The EU AI Act and UK GDPR for contact centres: what applies and when

The EU AI Act applies in stages, and an amending regulation published in July 2026, often called the Digital Omnibus, moved some of them. In the UK there is still no AI-specific statute: the government relies on existing regulators and law, and the most significant recent change for contact centres is the reform of automated decision-making in UK GDPR. The table sets out the dates that matter for contact centre AI, from the primary sources listed at the end of this guide.

Territorial reach matters for UK organisations. The Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU where the output of the AI system is used in the EU. A UK contact centre whose voicebot answers customers in Ireland, France or Germany should assume the relevant parts apply to it, and take advice on its role.

Article 50 of the AI Act requires AI systems that interact directly with people to be designed so that the people concerned are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant person. The information must be given at the latest at the first interaction. The duty sits formally with the provider of the system, but a contact centre that configures its own bots and voice agents controls the moment of disclosure, so in practice it should make sure the disclosure happens, clearly, at the start of every AI conversation.

In the UK there is no equivalent statutory duty, but transparency is a data protection principle, and the ICO's AI audit framework treats AI in use but not explained in privacy information as a risk. A short, plain statement at the start, with an easy route to a person, meets the EU duty, supports UK transparency and builds trust rather than eroding it.

• Say it first: before the AI asks for anything, tell the caller they are speaking to an automated assistant
• Say it plainly: avoid names or voices designed to suggest a person
• Offer a person: tell callers how to reach an agent, and make that route work
• Say it again on hand-over: tell the caller when a person joins
• Update privacy information to describe the AI, what it does and how data is used

Since February 2025 the AI Act has prohibited AI that infers the emotions of people in the workplace, except for medical or safety reasons. The Commission's guidelines on prohibited practices give a call-centre example: using voice recognition to track employees' emotions, such as anger, is prohibited. Using it only for an agent's personal training is allowed if the results are not shared with those responsible for HR and cannot affect assessment or promotion.

Customers are treated differently. The same guidelines say that using voice recognition to track customers' emotions, such as anger or impatience, is not prohibited, but that such emotion recognition systems are considered high-risk, and since August 2026 deployers must inform the people exposed to them. The guidelines also say the prohibition does not cover inferring emotions or sentiment without biometric data, such as analysing the words in a chat. So the first question for any sentiment feature is whether it works from the voice or from the words, and whom it is pointed at.

Annex III of the AI Act lists AI used to monitor and evaluate the performance and behaviour of workers, or to allocate tasks based on individual behaviour or traits, as a high-risk use. AI that scores agents' calls, ranks their performance or allocates work on the basis of their behaviour can fall within it. Under the July 2026 amendment, these high-risk rules apply from 2 December 2027, which gives contact centres time to prepare but not to postpone preparation.

Article 26 sets out what deployers of high-risk systems must do. Several of these are already good practice in a well-run contact centre, and the ICO's guidance on monitoring workers points the same way in the UK: tell workers what is monitored and why, and keep it proportionate.

1. Use the system according to the provider's instructions for use
2. Assign human oversight to people with the competence, training and authority to exercise it
3. Make sure input data is relevant to the system's purpose
4. Monitor operation, and report serious incidents
5. Keep the system's logs for at least six months
6. Inform workers' representatives and affected workers before use
7. Carry out a data protection impact assessment, using the provider's information

The Data (Use and Access) Act 2025 replaced UK GDPR's old Article 22 with Articles 22A to 22D, in force since 5 February 2026. A decision is solely automated if there is no meaningful human involvement, and significant if it has a legal or similarly significant effect. Such decisions are now generally permitted, but the controller must have safeguards that give the person information about the decision, let them make representations, let them obtain human intervention, and let them contest it. Decisions based on special category data face tighter limits.

In a contact centre this matters when AI does more than answer questions: refusing a refund, declining an application, applying a fee, or flagging an account. Design the safeguards into the journey itself, so the customer can always reach a person who can review and change the outcome. Financial services firms should also consider the FCA's Consumer Duty, which the FCA has said firms should consider when they use AI chatbots with customers. The ICO's guidance on automated decision-making was consulted on in 2026 and is expected to be finalised later this year.

AI depends on recordings and transcripts, and the ICO's guidance is clear on the basics: tell callers that calls are recorded and why, instruct agents to do the same where needed, and do not record more than is proportionate. It flags AI that analyses the emotions of people being recorded as higher risk. Recording and transcription policies written before AI arrived should be reviewed, because new uses of the same data need a lawful basis and transparent privacy information.

Outbound calling needs particular care. Under PECR regulation 19, direct marketing calls made by an automated calling system, defined as one transmitting sounds that are not live speech, require the subscriber's prior consent, and the ICO says that consent must specifically cover automated calls. In our view an AI voice agent making marketing calls is likely to fall within this rule, though no primary source yet says so expressly, so treat AI marketing calls as needing that specific consent and take advice before you start.

QVCCS builds these steps into the design of every AI journey we deliver, alongside the technical design, so compliance is part of the solution rather than a review at the end. Your legal and data protection advisers decide how the rules apply to you; this list makes sure the right questions reach them early.

1. List every AI system in your contact centre, who provides it and where its output is used
2. Decide, with advice, whether you are a provider or a deployer of each one
3. Script the AI disclosure and the route to a person for every AI journey
4. Check every sentiment and emotion feature: voice or words, agents or customers
5. Treat AI quality scoring and performance monitoring as high-risk, and prepare for December 2027
6. Map solely automated decisions and design the UK safeguards into the journey
7. Review recording, transcription and privacy information for AI uses
8. Get specific consent before any automated or AI marketing calls