EU AI Act voice AI classification: limited, high-risk, or out of scope?

The three classifications that matter

The EU AI Act creates four risk categories — prohibited, high-risk, limited-risk, and minimal-risk — but voice AI in enterprise contact centres realistically sits in only three of them. Prohibited practices (real-time biometric identification in public spaces, social scoring) do not apply to inbound customer service.

Limited-risk is the default for most servicing use cases. The obligation is narrow but specific under Article 50: the deployer must inform the natural person that they are interacting with an AI system, unless this is obvious from the context. 'Obvious from the context' is a higher bar than vendors often suggest — a voice that sounds human, in a channel a human would normally answer, requires disclosure.

High-risk is the regime that changes the economics of the deployment. The full conformity assessment, technical documentation, post-market monitoring, and EU database registration apply.

When voice AI becomes high-risk: Annex III triggers

Annex III lists eight high-risk use case families. Four of them are routinely triggered by voice AI deployments. Read each one literally — the language is the test, not the marketing.

Roles: provider, deployer, distributor

The Act distinguishes three roles. The vendor that develops and places the voice AI platform on the market is the provider. The enterprise that uses it under its own authority is the deployer. The reseller or system integrator that supplies it without modification is the distributor.

Most obligations sit with the provider — conformity assessment, technical documentation, EU database registration. Deployer obligations are narrower but real: human oversight, monitoring use against the provider's instructions, logging, transparency to affected persons, and (for high-risk systems serving public functions or essential services) a fundamental rights impact assessment.

A deployer that substantially modifies a high-risk system — for example, by replacing the underlying LLM with one not covered by the original conformity assessment — becomes a provider in its own right for that modified system. This is the trap most often missed in build-on-platform deployments.

Limited-risk: the transparency duty in practice

For limited-risk deployments, the obligation under Article 50 is to inform the natural person that they are interacting with an AI system, at the start of the interaction, in a clear and distinguishable manner.

What this means in the call: a disclosure within the first turn ('You're speaking with an automated assistant') that is unambiguous and not buried in legal text. A voice that introduces itself by name without disclosing its nature does not meet the duty. A disclosure offered only on request does not meet the duty. The disclosure is owed to the caller, not to the deployer's legal team.

Documentation: what each tier requires

Limited-risk deployments need: a transparency disclosure record, a basic data-protection assessment that overlaps with the GDPR DPIA, and a description of the use case kept on file.

High-risk deployments need: the provider's technical documentation under Annex IV (supplied to the deployer), a risk management system, data and data governance documentation, human oversight design, accuracy and robustness evidence, logging that supports post-market monitoring, and — for deployers in scope of Article 27 — a fundamental rights impact assessment before first use.

• Transparency disclosure record (limited-risk and above)
• DPIA / FRIA alignment under UK/EU GDPR (all tiers)
• Provider technical documentation under Annex IV (high-risk)
• Human oversight design with documented authority to intervene (high-risk)
• Logging and post-market monitoring plan (high-risk)
• EU database registration where the deployer is in scope (high-risk public-function deployments)

Timelines and enforcement

The Act's obligations phase in. Prohibitions applied from February 2025; general-purpose AI obligations from August 2025; high-risk obligations under Annex III apply from August 2026, with the harmonised-standards regime for high-risk products applying from August 2027.

Enforcement is by national competent authorities, with fines up to 7% of global turnover for prohibited-practice breaches, 3% for most other obligations, and 1.5% for supplying incorrect information to authorities. The fine exposure is meaningful; the reputational exposure is larger.