Usually not. Customer support is not a listed high-risk use, so a chatbot or agent that answers questions, tracks orders or resets passwords sits in the transparency tier: people must be told they are dealing with an AI system. It becomes high-risk when it starts doing a listed job, such as assessing an individual's creditworthiness.
Why is support usually outside the high-risk tier?
The EU AI Act decides high-risk status by use. Annex III lists the uses, including creditworthiness assessment and credit scoring of natural persons, and risk assessment and pricing for life and health insurance. Answering questions about an account, explaining a policy or booking a callback is not on the list.
What does apply is Article 50: providers must design systems that interact with people so that people are informed they are dealing with an AI system, unless that is obvious from the context, and certain AI-generated content must be marked. Article 4 AI literacy applies to the staff who run and supervise the chatbot. The general test is set out in is an AI agent a high-risk AI system under the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
When does a support agent cross into high-risk?
The line is crossed by capability, often quietly. A support agent becomes high-risk for a capability when it:
- Decides or shapes credit for individuals, for example approving an overdraft increase or a "buy now, pay later" limit inside the chat. See whether a credit scoring agent is high-risk.
- Prices or assesses risk for life or health insurance, for example quoting a premium after asking health questions. See whether an insurance pricing agent is high-risk.
- Decides eligibility for certain public services or benefits, where the operator is a public body or acts for one.
The difference between a chatbot and an agent matters here. A chatbot answers. An agent has tools. Once a support agent can change limits, issue credit or set prices, it may be doing a listed job, whatever it is called.
What substance does the transparency tier require?
| Requirement | What it means for a support agent | Control |
|---|---|---|
| Tell people they face an AI system | Clear notice at the start, unless obvious | Notice built into the first message |
| Mark AI-generated content where required | Generated media and certain text published to inform the public | Labelling in output channels |
| AI literacy for staff | Supervisors understand the agent's limits | Role-based training records |
| Stay out of prohibited practices | No manipulative or exploitative tactics | Approved templates; vulnerability hand-offs |
Even without high-risk status, a structured approach to risk pays off. The high-risk method in EU AI Act Article 9 risk management for AI agents is a sound model to borrow.
What may the agent do, and what stays with a person?
- Agent may: answer questions from approved sources, track orders and payments, update contact details after authentication, and explain fees.
- Agent may, within limits: issue small goodwill credits, rebook appointments, cancel orders before dispatch.
- Stays with a person: complaints that need a decision, any credit or insurance pricing decision about an individual, customers showing signs of vulnerability, and anything outside policy.
An illustrative example
Take an online retailer that also offers its own instalment credit. Its support agent answers delivery and returns questions, which is transparency-tier work. A product team then adds a tool so the agent can "help customers increase their instalment limit" by asking a few questions and applying a new limit.
That capability is creditworthiness assessment of individuals, a high-risk use. The retailer has two options: build the oversight, logging, documentation and impact assessment the high-risk tier requires, or take the tool away and route limit requests to its credit team. It chooses the second for now, and adds a refusal to the agent's scope so the capability cannot reappear without a classification decision.
Which controls keep a support agent where it belongs?
- Classify every capability when it is added, not just the agent at launch.
- Bound the agent's scope so it refuses listed high-risk jobs it has not been classified for.
- Give a clear AI notice at the start of every conversation.
- Route vulnerability and complaints to people.
- Review tool additions through the same gate as new agents.
The broader concept is explained in what a high-risk AI system is, and the full map in AI agent regulation, mapped to controls.
Questions people ask
Does a bank's support chatbot count as high-risk because banks are regulated?
No. Classification depends on the use, not the sector. A bank's chatbot answering card questions is in the transparency tier; the same bank's credit agent is high-risk.
Is a voice agent treated differently from a text chatbot?
The same use-based tests apply. Voice agents must also tell callers they are dealing with an AI system, and any synthetic audio content may need marking.
Do we need a fundamental rights impact assessment for a support agent?
Generally not. Article 27 applies to certain deployers of high-risk systems, such as those assessing credit or pricing life and health insurance.