Do I have to warn customers that an AI is replying?

Yes. Under the EU AI Act's transparency rule (Article 50), which applies from 2 August 2026, a person must understand they're talking to AI. One line at the start of the chat is enough. Saying it openly also builds trust.

Where is my customers' data stored?

If the agent is built properly, on servers in the EU. Data travels over secure channels, and only people who need it for their work can access it. That's a GDPR requirement, so ask your vendor about it separately.

What are the fines for getting it wrong?

GDPR allows up to €20M or 4% of global turnover, whichever is higher; breaking the AI Act's transparency rules can reach €15M or 3% of turnover, again whichever is higher. In Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon) supervises. For a small business, customer trust usually matters more than the size of the fine. But you have to follow the rules either way.

Does my agent count as 'high-risk'?

Almost certainly not. An agent that answers questions and books clients is a limited-risk system. 'High-risk' means AI for hiring, credit checks, medicine and similar tasks. For an ordinary agent, the main duty is to tell customers they are talking to an AI.

AI agents, GDPR & the EU AI Act: is your data safe? (2026)

Before launching an AI agent, owners most often ask us: 'Is it even legal to let a bot near my customers' data?' Yes, if the agent is built right. Below we explain in plain words what that takes.

In 2026 two EU laws apply to an AI agent: GDPR (how you handle customers' personal data) and the new EU AI Act (how you use artificial intelligence). Here is what they mean for a small company in Tallinn and what you need to do.

Two laws, not one

GDPR has applied across the EU since 2018. It sets out what you may do with personal data. A name, a phone number, a chat history, a booking record — all of it is personal data, whether a person or an AI agent handles it. The rules are the same: you need a lawful reason, you collect only what you need, you keep the data safe, and the customer has the right to know what happens to it.

The EU AI Act is the newer law. It entered into force in August 2024, and its requirements start to apply one after another. It deals with how risky the AI itself is and what you must tell your customers. One law does not replace the other, so your agent has to meet both.

Good news: your agent almost certainly isn't 'high-risk'

The EU AI Act sorts AI systems by level of risk. 'High-risk' means, for example, AI that picks job candidates, checks creditworthiness or makes a medical diagnosis. Such systems face many requirements. An ordinary agent that answers customers' questions, clarifies a request and books an appointment is not one of them: it is a 'limited-risk' system. It becomes 'high-risk' only if it starts deciding by itself whom to hire, who gets credit or how to treat a patient.

For limited-risk systems the main duty is this: a person must understand they are talking to an AI, not to a member of staff. On the European Commission's current timeline, this transparency rule (Article 50 of the AI Act) applies from 2 August 2026. In practice, it is enough for the agent to say it is an AI in one line at the start of the chat.

What GDPR asks of the agent

GDPR is older and stricter than the AI Act, and it's the part you follow every day:

A lawful basis. You need a reason to process the data — the customer's consent, performing a contract, or your legitimate interest. For taking a booking or answering a request, you usually already have that reason.
Data minimisation. The agent should see only what the task needs. A booking assistant has no reason to reach your whole accounting system.
Transparency. The customer has the right to know that an AI is replying and what happens to their data. A short note in the chat and in your privacy policy is enough.
Security and EU processing. Data travels over secure channels, access to it is tightly controlled, and it is processed on servers in the EU where possible.
A route to a human. The customer can always ask for a real person. A good agent can pass the chat to a person from day one.

A legal-AI-agent checklist

Before launch, check these points. They cover most of what GDPR and the AI Act require:

The agent introduces itself as AI in its first message.
The agent sees only the data its tasks need.
The agent hands complex and sensitive cases to a person, along with the conversation so far.
Data is processed and stored on servers in the EU.
You've signed a data processing agreement (DPA) with your AI vendor.
Your privacy policy says what data the agent sees and why.

What a legal agent does with one enquiry

Take a real-estate agency. An enquiry comes in at 23:40. The agent replies straight away, says it is an AI, asks two or three questions to clarify the request and offers a time for a viewing. In the customer database (CRM) it sees only what it needs to reply and book. Tricky cases go to a manager along with the conversation so far.

This one short chat already shows three points from the checklist: the agent says it is an AI in the first line, uses only the data it needs, and a person is one click away. Before launch, decide how you will judge whether the agent helps: for example, how many enquiries got a reply outside office hours, or how many chats ended without a manager. Once the agent is live, count it yourself. The limited access GDPR requires also lowers the risk of mistakes and data leaks.

What to ask a vendor before you start

If someone is building your AI agent, these questions help you spot a vendor who isn't serious:

Where is customer data physically processed and stored?
Which data will the agent be able to see, and who controls that?
How will the customer know it's an AI, and how do they reach a human?
Will you sign a data processing agreement (DPA)?
What happens to the conversation data after the chat ends?

Frequently asked questions

Do I have to warn customers that an AI is replying?: Yes. Under the EU AI Act's transparency rule (Article 50), which applies from 2 August 2026, a person must understand they're talking to AI. One line at the start of the chat is enough. Saying it openly also builds trust.
Where is my customers' data stored?: If the agent is built properly, on servers in the EU. Data travels over secure channels, and only people who need it for their work can access it. That's a GDPR requirement, so ask your vendor about it separately.
What are the fines for getting it wrong?: GDPR allows up to €20M or 4% of global turnover, whichever is higher; breaking the AI Act's transparency rules can reach €15M or 3% of turnover, again whichever is higher. In Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon) supervises. For a small business, customer trust usually matters more than the size of the fine. But you have to follow the rules either way.
Does my agent count as 'high-risk'?: Almost certainly not. An agent that answers questions and books clients is a limited-risk system. 'High-risk' means AI for hiring, credit checks, medicine and similar tasks. For an ordinary agent, the main duty is to tell customers they are talking to an AI.