Customer support, chat and CRM platforms

• Regulation (EU) 2016/679 — GDPR, Article 27
• Directive 2002/58/EC for call recording and cookies
• Regulation (EU) 2024/1689 — AI Act transparency and emotion recognition
• Regulation (EU) 2022/2065 — DSA where content is hosted

Who has to appoint one

Providers outside the Union supplying support, chat or CRM software used to communicate with people in the EU. The customer is normally the controller and the vendor a processor, but call recordings used to improve the vendor's models make the vendor a controller for that purpose.

Thresholds and exemptions

No threshold. Call recording is regulated additionally under national law, and several member states require both parties' consent.

What must appear on the label

Not physical. The representative in the privacy notice, disclosure that a chatbot is an AI system where users interact with one, and call recording notices before recording begins.

Marketplace fields

EU enterprise buyers require processing terms, subprocessor lists and transfer documentation. Vendors using customer conversations to train models without a separate basis have lost deals and faced regulatory attention.

Documentation you must hold

Article 30 records, Article 28 terms, the Article 27 designation, retention schedules for transcripts and recordings, the transfer mechanism, and where AI features exist, the transparency documentation required by the AI Act. Emotion analysis in the workplace context needs particular care.

Standards and testing

Not applicable, though where sentiment or emotion inference is offered, accuracy and lawfulness must both be examined before the feature is sold in the Union.

Language requirements

Notices and consent flows in the language of the end users.

When it applies

The representative before processing begins. AI transparency obligations apply from 2 August 2026, and the prohibition on emotion inference in workplaces applied from February 2025.

How long records are kept

Transcripts and recordings for a defined, justified period. Retaining conversations indefinitely for model training without a separate basis is the recurring compliance failure.

What happens if you do not comply

Up to €20 million or 4% of turnover, plus national penalties for unlawful call recording, which in several member states is a criminal matter rather than an administrative one.

Who enforces it

Data protection authorities and, for recording, national telecommunications and criminal authorities.

Where the boundary lies

Using customer conversations to train models is a distinct purpose requiring its own basis, and stating it in the processing terms does not make it lawful if the end users were never informed. Emotion recognition applied to employees is prohibited outright under the AI Act.

Questions we are asked

Can we train our models on customer conversations?

Only with a separate lawful basis and transparency to the individuals whose data it is. A clause in the customer contract does not substitute for that.

Do chatbots need to say they are AI?

Yes. The AI Act requires people to be informed they are interacting with an AI system unless it is obvious from the context.