What the EU AI Act’s Transparency Rules Mean for AI in Customer Service

Published On: October 27th, 202610 min read

In short: Since 2 August 2026, Article 50 of the EU AI Act requires that people are told when they are dealing with an AI system, unless that is obvious, and that people exposed to emotion recognition are informed. For any organization with a contact center, that reaches voice agents, chatbots and any tool that tries to read a customer’s mood. The fine for getting it wrong can reach 15 million euros or 3% of worldwide annual turnover, whichever is higher. The practical work is less about new technology than about knowing which of your customer-facing AI systems fall under which duty, and who in the chain owes it.

The easiest way to see what that means in practice is one ordinary phone call. A customer calls a service provider about a billing problem. The voice that answers is natural, responds to what they say rather than to a keypad, and sounds a lot like a person. Is it obvious that it is not one? Until this year, the answer was a matter of good practice. Since 2 August 2026, it is a matter of law.

What Article 50 Requires, and From When

Article 50 is the transparency chapter of the AI Act. It sets four duties, split between the companies that build AI systems (providers) and the companies that use them (deployers):

  • Interactive AI. Providers of AI systems meant to interact directly with people must make sure those people are informed they are dealing with an AI system, unless that is already obvious from the circumstances.
  • Synthetic content. Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable way so it can be detected as artificially generated.
  • Emotion recognition and biometric categorisation. Deployers of such systems must inform the people exposed to them.
  • Deepfakes and AI-generated text on matters of public interest. Deployers must disclose them, with an exception where the content has been through human editorial review.

Most of this became enforceable on 2 August 2026. Providers of systems already on the market before that date have until 2 December 2026 to meet the machine-readable marking duty, and the EU’s Digital Omnibus deferred only that specific part, not the rest (Morgan Lewis, 2026; Baker Botts, 2026). The rules also reach providers and deployers outside the EU when the output is used inside it.

When a Voice Agent Has to Say It Is an AI

In most contact centers, voice agents take routine, well-defined requests and hand anything more complex to a human agent, which means the disclosure question arises in the first seconds of a call. The exception that matters most for customer service is the phrase “unless this is obvious from the circumstances.” The Commission’s final guidelines, published on 20 July 2026, interpret it from the point of view of a reasonably well-informed, observant and circumspect person. They are interpretive and non-binding, and only the Court of Justice can settle the meaning authoritatively (Commission Article 50 guidelines, C(2026) 5054 final, summarised here).

For a text chat window labelled “virtual assistant,” that bar may be easy to meet. For a phone call with a fluent, natural-sounding voice, it is much harder to argue that a caller will assume they are talking to a machine. The more convincing the voice, the weaker the case that disclosure is unnecessary. Article 50 also says the information has to be given in a clear and distinguishable way, at the latest at the time of the first interaction or exposure, and in line with accessibility requirements. The safe reading for an organization is therefore a short, plain statement at the start of the call, not a line buried in the terms and conditions.

There is a second, quieter point for voice. A voice agent’s spoken output is synthetic audio, so the machine-readable marking duty in Article 50 is worth raising with whoever supplies the system, along with the 2 December 2026 transition date for systems already on the market.

Where Emotion Recognition Fits, and Where It Does Not

Customer service is increasingly full of tools that try to read how a customer feels: sentiment scores, frustration flags, tone analysis. The AI Act treats a narrower category as “emotion recognition.” Article 3(39) defines it as an AI system used for identifying or inferring emotions or intentions of natural persons on the basis of their biometric data, and Article 3(34) describes biometric data as personal data resulting from specific technical processing of physical, physiological or behavioural characteristics. That biometric basis is the hinge.

Recital 18 adds two useful details. The emotions it has in mind include anger and satisfaction, which are exactly what a contact center cares about. And it says the notion does not cover the mere detection of readily apparent expressions, gestures or movements, “unless they are used for identifying or inferring emotions,” giving as examples a frown, a smile, or characteristics of a person’s voice such as a raised voice or whispering. In plain terms, noticing that a caller is speaking loudly is not emotion recognition, but using vocal characteristics to conclude that the caller is angry may be. Analysis of the words in a text chat is generally not biometric at all. The same is more likely to hold for a phone call when the system first converts speech to text and then scores the transcript, because the analysis works on what was said rather than on how the voice sounds. A system that scores acoustic features such as pitch, pace or tone sits closer to the line, which is why it matters which of the two a tool actually does.

Two consequences follow for contact centers:

  1. Customers. Where a system does infer emotion from biometric data, for example the acoustic features of a voice, the deployer has to inform the customers exposed to it, and the processing still has to comply with GDPR, which Article 50(3) expressly preserves. Where a tool scores text, whether typed in a chat or produced by transcribing a call, the AI Act definition is less likely to apply, although GDPR and the general transparency expectations still do, and the AI voice agent itself still has to be disclosed as AI. The published commentary on the Commission guidelines does not settle the boundary for text-based sentiment tools, so it is a point to take to legal counsel rather than assume.
  2. Staff. A separate rule, Article 5(1)(f), has applied since February 2025 and prohibits using AI to infer the emotions of people in the workplace, except for medical or safety reasons. A tool that is acceptable for reading a customer’s frustration is not automatically acceptable for scoring the mood of the agent on the other end of the line. Any analytics that touch agents deserve separate scrutiny.

Who Owes What: Provider or Deployer

Provider (builds or supplies the AI system)Deployer (uses it under its own authority)
Typical roleThe vendor of the voice agent, chatbot or analytics toolThe organization running it in its contact center
Disclosure of AI interactionMust design the system so people are informed, unless obviousNeeds to confirm in its own greetings and flows that this actually happens
Marking of synthetic outputMust mark audio, text and other generated output in machine-readable formMust mark audio, text and other generated output in machine-readable form
Emotion recognitionBuilds the capabilityMust inform the people exposed to it
Penalty exposureUp to 15 million euros or 3% of worldwide annual turnoverSame ceiling

 

An organization that builds or rebrands a system under its own name can be a provider as well as a deployer, so it is worth checking which hat it wears for each tool.

What Enforcement Looks Like

Enforcement sits with the national market surveillance authorities each Member State designates, not with the Commission, and the maximum fine for breaching these duties is 15 million euros or 3% of worldwide annual turnover, whichever is higher (Article 99; Stibbe). Many organizations are already working through DORA, NIS2 and GDPR obligations, and Article 50 adds one more regulation to the same audit conversation: what AI is in use, where, who supplied it, and what customers are told.

A Short Checklist for the Next Review

  • List every customer-facing AI system: voice agents, chatbots, virtual assistants, sentiment or tone analytics.
  • For each, record whether the customer is told they are dealing with AI, and where, in the call or chat.
  • For voice, assume that a natural-sounding voice does not meet the “obvious” exception on its own.
  • Ask each supplier how it meets the marking duty for synthetic output and by what date.
  • For any tool that infers emotion, establish whether it scores a transcript or the acoustic features of the voice, and if the latter, how customers are informed.
  • Separate customer analytics from anything that analyses staff, and check the latter against the workplace prohibition.
  • Keep the evidence: wording used, dates, supplier statements. An auditor will ask for it.

If you are mapping your contact center AI against these obligations and want to compare notes, the ASEE team is happy to talk.

FAQ

What does Article 50 of the EU AI Act require?

It requires that people are informed when they interact directly with an AI system unless that is obvious, that synthetic audio, image, video and text output is marked in a machine-readable way, that people exposed to emotion recognition or biometric categorisation systems are informed, and that deepfakes and AI-generated text on matters of public interest are disclosed.

When did the transparency obligations start to apply?

Most of them became enforceable on 2 August 2026. Providers of systems already on the market before that date have until 2 December 2026 to meet the machine-readable marking duty.

Does an AI voice agent have to say it is an AI?

Generally yes, unless it is obvious to a reasonably well-informed, observant and circumspect person that they are dealing with a machine. With a natural-sounding voice on a phone call, relying on that exception is risky, so a short statement at the start of the call is the safer approach.

Is sentiment analysis covered by the emotion recognition rules?

Only if it meets the Act’s definition, which is based on biometric data. Scoring the text of a message, including a transcript of a call, is less likely to qualify than scoring acoustic features of the voice such as pitch or tone, but the boundary is not settled by the published guidance, and GDPR applies either way. Take specific tools to legal counsel.

Can a contact center analyse the emotions of its own agents?

Article 5(1)(f) prohibits using AI to infer emotions of people in the workplace, except for medical or safety reasons. Analytics that look at agents need separate review from analytics that look at customers.

Who is responsible, the organization or its AI vendor?

Both can be. The duty to design disclosure into an interactive system sits with the provider, the duty to inform people exposed to emotion recognition sits with the deployer, and an organization that builds or rebrands a system can be both. Contracts and supplier due diligence should say who covers what.

What are the penalties?

Up to 15 million euros or 3% of worldwide annual turnover, whichever is higher, enforced by national market surveillance authorities.

Are the Commission’s guidelines legally binding?

No. The guidelines published on 20 July 2026 are interpretive and non-binding. They show how the Commission reads the rules, but only the Court of Justice can give a binding interpretation.

Sources: Regulation (EU) 2024/1689 (the AI Act), EUR-Lex, the official text, including Recital 18 and Articles 3, 5, 50 and 99. AI Act Article 50, Article 5, Article 3 and Article 99, article-by-article text of the Act. Baker Botts, “EU AI Act Article 50 Transparency Obligations Go Live,” September 2026, on scope, dates and penalties. Morgan Lewis, “EU AI Act’s Transparency Rules: What Went Into Effect on 2 August?”, August 2026, on the duties and the 2 December 2026 transition period. Stibbe, “The AI Act’s Transparency Obligations: Rules, Scope and Timeline”, on provider and deployer roles and fine levels. Commission Article 50 guidelines, C(2026) 5054 final, 20 July 2026, as summarised on regulation-ai.eu, on the “obvious” standard, enforcement and the guidelines’ non-binding status.

Lucija Babić - author

Lucija Babić

Lucija Babić is a B2B marketing and communications professional with over 10 years of experience in the IT industry, specializing in strategic content development, brand positioning, promotional initiatives, and technology-driven growth.

Share

More from ASEE