re talking to AI. Using emotion recognition on agents in the workplace is banned. And AI used to evaluate or monitor staff performance counts as high-risk. The penalties are steep, apply equally to non-EU companies, and are calculated on worldwide revenue:

• Prohibited practices: up to €35 million or 7% of global annual revenue, whichever is higher
• High-risk violations: up to €15 million or 3% of global annual revenue
• Supplying incorrect information to regulators: up to €7.5 million or 1% of global annual revenue

The Act also distinguishes between two roles:

1. The provider that develops an AI system and puts it on the market under its own name
2. The deployer that uses that system in its operations

Most contact centers are deployers of vendor tools such as chatbots, voice bots, and quality-monitoring software. Even so, one company can hold both roles at once, for example, by building its own AI products while deploying third-party tools.

If you run a BPO, watch this split closely. An outsourcer running a client’s AI is typically a deployer. But a BPO that rebrands an AI tool as its own service, or substantially modifies it, can become a provider and take on the heavier obligations that come with that role.

If you serve customers in the U.S. or other regions, you’ll also need to meet their AI and data privacy rules. Make sure your contact center meets every requirement.

CTA: Download AI contact center compliance checklist

What does Article 50 mean for your call flows?

Article 50 sets out transparency obligations for certain AI systems that interact with people or generate synthetic media, including AI used in call flows. Basically, the law tells you how and when you need to let people know you’re using AI in your contact center processes. An AI agent that talks directly to people must be designed so they know it’s AI. In practice, this means the AI agent should identify itself as AI before the interaction starts. Let’s go over the call flow processes affected by the new law.

EU AI Act Article 50 at a glance

How an AI agent should disclose itself

An AI agent should disclose itself in the first interaction with a customer. So the safest place for the disclosure is the first sentence of the greeting. Use plain wording such as “Hi, I’m the virtual assistant for [Company].” Avoid euphemisms like “smart agent” or “digital team member,” as they might confuse the customer.

Then test the live call flow, not just the script. Confirm the notice plays at every entry point, including callbacks, overflow routing, and chat-to-voice escalations. Make sure it still fires when a call is transferred from another queue or system straight to the AI agent. AI-powered quality monitoring and auto QA features can be very useful here, as these tools allows you to evaluate 100% of customer interactions automatically against your criteria. So, say a call is transferred to a specialized AI agent and it doesn’t disclose itself. AI auto QA would flag that.

How AI-to-human handoffs should work

The EU AI Act Article 50 doesn’t spell out handoff rules, but a clean transition is best practice and keeps the disclosure honest throughout the call. Define clear triggers for escalation, for example, the customer asks for a person, the AI can’t resolve the issue, the topic is sensitive, or frustration is building.

Pass the conversation context to the human agent so customers don’t have to repeat themselves. And make it clear who the customer is talking to at each stage, with a line like “I’m connecting you with a member of our team now,” followed by the human agent introducing themselves. Customers should never be left guessing whether they’re still speaking to a machine.

How to handle AI-generated content and emotion recognition notices

For synthetic voices and generated text, the provider should be the one marking it, so the practical step is to ask your vendors directly. Are their outputs marked in a machine-readable way? Will they be compliant by December 2, 2026? Which detection tools do they offer? Make sure to get the answers in writing.

Emotion recognition is narrower than it sounds. The Act defines it as inferring emotions from biometric data, such as vocal tone or facial expressions. That means text-based sentiment analysis of chats, emails, or transcripts falls outside its scope. If you analyze emotion in callers’ voices, however, the Article 50(3) notice applies, and it fits naturally alongside your call-recording announcement. 

One important distinction here is that using emotion recognition on your own human agents is a different matter entirely. Inferring employees’ emotions at work is a prohibited practice under Article 5, not just a disclosure obligation.

Which contact center AI use cases could be high risk, and what is prohibited?

The EU AI Act defines which AI use cases are high-risk and which are completely prohibited. For example, AI that tracks employees’ emotions in the workplace is prohibited, but customer sentiment tracking is only high-risk. Let’s go over some of the main cases to see how it works.

Prohibited use cases under the EU AI Act

The AI Act’s bans have applied since February 2, 2025. The most relevant part of the EU AI Act to contact centers prohibits AI systems that infer the emotions of people in the workplace. The only exceptions are for medical or safety reasons. In a contact center, the ban covers your agents. Webcam-based analysis of facial expressions and voice analytics that read stress, frustration, or enthusiasm in an agent’s voice both fall on the wrong side of the line.

The ban doesn’t extend to customers. Analyzing a caller’s emotions, for example, through sentiment analysis that helps AI detect intent and deliver an appropriate response, isn’t prohibited. However, voice-based emotion recognition on customers is classed as high-risk.

To spot these cases, you should audit your contact center AI. Review whether any auto QA, coaching, workforce management, or speech analytics tool scores agents on voice tone, stress levels, empathy, or emotional delivery. These features are often bundled into broader analytics platforms and switched on by default, so check the settings and contracts.

High-risk use cases under the EU AI Act

For contact centers, two main categories are likely to matter when it comes to EU AI Act high-risk cases:

• AI that manages workers: This covers AI that monitors or evaluates agent performance in ways that feed into pay, coaching plans, promotion, discipline, or termination. It also covers AI that allocates tasks or shifts based on individual behavior or personal traits, and AI used in hiring, such as screening applications, ranking candidates, or scoring interviews.
• Voice-based emotion recognition on customers: Inferring callers’ emotions from their voice is permitted, but as a biometric use, it counts as high-risk. Text-based sentiment analysis of chats or transcripts isn’t emotion recognition under the Act, so it doesn’t fall into this category.

If you deploy a high-risk system, you’ll need to use it according to the provider’s instructions, assign trained staff to provide human oversight, monitor how it performs, and keep its logs for at least six months. You’ll also need to inform workers and their representatives before putting high-risk AI into use in the workplace. Start mapping which tools fall into these categories now, so vendor conversations and works council consultations aren’t rushed in late 2027.

What should you do in the next 90 days? Your 7-step checklist

To ensure EU AI Act compliance, you need to audit your current AI contact center workflows and redesign your call and text communication flows so they meet all transparency requirements. The next 90 days run past the December 2, 2026, marking deadline, so start now.

1. Inventory your AI tools. List every AI system in your contact center: chatbots, voice bots, IVR, speech and text analytics, QA scoring, workforce management, agent assist platforms, and hiring tools. Include features bundled inside larger platforms, and for each one, note who supplies it, what it does, and whether its output reaches people in the EU.
2. Classify each tool by risk. Sort your inventory into four buckets: prohibited, high-risk, transparency-only, and minimal-risk. Switch off anything prohibited immediately, and flag high-risk tools for a compliance plan ahead of December 2027.
3. Fix your disclosures. Make sure every AI agent identifies itself in the first sentence of the greeting, across every entry point and transfer path. Add a notice wherever you analyze customers’ emotions from their voice, and test the live call flows.
4. Document human oversight. For each tool that influences decisions about customers or agents, record who reviews its outputs, when they can override it, and how escalations work. This documentation will form the foundation for high-risk compliance and show regulators that people, not algorithms, make the final call.
5. Review vendor contracts. Ask providers how they meet their Article 50 duties, including whether synthetic voices and generated text will be marked by December 2, 2026. Build AI Act obligations into your contracts: compliance warranties, access to technical documentation, incident notification, and clarity on who is the provider and who is the deployer, especially if you’re a BPO customizing or rebranding tools.
6. Train frontline teams. Agents, team leads, and QA staff should understand which tools use AI, what the disclosures say, how handoffs work, and how to escalate when the AI gets it wrong. Even with the AI Omnibus softening the AI literacy duty, you’re still required to take measures that support AI literacy among your staff.
7. Name an owner. Make one person accountable for AI Act compliance across the contact center, with a direct line to legal, IT, operations, and HR. Without a clear owner, the inventory goes stale, vendor questions go unanswered, and the 2027 deadline arrives before anyone notices.

Learn which 6 regulations contact centers need to meet in our practical guide to AI governance in contact centers.

What should you ask AI vendors about the EU AI Act?

Whether it’s a new vendor or an existing one, make sure you ask them about compliance with the new EU AI Act in customer service. Don’t wait to learn the hard way whether your AI vendors comply with the law. After making a list of all the AI tools you use, contact each vendor and ask these specific questions:

“Do you consider yourselves the provider of this system under the AI Act, and what does that make us?”

• Look for: A clear statement that they are the provider and you are the deployer, plus a note on what would change that, such as rebranding or substantially modifying the tool.
• Red flag: “The AI Act doesn’t apply to us” or “That’s up to you.”

“How does your AI agent disclose that it’s AI, and can we configure or disable it?”

• Look for: EU AI Act chatbot disclosure built in by default at the start of every interaction, with configurable wording.
• Red flag: Disclosure that is optional, off by default, or left entirely to your script.

“Are your synthetic voices and generated text marked in a machine-readable way, and will you be compliant by December 2, 2026?”

• Look for: Watermarking, metadata, or both, a confirmed timeline, and ideally a commitment to the Code of Practice on marking and labeling AI-generated content.
• Red flag: Vague assurances with no technical detail or date.

“Does any feature infer emotions from voice or facial expressions, for customers or for agents?”

• Look for: A complete list of emotion-related features, a clear distinction between biometric emotion recognition and text-based sentiment analysis, and the ability to switch off agent-facing emotion features entirely.
• Red flag: Marketing terms like “empathy scoring” or “stress detection” with no explanation of how they work.

“Which of your features could be classed as high-risk, and what’s your plan for December 2027?”

• Look for: An honest assessment, especially for performance scoring, task allocation, and hiring features, plus a roadmap covering technical documentation, logging, human oversight tools, and conformity assessment.
• Red flag: “None of our features are high-risk” without any reasoning.

“What documentation and instructions for use will you give us?”

• Look for: Clear instructions explaining the system’s intended purpose, limitations, accuracy, and how to oversee it, since deployers of high-risk systems must follow them.
• Red flag: Nothing beyond a standard product manual.

“How do you support human oversight and logging?”

• Look for: Features that let staff review, override, and audit AI outputs, and logs retained for at least six months or exportable to your systems.
• Red flag: Black-box decisions with no override or audit trail.

“Will you put these commitments in the contract?”

• Look for: Willingness to add AI Act compliance warranties, incident notification duties, cooperation with regulators, and notice of material changes to the system.
• Red flag: Reluctance to commit in writing to anything they’ve said in a sales call.

Start your preparation for the EU AI Act now

AI transparency requirements in customer service are here, and they will likely only get stricter. Prepare your business with the right AI partners. Capacity pays 100% attention to your data, with no compromises on security or data privacy.

Our infrastructure is ready for the new law, as it allows:

• Labeling of synthetic voice and generated content
• Easy, configurable AI escalation to a human agent
• Built-in AI disclosure for voice bots and chatbots, so customers know they’re talking to AI
• No manipulative or exploitative persuasion techniques in sales or collections flows
• Human oversight controls: override, review queues, and confidence thresholds

And many other features to give you peace of mind while you run your business and ensure an excellent customer experience at scale. Ready to grow your business globally? Read more about Capacity’s commitment to data security in our Trust Center.

Trust Center

Data security for
every AI agent.

Capacity is committed to protecting your and your customers' data. Explore all our security, privacy and compliance documentation in one place.

Visit the Trust Center

FAQs

Written by

Eglė Račkauskaitė

Content Writer

Egle Rackauskaite helps SaaS and B2B brands connect with their audiences through clear, conversational content. She specializes in AI, customer experience, business and workforce management, and automation topics, with a strong focus...

View full author profile