On 2 August 2026 the EU AI Act takes effect. If you use AI for customer contact, bookkeeping or CRM, this concerns you. Here is what to do and how CallMerlin is already compliant.
On 2 August 2026 the transparency obligations of the EU AI Act (Regulation EU 2024/1689) take effect. Every company that uses AI to interact with people in the European Union needs to comply. That includes chatbots, voice assistants, AI-powered customer service, and tools like CallMerlin.
This is not just a rule for Big Tech. Whether you are an accountant using AI for invoice queries, a real estate agent with an AI phone assistant, a hospitality business with voice ordering, or a marketing agency automating client reports, the AI Act applies to you. In this article we explain what the law requires, how CallMerlin is already compliant, and the five steps you can take today to prepare your business.
What is the EU AI Act?
The EU AI Act is the first comprehensive AI law in the world. It classifies AI systems into four risk categories, each with its own set of obligations.
- Prohibited AI: social scoring, manipulative techniques targeting vulnerable groups, real-time biometric identification in public spaces. No normal business use falls here.
- High-risk AI: AI used for hiring decisions, credit scoring, medical triage, educational grading, or critical infrastructure. Requires conformity assessments, technical documentation, human oversight and EU database registration.
- Limited-risk AI: AI systems that interact directly with people, such as chatbots, voice assistants and AI phone agents. Must inform users that they are talking to AI. This is where CallMerlin falls.
- Minimal-risk AI: spam filters, recommendation engines, predictive analytics. No extra obligations.
Where does CallMerlin fit?
CallMerlin is an AI voice assistant and chat platform that interacts directly with people via phone, webchat, desktop app and mobile app. Under the EU AI Act this classifies as a limited-risk AI system. The main obligation is transparency: users must be informed they are interacting with AI.
CallMerlin does not perform HR screening, credit assessments or medical triage, so the strict high-risk requirements of Annex III do not apply.
Article 50: the transparency obligation
Article 50(1) of the EU AI Act states that providers of AI systems intended to interact directly with natural persons must ensure those persons are informed that they are interacting with an AI system. The disclosure must be clear, distinguishable and provided at the latest by the time of the first interaction.
For voice-based systems this means an explicit spoken statement at the start of the call. For chat-based systems this means a visible indication in the interface. Generic references to an 'assistant' or technical descriptions like 'this system uses LLMs' do not satisfy the requirement.
The three obligations that apply to everyone
Regardless of risk category, three obligations apply to every company that uses AI in the EU.
- AI literacy (Article 4): everyone who works with AI or decides about AI must understand the basics. You need to document who received training and when.
- AI inventory: you need to know which AI systems are in use across your organisation. Shadow AI (employees using ChatGPT, Claude or other tools without IT knowing) makes this difficult.
- Transparency disclosure: users must know when they are interacting with AI. For chatbots and voice assistants this means clear labelling or spoken announcements.
How CallMerlin is already compliant
We have built compliance into the platform from the start. Here is what CallMerlin does to meet the EU AI Act requirements.
- AI disclosure on every call: callers hear at the start of every conversation that they are speaking with an AI system. This is configurable per language in your dashboard.
- Visible AI indication in chat: the webchat widget, desktop app and mobile app clearly indicate that the user is communicating with AI.
- EU storage for account and platform data (Netherlands). For AI, chat, voice and transcripts may go to xAI (US) under DPA/SCCs; not an EU-only claim.
- Auditable call logging: every AI interaction is logged with timestamps, making it possible to demonstrate compliance at any time.
- BYOK (Bring Your Own Keys): you use your own API keys for connected services. You remain the owner of your data.
- Technical documentation: documentation about the AI models used, data sources and human oversight measures is available on request.
Five steps to make your business compliant
You do not need a legal department or a 50-page document. Follow these five steps and you are covered before the deadline.
- Step 1: Inventory. List every AI tool in your organisation. Do not forget embedded AI in existing software (CRM, accounting, email). Ask every department: which AI tools do you use?
- Step 2: Classify. Determine the risk category for each tool. Most will be minimal or limited risk. Be strict about high-risk: anything touching HR decisions, credit or medical advice triggers the full obligation set.
- Step 3: Train your team. A two-hour training per role is sufficient. Cover: which AI tools we use, what the risks are (hallucinations, bias, data leaks), and what to do when in doubt. Document attendance.
- Step 4: Implement transparency. For every AI tool that interacts with people: add a clear disclosure. CallMerlin does this automatically. For other tools, add visible labels or spoken announcements.
- Step 5: Document and review. Create a simple living document listing your AI systems, their risk category, the responsible person, and the last training date. Review every six months.
Penalties and risks
Non-compliance with the transparency obligations of Article 50 can result in fines of up to 15 million euros or 3% of global annual turnover, whichever is higher. For violations of the prohibited AI practices the ceiling is 35 million euros or 7% of turnover.
Beyond fines there are practical risks. Enterprise customers increasingly include AI Act compliance in vendor questionnaires. A verified compliance posture builds trust and removes friction from sales processes.
FAQ
Does the EU AI Act apply to companies outside the EU?
Yes. If your AI system interacts with people in the EU, the law applies regardless of where your company is based.
What if I think I do not use AI?
Almost impossible in 2026. AI is embedded in Outlook, Gmail, your CRM, accounting tools and even spell checkers. Inventory first, then conclude.
What is the difference between the AI Act and GDPR?
GDPR regulates personal data. The AI Act regulates AI systems. Both can apply simultaneously. An AI system that processes customer data falls under both.
What if I miss the 2 August 2026 deadline?
Fines range from 1.5% of global turnover (administrative violations) to 7% (prohibited practices). Enforcement is expected to focus on large companies and clear high-risk cases first, but you should not rely on that.
Does CallMerlin handle compliance for me?
For the AI interactions that run through CallMerlin, yes. We handle the transparency disclosure, EU hosting, call logging and documentation. For other AI tools in your organisation you need to implement compliance yourself.
What should I do today?
Start with one email to your team: 'Which AI tools do you use for work?' Then schedule an hour with your IT lead to review embedded AI in existing software. And make sure every AI tool that talks to customers has a clear disclosure. CallMerlin already takes care of that for you.
