AI Act compliance: chatbots, voicebots & sentiment

The year of experimentation is over. 2026 is the year the AI Act gets teeth, and for organizations deploying AI in customer contact, reality is hitting hard. Chatbots, voice bots, sentiment analysis, emotion detection - technologies rolled out massively across contact centers over the past two years now fall under concrete legal obligations. Some are outright banned.

This article provides a practical guide: which customer contact AI falls where under the AI Act, and what do you need to arrange now?

The playing field: three risk categories

The AI Act uses a risk-based approach. For AI in customer contact, three categories matter:

Prohibited (Article 5): AI systems that detect emotions in the workplace or in education. This directly affects sentiment analysis of agents in contact centers.

High risk (Article 6 + Annex III): AI systems used for decision-making that substantially impacts individuals. Think of AI determining whether a customer qualifies for a service, or automated credit assessments.

Transparency obligations (Article 50): For AI systems intended to interact directly with people, paragraph 1 places the disclosure-by-design duty on the provider. The deployer verifies that feature and whether a separate paragraph 3 or 4 duty applies to its use case.

Emotion recognition: the red line

Article 5(1)(f) of the AI Act explicitly prohibits AI systems that infer emotions of persons in the workplace and in educational institutions. The only exception: medical or safety reasons.

For contact centers, this is a direct hit. Many workforce management and quality monitoring platforms use sentiment analysis or emotion detection. They analyze agent voice patterns to detect stress, frustration, or dissatisfaction. Under the AI Act, this is prohibited.

Note the subtle but critical distinction: emotion recognition of customers during a conversation is not inherently prohibited (unless it takes place at the customer's workplace), but does fall under strict transparency requirements. Emotion recognition of employees in the workplace is banned outright.

In practice, many systems use the same technology for both sides of the conversation. Organizations deploying such tools must therefore determine precisely what is being analyzed, from whom, and for what purpose.

Chatbots and voice bots: transparency is not optional

Article 50(1) is clear about direct interaction: since 2 August 2026, the provider must design a system intended to interact directly with people so that they know they are dealing with AI, unless this is already obvious in context. A deploying organisation should verify that its chatbot or voice bot includes that provider-supplied disclosure and use it according to the instructions.

That sounds simple, but the implication is far-reaching. The trend in CX for years was to make AI interactions as human-like as possible. Voice bots that sound like real agents. Chatbots indistinguishable from human representatives. That approach is now a legal liability.

For an in-scope direct interaction, the system must make the AI nature clear unless it is already obvious to a reasonably well-informed and observant person. The "Turing test marketing strategy" - where companies boast that their bot cannot be distinguished from a person - is therefore a compliance risk for the provider and a procurement risk for the deployer.

High-risk classification: when does it get serious?

Annex III of the AI Act defines the categories of high-risk AI systems. For customer contact, the most relevant are:

• Access to essential services: AI determining eligibility for public services, insurance, or financial products
• Credit scoring: Automated systems assessing the creditworthiness of individuals
• Emergency service communication: AI systems routing or prioritizing emergency calls

If your customer contact AI makes decisions or recommendations that directly affect a customer's access to a service or product, the system may be classified as high risk. That triggers obligations around risk management, data quality, human oversight, transparency, and technical documentation.

The "governance as infrastructure" shift

Manual compliance does not work at the scale AI is deployed in customer contact. Thousands of AI agents making millions of micro-decisions daily in a contact center - you cannot check that with a spreadsheet.

The shift required: governance must become part of the technical infrastructure. Not something bolted on afterward, but built into the platform. That means:

• Automated logging of all AI decisions and interactions
• Built-in transparency notifications that do not need manual activation
• Continuous monitoring of AI performance and behavior, not just periodic audits
• Clear escalation paths from AI to human agents

Five steps for organizations

What should you do now?

1. Inventory all AI in customer contact. Not just the official tools, but also shadow AI: employees copying customer data into ChatGPT or other LLMs for quick summaries. That is a data breach waiting to happen.

2. Classify each system. Does it fall under prohibited practices (employee emotion recognition)? High risk (service access decisions)? Or transparency obligations (chatbots, voice bots)?

3. Stop prohibited practices immediately. Employee emotion recognition has been banned since February 2025. There is no transition period left.

4. Implement transparency. Ensure every AI interaction with customers is clearly identified as such. This is the easiest step with the most impact.

5. Build governance into your platform. Work with your vendors to automate compliance monitoring. Ask for certifications and compliance documentation.

Vendor selection becomes a compliance decision

A development gaining importance fast: choosing an AI vendor is increasingly a compliance decision. Organizations purchasing AI tools for customer contact must evaluate vendors on their ability to meet AI Act requirements. Can the vendor demonstrate how the system works? Is there technical documentation? Are there provisions for human oversight?

The days of buying a "black box" AI solution from a startup are over. If you cannot demonstrate the provenance of the data and how the model works, the deal will not close.

The bottom line

AI in customer contact is no longer a grey area. The rules are clear, the deadlines are approaching, and the supervisory authorities have been designated. Organizations that move now - inventory, classify, adapt - build an advantage. Those who wait for the first fine to land are already too late.