The EU AI Act for Businesses: What Sales and Customer Service Teams Need to Review

The EU AI Act has more than one deadline, and the postponement of certain requirements is not a blanket moratorium. It distinguishes between roles, timelines, and risk levels. A company using AI in sales or customer service may already have obligations, even though the high-risk framework has been delayed.

By E2M Global Advisory LLC · English edition published September 27, 2026 · About E2M

Your sales team uses a chatbot on the website, an assistant inside the CRM that summarizes calls, or a tool that prioritizes leads based on a conversation. Nobody built it from scratch: the team bought it, turned it on, and started using it. The question that eventually reaches leadership is usually more specific than “Do we comply with the AI Act?” It is: does the technology we already use create obligations, when did those obligations begin, and what happens if we have not reviewed them?

The answer is more complicated because the AI Act does not have a single implementation date. In 2026, some requirements were postponed and others were not. Assuming that everything was delayed until 2027, or that every chatbot is automatically high-risk, can lead a business in the wrong direction.

This guide concerns the European Union’s AI Act. For a U.S.-based business, whether the regulation applies depends on the scope of its activities and the rules in Article 2, including certain uses of AI outputs in the EU. It is not a general U.S. AI compliance guide.

The main point: what to understand first

If your business falls within the AI Act’s scope and uses AI in sales or customer service, it will generally have a defined role, often as a deployer. Measures to support staff AI literacy and the applicable transparency requirements may already need attention.

The December 2027 postponement concerns the high-risk framework for Annex III systems, including specific uses such as creditworthiness assessment and risk assessment or pricing in life and health insurance. A typical sales chatbot or CRM assistant is not automatically in that category. That does not make it exempt from every other requirement.

Why this matters now, rather than in 2027

Regulation (EU) 2024/1689 applies in stages. The prohibitions and AI literacy requirements began applying on February 2, 2025. The customer interaction and emotion-recognition transparency requirements discussed here began applying on August 2, 2026. Regulation (EU) 2026/1744, known as the AI Omnibus, entered into force on July 27, 2026, postponing the relevant Annex III high-risk requirements until December 2, 2027, and those for high-risk systems covered by Annex I until August 2, 2028. See the European Commission’s implementation overview and the AI Omnibus Regulation.

The postponement is real, but its scope matters. It does not suspend the existing prohibitions or the chatbot disclosure requirement. AI literacy also retains its original application date, although the July 2026 amendment changed the standard: providers and deployers must take measures to support the development of AI literacy, rather than guarantee a particular level for every individual.

A company that reads “the AI Act has been postponed” as “we have nothing to review until 2027” is treating one part of the regulation as if it were the whole. Official explanatory pages may also be updated at different times. The AI Act Service Desk timeline should be read alongside the amending regulation and the Commission’s updated policy page. Check the specific obligation, the company’s role, and the system’s intended use before relying on a headline date.

First, identify your company’s role

Provider vs. deployer

The regulation defines several roles. For sales and customer service teams, two are especially relevant: the provider, which develops a system or has it developed and markets or puts it into service under its own name, and the deployer, which uses it under its own authority. Article 3(4) defines the deployer role, excluding personal, nonprofessional use. See Regulation (EU) 2024/1689 on EUR-Lex.

In practical terms, buying a customer service chatbot, an AI module for your CRM, or a proposal-writing assistant can make your company the deployer even if nobody on your team wrote any code. Your responsibilities are distinct from those of the vendor. “We bought the AI; we did not build it” does not settle the question.

Article 26 addresses obligations specifically for deployers of high-risk systems. It should not be treated as a checklist that automatically applies to every business chatbot. The obligations that matter depend on both the role and the use case.

What sales and customer service teams already need to review

Staff AI literacy: Article 4

AI literacy requirements have applied since February 2, 2025, but their wording changed in July 2026. The amended Article 4 requires providers and deployers to take measures supporting the development of AI literacy among staff and others operating or using AI on their behalf. Those measures should reflect their knowledge, experience, education, training, and the context in which the systems are used. The amendment expressly says that providers and deployers do not have to guarantee a specific level of literacy for each individual. See Regulation (EU) 2026/1744, Article 1(5).

The practical work remains. Keeping a record of the training provided, the roles covered, and the material used is a sensible way to show what your company has done. If a sales team uses an AI assistant to write proposals or prioritize leads, it needs to understand what the tool does, what should remain a human decision, and how to review its output. A purchased license is not evidence that the team has received that support.

Making it clear when someone is interacting with AI: Article 50(1)

Article 50(1) places a design obligation on providers of AI systems that interact directly with people: users must be informed that they are interacting with AI, unless this is obvious in the circumstances to a reasonably informed and attentive person. The requirement has applied since August 2, 2026. See the European Commission’s Article 50 FAQ.

For a sales or support chatbot, the practical check is straightforward: does the actual customer experience make the use of AI clear? Review the opening interaction and the configuration with the provider. A disclosure hidden where customers are unlikely to see it may not resolve the issue. The relevant information must be clear and accessible by the first interaction or exposure, subject to the applicable exceptions.

Disclosure for emotion recognition or biometric categorization: Article 50(3)

Some CRM and contact center tools analyze conversations, voice, or other signals. First establish what the system actually does: a tool described as “sentiment analysis” is not automatically an emotion-recognition system under the Act. The legal definition of emotion recognition refers to inferring emotions or intentions from biometric data.

Where Article 50(3) applies, deployers of emotion-recognition or biometric-categorization systems must inform the people exposed to them and comply with applicable data protection rules, including the GDPR. See Article 50 in the AI Act Service Desk.

This is separate from the prohibition on AI used to infer emotions in workplaces and educational institutions, subject to the narrow medical or safety exceptions in Article 5(1)(f). A contact center analyzing its employees’ emotions faces a different issue from one analyzing customers. Nor does disclosure alone make every use involving customers lawful: the purpose, data, other prohibitions, and risk classification still need review.

When sales AI may be high-risk

The postponement of the relevant Annex III requirements to December 2, 2027, does not remove the need to understand your use case. The high-risk framework involves more demanding requirements, including risk management, documentation, and, for providers, conformity assessment. Responsibilities differ between providers and deployers.

Examples relevant to sales include AI intended to assess an individual’s creditworthiness or credit score, with an exception for financial fraud detection, and AI used to assess risk or set prices in life and health insurance. These uses are listed in Annex III.

That matters for point-of-sale financing, consumer credit approval, or insurance sales in which AI influences pricing. These are examples, not an exhaustive list. A typical sales chatbot or CRM assistant should not be classified as high-risk solely because it uses AI, but its exact purpose and the classification rules must be assessed before reaching the opposite conclusion.

What happens if you do not review it: putting penalties in context

Article 99 distinguishes between categories of infringement. Violations of the prohibited practices in Article 5 can carry maximum administrative fines of €35 million or 7% of worldwide annual revenue for the preceding financial year, whichever is higher. Violations of certain other requirements, including Article 50 transparency obligations, can carry maximum fines of €15 million or 3%. A third category covers incorrect, incomplete, or misleading information supplied to the relevant authorities or bodies. See Article 99 of the AI Act.

For small and medium-sized enterprises, including startups, Article 99 provides for the lower of the applicable fixed amount or revenue percentage. These are legal ceilings, not predictions of the penalty a particular company would receive. The circumstances and the applicable provisions matter. The purpose of understanding these figures is to set priorities realistically, not to turn every chatbot review into a €35 million headline.

A review checklist for sales leaders

Use these questions to decide where a more specialized review is needed. They are a starting point, not a binding legal self-assessment.

• Role: For each AI tool used by your team, do you know whether your company is the deployer and whether the AI Act applies?
• AI literacy: Can you show what you have done to help the team understand the tool, its limitations, and the decisions that should remain with people?
• Basic transparency: Does the chatbot or assistant make it clear from the first interaction that the customer is dealing with AI, where disclosure is required?
• Emotion-related transparency: Do any tools analyze customer voice or other signals? Have you checked whether they meet the legal definition of emotion recognition or biometric categorization and what disclosure is required?
• Employees vs. customers: Are any emotion-recognition systems used on your own agents or employees? This can raise a prohibition issue, rather than simply a disclosure question.
• High risk: Does AI participate in creditworthiness assessments, consumer financing, or risk assessment or pricing for life and health insurance? Have you checked any other relevant Annex III uses?
• Documentation: If someone asked tomorrow what your company had reviewed, could you provide a written record, or would you have to reconstruct decisions from memory?

What we would not do

We would not sign an “AI Act compliance certificate” or claim that a tool complies simply because someone added a generic AI notice to the bottom of a chat window. We would not recommend stopping every commercial AI initiative out of fear of the high-risk framework when the intended use may not fall within it.

We also do not replace legal counsel in determining the final legal classification of a system. This article organizes the questions; it does not replace a legal opinion. If your company operates in consumer credit, point-of-sale financing, or insurance, or if the classification of a particular system is unclear, obtain specialized legal advice before making decisions.

From legal requirements to business decisions

Working through four questions—role, AI literacy, transparency, and high risk—is the starting point. Once you understand what needs review, the business question returns: where should AI be used in your sales process, and how will you measure its value before expanding it?

We explore that question in AI for Commercial Processes: Where to Start Before Buying Another Tool. If your concern is a system that analyzes CRM conversations, read AI for CRM and Sales Follow-up: Turn Conversations into Next Actions. And if you are still deciding whether the business is ready for more automation, see When an SME Should Not Automate Yet.

Sources and limits of this guide

This article provides general information, not legal advice. Decisions about a system’s classification, potential penalties, or formal compliance require analysis of the specific circumstances and, where appropriate, qualified legal counsel.

• EUR-Lex: Regulation (EU) 2024/1689. The legal source for scope, roles, definitions, prohibited practices, and penalties. Read the original regulation together with subsequent amendments.
• EUR-Lex: Regulation (EU) 2026/1744, the AI Omnibus. The primary source for the July 2026 amendments, including the revised AI literacy obligation and the high-risk implementation dates.
• European Commission: AI Act overview. An official explanation of the framework and implementation timeline. It complements the legislation but does not replace it.
• AI Act Service Desk: Implementation timeline. Useful for navigating application dates. Check amendment notices and the latest legal text when explanatory pages differ.
• European Commission: Article 50 transparency FAQ. Practical guidance on transparency obligations; it is not a substitute for the legal text in borderline cases.
• AI Act Service Desk: Article 50. Covers the disclosure requirements discussed here. Read it together with the definitions, prohibitions, and any amendment notice on the page.
• AI Act Service Desk: Annex III. Lists high-risk use cases. Classification still requires a review of the system’s purpose and the applicable rules.