Section 1/8What the EU AI Act requires in October 2026
The EU AI Act in 2026: the rules for AI in sales and customer service
The rules are lighter than the headlines suggest, as long as you know which AI your company uses. Here are the dates, the roles and a checklist.
The EU AI Act (opens in a new tab) has produced plenty of scary headlines about fines in the millions. For most companies using AI in sales and customer service, reality looks different. The rules that apply today are about transparency and AI literacy, and they are entirely manageable.
The bigger risk is AI that nobody keeps track of: a chatbot someone plugged in, an AI field in the CRM that fills in data, an email tool that writes to customers. Companies that know which AI they run, and build the rules in from the start, can automate more, not less.
What the EU AI Act requires in October 2026
AI use is growing fast. According to Statistics Sweden (SCB) (opens in a new tab) (May 2026), 35 percent of Swedish companies used AI in 2025, up from 25 percent the year before. Among mid-sized companies the share was 50 percent. At the same time, the AI Act timeline has changed.
In July 2026, the EU's digital omnibus, Regulation (EU) 2026/1744 (opens in a new tab), entered into force. It postponed the heavy requirements for high-risk AI, but not everything:
In force since 2 February 2025: the bans on certain uses of AI, such as manipulation that harms people, and the AI literacy (opens in a new tab) requirement.
In force since 2 August 2026: the transparency rules in Article 50 (opens in a new tab). Anyone interacting with an AI system must be told so, unless it is obvious, and deepfakes must be labelled. Generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to mark their output in a machine-readable way, a duty that sits with the provider.
Kept but softened: the AI literacy requirement. Under the omnibus wording, companies must take measures that support their staff's AI literacy, but do not have to guarantee a particular level.
Postponed to 2 December 2027: the requirements for high-risk systems under Annex III (opens in a new tab), such as AI used in recruitment or credit scoring. For AI in products that already have their own EU rules, Annex I, the date is 2 August 2028.
For a company using AI in sales and customer service, Article 50 and AI literacy are what apply now.
Provider or deployer: which role does the company have?
The AI Act separates whoever develops an AI system (the provider) from whoever uses it in their business (the deployer, see Article 3 (opens in a new tab)). The role decides which requirements apply.
A company using ready-made AI features in HubSpot, Attio or Microsoft 365 is usually a deployer. The provider then carries the main responsibility for how the system is built. That includes transparency: the duty for a chatbot to identify itself as AI formally sits with the provider. That changes when a company builds its own solutions, for example a chatbot built on a language model with custom instructions, or an AI agent that sends emails in the company's name. The company itself can then count as the provider of that solution, and the Article 50 requirements fall on the company.
The line is not always obvious, which is exactly why it needs to be settled before the solution is built, not after.
Most of the risk lies in AI that nobody keeps track of.
Chatbots and AI email: transparency in practice
Article 50 requires that people who interact directly with an AI system are told so, unless it is obvious. The information must be clear and given no later than the first interaction. In practice that means:
Chatbot on the website: a clear line at the start of the chat saying it is an AI assistant. We also recommend an easy way to reach a person, even though the regulation does not require it.
AI agent on the phone or in chat: the same, even when the voice or tone sounds human.
Images, audio and video that look real: whoever uses AI to create deepfakes must disclose that the content is AI-generated.
AI that helps a salesperson write an email the salesperson then reviews and sends is a different situation from an agent that answers customers on its own. The more independent the AI, the more important it is that transparency is built in. It is a design decision, not a legal afterthought.
Where the high-risk line is drawn
Most AI features in sales and customer service are not high-risk. That changes when the AI makes or steers decisions that affect people's opportunities. Two examples close to sales and administration:
Recruitment: AI that sorts or ranks applicants.
Credit scoring: AI that assesses whether an individual is creditworthy.
Such systems face extensive requirements on documentation, risk management and human oversight from 2 December 2027. Anyone planning such solutions should start now, since the requirements affect how the system is built.
What getting it wrong costs
Breaking the transparency rules can lead to fines of up to EUR 15 million or 3 percent of global annual turnover, whichever is higher for larger companies. For small and mid-sized companies the lower amount applies instead (Article 99 (opens in a new tab)). These are maximums. The more important point is that the rules apply in full to small companies too.
In Sweden, the government inquiry SOU 2025:101 (opens in a new tab) (in Swedish) proposed in October 2025 that the Swedish Post and Telecom Authority (PTS) should lead supervision. In June 2026, the government tasked PTS, the Swedish Authority for Privacy Protection (IMY), the Swedish Financial Supervisory Authority (Finansinspektionen), the Medical Products Agency and Swedac (opens in a new tab) (in Swedish) to act as competent authorities under the AI Act, with PTS as coordinator, pending supplementary Swedish legislation. Often, though, the bigger cost is not a fine but the trust lost when a customer discovers they have been talking to an AI without knowing it.
Checklist for AI in sales and customer service
List all AI that touches customers: chatbots, AI fields in the CRM, email tools, telephony and meeting notes.
Establish your role for each solution: is it a ready-made feature from a vendor, or something the company has built or had built?
Make AI visible where customers meet it: a clear line in the chat, and ideally a way to reach a person.
Train the people who use the AI: what it does, where it can be wrong and when a person should take over. Document the training.
Check the personal data: which data the AI may read, where it is processed and what the data processing agreement says.
Flag anything close to high-risk, such as recruitment or credit decisions, and plan for the requirements that apply from December 2027.
This text is not legal advice. When the role or risk class is unclear, it pays to check with a lawyer.
How we build AI that meets the rules
When we build AI agents and automations, transparency and control are part of the design from day one:
Mapping: which AI is already in use, in which systems and with which data.
Clear rules for the agent: what it may do on its own, when it hands over to a person and how it introduces itself.
Logs and follow-up: every automated decision can be traced in the CRM.
Training: the team understands the tool, and the training is documented.
The goal is AI that saves time in sales and customer service, where it is always possible to see what it has told customers and why.
Frequently asked questions
Does the EU AI Act apply to small companies?
Yes. The transparency and AI literacy requirements apply regardless of size. Small and mid-sized companies get the lower of two maximum fines, and providers of high-risk systems may submit simplified technical documentation. The requirements themselves still apply.
Does a website chatbot have to say it is an AI?
Yes. Since 2 August 2026, people interacting with an AI system must be told so, unless it is obvious. The information must be given no later than the first interaction.
Are AI features in CRM systems high-risk?
Usually not. High-risk mainly covers systems that affect people's opportunities, for example in recruitment or credit scoring. The requirements for those apply from 2 December 2027.
What did the EU digital omnibus change?
The omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It postponed the high-risk requirements to December 2027 and August 2028 respectively, and softened the AI literacy requirement. The transparency rules have applied since August 2026, but generative systems already on the market have until 2 December 2026 for machine-readable labelling.
Can NOD³ help with AI that complies with the regulation?
Yes. We map which AI is in use, build agents and automations with transparency and logging built in, and train the team. We do not give legal advice, so questions about role and risk class should be checked with a lawyer.
What would you like to improve?
Tell us about your situation and what you want to achieve. One of our founders will reply within two working days and help you identify a first step. The first conversation is free and there is no obligation to proceed.
What happens next?
- We review your inquiryWe read your inquiry and reply within two working days.
- We clarify the next stepWe ask follow-up questions or suggest a first conversation.
- You decide whether to proceedIf we can help, you receive a proposal for the next step with a defined scope and price.