EU AI Act compliance for customer support and chatbot SaaS

Is your product high-risk under Annex III?

Most customer-support SaaS is NOT high-risk under Annex III. The exception cases:

• Emotion recognition or biometric categorisation in voice or video support (Annex III point 1(a))
• Support tools used by law enforcement, judiciary, or public assistance agencies (Annex III points 6, 7, 8)
• Support routing decisions that meaningfully affect access to essential services (Annex III point 5)

If you provide vanilla helpdesk, ticket triage, AI-assisted reply drafting, or knowledge-base search for non-high-risk customer segments, you are out of Chapter III scope. Your work stays in Article 50 territory.

Article 50 transparency obligations

Article 50 is the binding regime:

Article 50(1): every chatbot interaction must include a clear AI disclosure. The disclosure must appear before or at the start of the conversation, in language the user understands, in a place they actually see. Examples that satisfy the rule:

• Greeting message that starts with "Hi, I'm an AI assistant from [Company]..."
• Persistent badge in the chat header reading "AI assistant"
• Splash screen on first open of the widget

Examples that do NOT satisfy the rule:

• AI disclosure only in the website footer
• AI disclosure only in terms of service
• Generic "powered by" line that does not name AI explicitly

Article 50(2): every AI-generated reply, summary, knowledge-base article, or auto-response must be marked as AI-generated in a machine-readable way. The C2PA standard is the expected mark; until it stabilises, a clear visible "AI-generated" label plus a corresponding metadata tag in HTML satisfies most national regulator guidance.

Self-audit checklist before 2 August 2026

Seven checks before 2 August 2026:

1. List every AI feature in your product: chatbot, ticket triage, reply suggestion, sentiment scoring, summarisation, knowledge-base article generation.
2. Audit your chatbot disclosure UI. Take a screenshot on first interaction. Show it to someone outside the company. Ask them if it is clear they are talking to AI before the third message. If no, redesign.
3. Tag every AI-generated piece of customer-facing content with both a visible label and HTML metadata.
4. Build a customer-facing AI use page explaining what AI features you ship and what data they process.
5. Provide an opt-out for AI-handling where feasible (especially for B2B customers serving high-risk industries).
6. Update privacy notice with explicit references to Article 50 disclosure approach.
7. Document the disclosure in your customer-onboarding flow so EU enterprise procurement reviews can validate compliance in 10 minutes, not 10 weeks.

Penalties and enforcement

Penalty ceilings under Article 99 for Article 50 violations: €15M or 3% of global turnover. Worked example: a customer-support SaaS with €4M ARR and 40 staff faces a theoretical max of €120,000 per violation under SME proportionality. Realistic regulator behaviour for first-offence Article 50 failures: a corrective order plus a fine of €10,000 to €50,000 per affected user-facing surface. The procurement cost is the bigger lever: Salesforce, ServiceNow, Zendesk, and Intercom-tier buyers already require Article 50 attestation in their vendor risk assessments. Missing it slows enterprise deals by 2 to 4 months.