The AI Act isn’t a future deadline. The EU Regulation on Artificial Intelligence (Regulation (EU) 2024/1689) has been in force since 1 August 2024: prohibitions on unacceptable practices have applied since 2 February 2025, obligations for general-purpose models since 2 August 2025 and, since 2 August 2026, the transparency obligations that apply directly to anyone who communicates with customers.
When it comes to customer communications, the most common mistake is one of timing. Many IT, Risk and Compliance teams planned every intervention for 2027, the year of the high-risk deadlines, and overlooked the transparency obligation that hit customer communications first. That obligation already applies, and breaches of the transparency rules can be fined up to €15 million or 3% of global annual turnover.
AI Act since 2 August 2026: what already applies to customer communication
In July 2026, the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) postponed the obligations for high-risk systems. Annex III systems, high-risk systems classified by intended use such as credit scoring or personnel selection, have been pushed back to 2 December 2027. For Annex I systems, meaning AI embedded as a safety component in products already subject to regulation (medical devices, machinery), the deadline is now 2 August 2028.
That’s welcome breathing room, but not for the people who manage customer communication. The Omnibus did not move the transparency obligations under Article 50: they have applied since 2 August 2026. Teams that planned around a 2027 horizon are already behind.
Chatbot transparency (Article 50): what has applied since 2 August 2026
When a customer interacts with an AI system – a chatbot, a virtual assistant, a generated response – they must be told about it, and content generated or manipulated by AI has to be disclosed. The transparency obligation under Article 50 is the first AI Act requirement to affect every customer touchpoint. For generative AI systems already on the market before that date, the machine-readable marking (watermarking) obligation applies from 2 December 2026, the next deadline to plan for.
AI Act in regulated industries: the risk-based model for communications
The AI Act’s risk-based model classifies systems by level of risk. The same principle should apply to customer communication. A bill, an insurance document or a credit communication carries a different legal and financial risk profile than an onboarding campaign or a newsletter. Applying one rule to every communication would slow down the harmless flows while leaving the critical ones exposed.
The operational distinction needs to be clear-cut:
- High-risk communications (financial information, policies, investment decisions, regulated billing, official notices): AI works inside structured templates, subject to human oversight, traceability and auditability. It optimises, validates and migrates content, but doesn’t draft it on its own.
- Low-risk communications (onboarding, informational content, marketing, interactive journeys): here AI can be used to boost creativity, real-time personalisation and orchestration, while keeping things transparent and protecting data.
The advantage is concrete: the business moves faster where exposure is low and stays cautious where it’s high, without stalling the whole roadmap while waiting for one policy to cover everything.
AI Act for banks and insurers: same flows, different risks
In finance and insurance, dozens of document flows coexist with very different profiles: an insurance quote, an account statement and a promotional communication each call for a different level of control. With risk-based classification, a company can adopt AI without halting operations, enabling it on low-risk journeys while keeping it under tight control for billing and regulated documents.
Shadow AI: the risks for businesses in regulated industries
The most underestimated risk has nothing to do with the AI platforms a company officially adopts. It comes from unapproved GenAI tools employees use to get their work done faster. An employee who pastes a customer’s data into a public chatbot to rewrite a communication puts sensitive information outside the corporate perimeter, with no legal basis and no traceability.
In a regulated sector, using an unapproved tool creates three risk exposures at once: a potential GDPR breach on the data processed, loss of control over cross-border transfers, and no audit trail at all. And the slower the official processes are, the more Shadow AI grows.
Still, there’s no denying it: a ban with no alternative just pushes the behaviour underground. The real fix is offering an approved tool that’s faster and more useful than the unauthorised one.
Human-in-the-loop and compliance: a requirement, not a brake
In high-risk communications, human oversight isn’t a constraint that slows the process down. It’s what makes AI-generated content defensible. The AI Act specifically requires it for high-risk systems. When communication carries legal or financial weight, human review is what separates a process you can verify after the fact from one you can’t justify to a regulator, or to a customer.
In practice, that means building validation checkpoints into the workflow while the communication is being put together, rather than doing a formal check at the end. Who generated that content, when, with which model, and who approved it: without answers to those questions, there’s no compliance, no matter how good the communication itself is.
AI Act obligations for businesses: governance is architecture
The message for CIOs, CISOs and Compliance leaders is simple: AI governance is part of an organisation’s digital architecture, the same way security and business continuity are. Companies that classify communications by risk, build controls into the process and roll out AI selectively can demonstrate compliance today and are ready for the next deadlines (2 December 2026 for marking, 2 December 2027 for high-risk systems).
The first step is mapping: working out which communications already use, or will use, AI, with what risk profile, and what controls are already in place. If you haven’t done it yet, start now: the transparency obligation already applies.
Want to find out which communications already fall within the scope of the AI Act?
Start with a risk-based mapping of your communication flows. Read our executive brief, Customer Communication in the Age of the AI Regulation: From Compliance to Competitive Advantage, and book a meeting with the Doxee team for a concrete assessment of your use cases.
FAQ
When does the AI Act apply?
EU Regulation 2024/1689 has been in force since 1 August 2024. Prohibitions have applied since 2 February 2025, obligations for general-purpose models since 2 August 2025, and transparency obligations since 2 August 2026. Following the Digital Omnibus (Regulation (EU) 2026/1744), the marking obligation for systems already on the market applies from 2 December 2026, and the high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
What has changed for businesses since 2 August 2026?
Since 2 August 2026, the Article 50 transparency obligations apply, and the Commission can fine providers of general-purpose AI models. Businesses have to tell users when they’re interacting with an AI system and disclose AI-generated content where the Regulation requires it. It’s the first threshold to directly affect customer communications.
Does the AI Act apply to customer communications?
Yes. Any communication produced, personalised or managed through AI falls within the scope of the AI Act: from the transparency obligations for AI-generated content, including high-risk content such as regulated billing or financial documents, through to the requirements for human oversight, traceability and auditability of the system used.
What is Shadow AI, and why is it a risk?
Shadow AI is employees’ use of generative AI tools the company hasn’t approved. In regulated settings, Shadow AI risks exposing sensitive data with no legal basis and no audit trail, raising GDPR and cross-border transfer risks. The slower the official processes, the more it spreads.
What does human-in-the-loop mean under the AI Act?
It means having effective human control over what AI systems produce. The AI Act requires it for high-risk cases. In communications with legal or financial impact, validation checkpoints built into the workflow make the process traceable and defensible, rather than a formal check done after the fact.
What penalties does the AI Act set out?
The most serious violations, tied to prohibited practices, carry fines of up to €35 million or 7% of global annual turnover. For most other obligations, the cap drops to €15 million or 3% of turnover. Whichever amount is higher applies.
