AI chatbots in customer service: What teams need to clarify before August 2

A chat window opens, greets customers, and answers questions about invoices, returns, or appointments in seconds. What seems technically convenient is also becoming an organizational urgency for Austrian companies from August 2, 2026 onwards: The transparency obligations of the EU AI Act are becoming applicable. People should be able to recognize when they are interacting directly with an AI system. For a AI chatbot in customer service in Austria it is therefore not enough to simply add a tool and hope for good answers.

Service managers and employees must clarify what the bot is allowed to answer, when a human takes over, which data are processed, and how incorrect information is corrected. This guide translates the current legal situation into a practical workflow. It does not provide individual legal advice, but it shows which questions a company should answer before putting the system into productive use.

Why AI chatbots are becoming a workplace issue right now

Artificial intelligence has arrived in Austrian businesses. According to the report published in June 2026 Survey by Statistik Austria in 2025 already 30 percent of companies with ten or more employees used AI technologies. The EU average was 20 percent. As adoption increases, so does the need for people who implement systems, maintain knowledge bases, check answers, and take over difficult cases.

In customer service the use case is particularly visible. A bot can triage recurring questions around the clock, compile information from a shared knowledge base, or collect data for human handling. At the same time it interacts directly with people who expect a reliable solution. An invented return deadline, wrong pricing information, or a blocked handover to a human damages trust faster than a friendly greeting can build it.

The central question therefore is not: "Can the AI answer?" It is: "For which requests may it answer, on what basis, and with what safety net?" It is at precisely this interface that new tasks arise for service, IT, data protection, legal, product management, and leadership.

What Article 50 of the AI Act means for chatbots

The The European Commission published guidelines on 20 July 2026 to the transparency obligations under Article 50 of the AI Act. These obligations apply from 2 August 2026. The Austrian AI Service Center of RTR summarizes the key point for chatbots as follows: Providers of AI systems for direct interaction with natural persons must design the system so that it is apparent that the interaction is with AI.

An exception exists when the use of AI is obvious to a reasonably well-informed, attentive and understanding person because of the circumstances and context. In practice, companies should not read this exception as an invitation to hidden or misleading solutions. Clear information before, or at the latest at the start of the conversation, is easy to understand, technically simple, and strengthens trust.

The allocation of roles is important: Article 50(1) primarily directs the design obligation at the provider of the system. An Austrian company that operates a third-party chatbot on its website must nevertheless check whether the solution used enables the necessary information and how it appears in the specific interface. In addition, its own obligations as operator and as the data controller under data protection law remain. Contract, configuration and actual use must align.

What a clear notice can look like

The notice should be visible, concise, and phrased in the language of the users. One possible working version is:

You are speaking with our AI assistant. It answers questions based on our service information. For complex issues, you can request a staff member at any time.

This is not a universally valid legal template. The text must match the scope of functionality. Does the bot collect personal data, make preliminary decisions, or only provide general information? The more influence the system has on the matter, the more precisely the information and handover process must be described.

Transparency is more than a label

A small note 'AI chat' does not solve all problems. Customers need a realistic picture of what the system can do and where its limits lie. Good transparency answers four questions:

Who am I speaking with? The AI character of the interaction is recognizable from the start.
What is the bot intended for? The permissible scope is clear, for example product information, appointment preparation, or status inquiries.
What happens to my information? Data protection information is easy to find and corresponds to the actual processing.
How do I reach a human? The handover is not hidden and also works in cases of misunderstandings.

The team should not answer these questions only on an information page. The answers must become visible in the conversational flow. For example, anyone who writes "complaint", "cancellation", "payment problem" or "I don't understand this" must not end up in an endless loop.

The GDPR and the AI Act apply alongside each other

Labeling as an AI system does not replace a data protection assessment. The Austrian Data Protection Authority betont, dass die DSGVO parallel zur KI-Verordnung anwendbar bleibt, sobald personenbezogene Daten verarbeitet werden. In ihren FAQ verwendet sie ausdrücklich das Beispiel eines intelligenten Kundenservice-Chatbots auf der Website einer Versicherung.

Für den Betrieb sind insbesondere diese Grundsätze relevant:

Rechtsgrundlage und Zweck: Für welche konkrete Serviceleistung werden die Angaben benötigt, und worauf stützt sich die Verarbeitung?
Datenminimierung: Der Bot soll nur Informationen abfragen, die für den jeweiligen Schritt wirklich erforderlich sind.
Richtigkeit: Falsche Kundendaten und fehlerhafte KI-Ausgaben müssen berichtigt werden können.
Storage limits: Conversation logs must not be retained indefinitely just because they might be useful later.
Integrity and confidentiality: Accesses, transmissions to providers, and safeguards must be auditable.

Before launch, it should be clarified whether inputs will be used for the provider's training, where data will be stored, which subcontractors are involved, and how deletion or access requests are handled. Health data, payment information, identity document data, trade union membership, or other sensitive information should be treated with particular caution. A general clause in the terms and conditions does not replace transparent, purpose-specific information.

Ten decisions before going live

1. Define a narrow purpose

"Automating customer service" is not a useful purpose. Better is: "The bot answers general questions about delivery times from the approved knowledge base and hands individual complaints over to the service team." A narrow mandate limits data, tests, and responsibilities.

2. Determine authoritative sources of truth

The bot must not confuse the open internet with the company's official truth. Prices, deadlines, contractual terms, opening hours, and service commitments require a version-controlled, accountable source. Every change should include a date, a responsible person, and a short approval note.

3. Define allowed and prohibited responses

A positive list shows what the bot may answer autonomously. A negative list specifies topics that must be handed to humans immediately: legal threats, cases of financial hardship, security issues, discrimination, health information, or decisions with significant consequences.

4. Set up the human handover

A button alone is not enough. The team must know when a case will be taken over, which conversation data is transferred, how long the response will take, and what happens outside service hours. A good handover message states the next step and does not promise an unrealistic immediate solution.

5. Limit data collection

If the bot asks for name, address, and customer number too early, it may collect more than necessary. General questions should be possible without identification. Only when a specific case is opened should a controlled, clearly explained data collection begin.

6. Test critical responses

Normal template questions are not enough. Tests should include typos, dialect, contradictory information, emotional complaints, manipulated prompts, and topics outside the intended scope. The goal is not only a correct answer but also a safe 'I can't decide that.'

7. Define quality metrics

Measurable indicators include, among others, correct first responses, abandonment rate, handover rate, repeated questions, reasons for complaints, and subsequent corrections. A low handover rate is not a success if people abandon their requests out of frustration.

8. Set up error and incident channels

Employees need a simple reporting channel for incorrect facts, data protection issues, or unusual conversation patterns. Critical errors must be able to disable a knowledge source or temporarily revert the bot to restricted functionality.

9. Document responsibilities

Who maintains content? Who approves changes? Who decides on data protection, security, and escalation rules? Who monitors the service provider? Without designated responsible parties, the chatbot remains a community project that no one feels responsible for in an emergency.

10. Involve employees in the rollout

Service staff know recurring misunderstandings, exceptions, and phrasings. Their experience should be included already in the design. Anyone who only deploys a system technically and then lets the team work with it afterward overlooks valuable process knowledge and creates unnecessary resistance.

What new tasks arise in customer service

AI chatbots may reduce some simple routine contacts. They also create tasks that are often missing from job descriptions:

New task	Required competency	Typical outcome
Knowledge maintenance	Product knowledge, editing, versioning	Approved and up-to-date answer source
Dialogue design	Service communication, user guidance, clear language	Understandable questions, hints, and handovers
Quality assurance	Error analysis, spot checks, documentation	Identified patterns and concrete improvements
Escalation management	Judgment, de-escalation, expertise	Secure solution for complex cases
Service analysis	Data understanding, data protection, process thinking	Prioritized causes instead of mere contact numbers

For employees, this creates a valuable combination: understanding the concern empathetically, recognizing system boundaries, and feeding improvements back in a structured way. The jobspot.at-guideAI competence is becoming a job factorIt shows how such skills can be developed and demonstrated with a learning plan. The article offers further examples of task shifting AI in Tourism.

A ten-day plan through August 2

Day 1: Create an inventory. Document all chatbots, assistants and automated contact flows, including pilot projects.
Day 2: Clarify roles. Document providers, operators, data protection responsibilities, internal owners and service providers.
Day 3: Check notices. Test visibility, language, timing and accessibility of the AI information.
Day 4: Align purposes and data. Compare inputs, logs, retention periods and disclosures with the actual information.
Day 5: Clean up knowledge sources. Remove outdated documents, assign responsible parties, and set an update schedule.
Day 6: Define boundaries. Erlaubte Antworten, sensitive topics and automatic handovers documented in writing.
Day 7: Conduct a stress test. Real, difficult, and ambiguous cases reviewed with service and specialist departments.
Day 8: Train the team. Handover, correction, incident reporting, and customer explanations practiced.
Day 9: Implement corrections. Close critical gaps and disable functions that are not under control.
Day 10: Document sign-off. Version, review result, open items, and next inspection date.

Companies that are just getting started should not promise a rushed full-scale deployment. A small, clearly limited bot with a functioning handover is more valuable than a universal assistant that convincingly gives wrong answers on important issues.

Three practical cases from Austrian service businesses

Case 1: Returns in online retail

The bot explains general return steps from the current policy and only asks for the order number when checking the status. An expired deadline or damaged goods are escalated to the team. This keeps standard information quick, while goodwill gestures and disputes are decided by humans.

Case 2: Appointment in a healthcare facility

The system offers available time slots, but should not assess symptoms or determine urgency. As soon as a person describes complaints, the bot ends the automated consultation and refers them to the designated human or medical contact channel. Health data is processed only within the defined process.

Case 3: Invoice from a utility company

The bot explains line items and collects the reason for an inquiry. In cases of payment difficulties, disputes, or an impending disconnection, a trained human takes over. The conversation summary serves only as an aid; the employee checks the original data and decides according to the applicable rules.

Checklist for service managers and employees

The AI notice appears before or at the start of the interaction and is easy to understand.
The functionality is not presented as being greater than it actually is.
Privacy information, purpose, and the actual processing are consistent.
General inquiries should be possible without unnecessary identification whenever possible.
Authoritative facts come from named and maintained sources.
For sensitive, complex, or consequential matters, a human handover is available.
Employees can report errors and have critical content quickly blocked.
Spot checks examine not only tone, but also facts, fairness, and impacts.
The provider is contractually and technically assessed for data usage and security.
A next review date is scheduled; the approval is not indefinite.

Frequently asked questions about AI chatbots in customer service

Does every chatbot have to explicitly say 'AI'?

Article 50 requires informing users about interactions with an AI system, unless this is obvious to a reasonably informed, attentive, and understanding person. For most company websites, a clear, visible statement is the more robust approach. The specific implementation should be appropriate to the application and to current guidance.

Is a notice in the imprint or in the terms and conditions sufficient?

A hidden, general notice hardly serves the practical purpose of transparency. The information should reach the person when they begin the interaction. In addition, appropriate data-protection information is required as soon as personal data are processed.

May a bot handle complaints completely?

Simple, clearly defined steps can be automated. As soon as interpretation, discretionary concessions, a significant disadvantage, or an emotional escalation are involved, a human should take over. Decisive factors are risk, data, legal effect, and the actual scope for action.

Who is liable for an incorrect answer?

There is no blanket answer to that. The provider role, operator role, contract, type of error, and concrete consequences are relevant. In any case, for the affected customer the company deploying the system remains the visible point of contact. Error checking and escalation must therefore not be delegated to the technology.

Do AI-assisted emails also have to be labeled as a chatbot?

A direct interaction with an AI system is assessed differently than an internal draft that an employee reviews and sends themselves. Nevertheless, depending on the use, further transparency, data-protection, or labeling questions may arise. Companies should inventory and assess both processes separately.

Conclusion: A good AI chatbot knows its limits

From 2 August 2026 the transparency obligations of the AI Act will become practically relevant for AI systems that interact directly. For Austrian companies, the visible notice is only the beginning. Reliable customer service requires a clear purpose, up-to-date knowledge sources, minimal data processing, tested limits, and an available human handover.

For employees the opportunity does not lie in fending off as many contacts as possible. People who monitor automated responses, resolve complex issues, and turn mistakes into better processes will become valuable. Review a real chat transcript today from the first notice to the handover to a human. If at any point it is unclear who decides, which data are shared, or how an error is corrected, that is precisely where you should act before the next expansion.

AI Chatbots in Customer Service: What Teams Need to Clarify Before August 2

Why AI chatbots are becoming a workplace issue right now