It depends on who the customer is dealing with. If an AI agent replies to customers directly, Article 50 expects them to be told they are interacting with an AI system. If the agent drafts and a named person reviews, owns and sends the letter, the customer is dealing with that person, and the question largely falls away.
What does Article 50 say that bears on customer letters?
Article 50 of the EU AI Act sets transparency duties that apply regardless of risk tier. Three of them matter for agents that write to customers.
First, providers must design systems intended to interact directly with people so that those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed person. Second, providers of systems that generate synthetic text, images, audio or video must mark the output in a machine-readable way so it can be detected as AI-generated, with an exception for systems that only assist with standard editing or do not substantially alter the input. Third, deployers that publish AI-generated text to inform the public on matters of public interest must disclose it, unless the text has undergone human review or editorial control and someone holds editorial responsibility.
The full set of duties is covered in Article 50 transparency for AI agents.
Who has to disclose: the provider or the firm?
The interaction and marking duties sit with the provider, who must build disclosure and marking into the system. The firm, as deployer, must use the system as designed and not strip the disclosure out. The public-interest publication duty sits with the deployer, but a reply to a customer's complaint is not a publication to the public, so that duty rarely applies to customer correspondence.
In practice the firm decides the most important thing: whether the customer is dealing with an agent or with a person. That design choice determines which duties bite.
How does human review change the answer?
Consider three ways an agent can write to a customer.
The agent replies on its own. A customer emails about a missing card and the agent answers within minutes, with no person in between. The customer is interacting directly with an AI system. Tell them, in the message itself, clearly and from the first reply.
The agent drafts and a person sends after real review. The agent prepares a response to a complaint, a named handler reads it against the file, edits it and sends it under their name. The customer is dealing with that handler. The Act's own logic for public-interest text points the same way: human review plus editorial responsibility removes the disclosure duty there. The letter is the firm's statement, and the handler answers for it.
The agent drafts and a person clicks send without reading. This is the risky middle. Formally there is a human step; in substance the customer is receiving AI output. A supervisor looking at approval times of a few seconds will not accept that a person took responsibility. Either make the review real or treat the message as agent-to-customer and disclose.
The provider's machine-readable marking duty may still apply to generated text in the second case, since review does not change how the text was produced. That is a marking question, not a customer notice, and is covered in Article 50 marking of AI-generated content.
How do you meet Article 50 for customer correspondence?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Tell people when they interact with AI | Messages sent by the agent without review carry a plain disclosure in the first message | Message templates and sent copies |
| Disclosure is clear and timely | Wording tested with customers; shown at the start, not in a footer | Template approvals and test notes |
| Human review is real where relied on | Agent kept at depth 2; a named person reviews, edits and sends | Approval records with reviewer, edits and time taken |
| Reviewer takes responsibility | Letter sent under the reviewer's name or team | Sent letter and sender identity |
| Marking not removed | Provider's machine-readable marks preserved through templates and channels | Channel configuration review |
| Decision is reconstructable | Each message filed with draft, verdict and sender | Action record per customer contact |
What will a supervisor ask?
- Which customer messages are sent by an agent without a person reviewing them?
- Where does the disclosure appear, and what does it say?
- For reviewed letters, how long do reviewers spend, and how often do they edit?
- Can a customer find out whether a person read their complaint response?
- Has the agent ever made a commitment, such as a refund or an apology, that a reviewer did not intend?
That last question goes beyond Article 50 to authority. Whether an agent can admit fault or apologise is covered in can an AI agent apologise on behalf of the company.
What does Article 50 not cover?
It does not say that every document touched by AI must be labelled for the reader. It does not override conduct rules: a disclosure does not excuse a misleading or unfair letter, and consumer protection duties such as the FCA Consumer Duty apply whoever drafted it. It does not decide data protection questions about using customer data to draft replies. And outside the EU it does not apply at all, although the same distinction between direct agent replies and reviewed drafts is a sensible default everywhere. For the wider map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Should we disclose AI drafting on reviewed letters anyway?
You may choose to. Some firms add a short line explaining that drafts are prepared with AI and reviewed by staff. It is a trust decision rather than a requirement in that case, and it should not suggest the reviewer is less responsible.
Does an automated acknowledgement email count?
A fixed template that says "we received your message" is not AI-generated interaction. A personalised reply composed by an agent is, and should carry the disclosure if no person reviews it.
Does disclosure have to be in every message of a thread?
The Act requires the information at the latest at first interaction. Repeating it where a conversation could be read out of context, such as a forwarded reply, is good practice.