The EU AI Act hits voice: what August 2026 means for conversational AI

The dates on the statute book

The AI Act did not land in one piece. It arrives in tranches, and the tranche that matters most to anyone running conversational AI is the one dated the 2nd of August 2026: Annex III high-risk obligations and the Article 50 transparency duties both start to apply on the same day.

There is a live conversation in Brussels about softening that timetable: the Commission's digital omnibus package floated tying the Annex III start date to the readiness of harmonised standards. Until something amends the Regulation, the 2nd of August 2026 is the date that exists in law. And a delay would buy you documentation time, not architectural time: the logging, oversight and traceability requirements are design decisions, and they are considerably more expensive to retrofit than to build.

Every voice agent is caught by one article

Before the high-risk question, there is a duty that applies to essentially every conversational AI system operating in the EU market regardless of what it does. Article 50 is short, and it is the one most voice deployments will be measured against.

• Tell people they are talking to a machine. Article 50(1) requires that natural persons interacting with an AI system are informed of that fact, unless it is obvious to a reasonably well-informed person in the circumstances. In voice, "obvious" is a shrinking defence; the entire industry has spent two years making agents that do not sound synthetic. If your disclosure strategy is "they'll be able to tell", you are betting compliance on your own product being bad.
• Mark synthetic audio.Article 50(2) and 50(4) cover machine-readable marking of AI-generated content and disclosure of deepfakes. Cloned or synthesised voice output is squarely in scope.
• Notify emotion recognition.Article 50(3) requires deployers of emotion recognition and biometric categorisation systems to inform the people exposed to them. Any voice stack inferring sentiment, stress or frustration from acoustic signal needs to answer this.
• AI literacy, already in force.Article 4 has applied since February 2025 and lands on both providers and deployers: the people operating your voice agents need a sufficient level of AI literacy for the context in which they are used. It is the cheapest obligation in the Act and the most commonly ignored.

Four things nobody may build

Article 5 has been in force since February 2025, carries the heaviest penalties in the Act, and contains prohibitions that are uncomfortably close to patterns the voice industry has been experimenting with.

• Manipulative or deceptive technique.Article 5(1)(a) prohibits subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause significant harm. Persuasion architecture in an outbound sales agent is exactly the territory this was drafted for.
• Exploiting vulnerability.Article 5(1)(b) prohibits exploiting vulnerabilities arising from age, disability or a specific social or economic situation. Vulnerability detection is a regulatory expectation in UK financial services. Using that same signal to press harder rather than to route more carefully is prohibited, not merely frowned upon.
• Emotion inference at work or in education. Article 5(1)(f) prohibits inferring emotions of natural persons in the workplace and in education institutions, outside narrow medical and safety grounds. Agent-sentiment scoring pointed at your own staff is the obvious exposure here.
• Biometric categorisation by protected attribute. Article 5(1)(g) prohibits inferring race, political opinion, trade union membership, religious belief, sex life or sexual orientation from biometric data. Accent and voiceprint are biometric data.

Breach of Article 5 attracts fines up to €35 million or 7% of total worldwide annual turnover, whichever is higher. No other provision in the Act reaches that ceiling.

Where the high-risk line actually falls

High-risk is not a judgement call about how important your use case feels. It is a list. Annex III enumerates eight areas, and a conversational AI system is high-risk when its intended purpose falls inside one of them. Five of the eight are directly relevant to voice: biometrics, critical infrastructure, education, employment, and access to essential private and public services.

The useful mental model is this: the Act does not care that a conversation happened. It cares whether an automated system influenced a consequential decision about a person.

Read down that table and a pattern emerges that surprises most buyers: the same organisation frequently runs both tiers. A health trust booking appointments by voice is in limited risk; the same trust triaging symptoms is high-risk. An insurer capturing a motor claim is in limited risk; the same insurer pricing life cover is high-risk. Compliance is scoped per system and per intended purpose, not per company.

The verification carve-out buyers keep getting wrong

Voice biometrics is where the misreadings cluster. Annex III point 1(a) makes remote biometric identification systems high-risk, and then explicitly carves out systems used for biometric verification whose sole purpose is to confirm that a person is who they claim to be.

That distinction is worth money. A voiceprint check against the single account the caller has already identified is one-to-one verification and sits outside the high-risk list. Searching a caller's voice against a database of enrolled or watch-listed voices to work out who they are is one-to-many identification, and is high-risk. The functionality looks nearly identical in a demo. The regulatory consequence differs by an entire conformity assessment.

The escape hatch in Article 6(3), and its trapdoor

A system whose purpose falls inside Annex III is not automatically high-risk. Article 6(3) allows a provider to conclude otherwise where the system does not pose a significant risk of harm to health, safety or fundamental rights (including because it does not materially influence the outcome of decision-making) and one of four conditions holds: it performs a narrow procedural task, it improves the result of a previously completed human activity, it detects patterns or deviations without replacing human assessment, or it performs a preparatory task to an assessment.

Most well-designed voice agents in high-risk sectors are aiming for that space: capture the facts, verify the details, prepare the file, and hand a human the decision. The trapdoor is the last sentence of the provision. If the system performs profiling of natural persons, it is high-risk regardless. And the derogation is not free: the assessment must be documented before the system goes to market, and the system must still be registered in the EU database. It is a paperwork route, not a silence route.

What high-risk actually costs you

If a voice deployment lands in high-risk, Chapter III turns a product into a regulated product. In practice, for a voice agent, the obligations read as follows.

Before it goes live

• Risk management system (Article 9).A continuous, documented process across the lifecycle, not a one-off risk register signed at launch.
• Data governance (Article 10).Training, validation and testing data examined for bias and representativeness. For voice this means accent, dialect, age and speech-difference coverage, which is precisely where most ASR stacks underperform quietly.
• Technical documentation (Article 11, Annex IV). System architecture, model provenance, intended purpose, known limitations, performance metrics.
• Instructions for use (Article 13).The deployer-facing transparency pack. If you are buying, this is the artefact that determines whether you can meet your own obligations.
• Accuracy, robustness and cybersecurity (Article 15). Declared accuracy metrics that hold under production conditions. For UK voice this collides with narrowband telephony, which we have written about separately. A model benchmarked on wideband audio and deployed over a 3.4 kHz channel is not performing at its declared level.
• Quality management, conformity assessment, CE marking and registration (Articles 17, 43, 47–49).The declared conformity route, the EU declaration, the CE mark and the entry in the EU database.

Once it is live

• Logging (Article 12).Automatic recording of events over the system's lifetime, sufficient to trace how a given outcome was produced. On a voice agent this is not the call recording; it is the retrieval decisions, tool calls, policy evaluations and model versions behind each turn.
• Human oversight (Article 14).Designed-in capability for a person to understand, intervene, override and stop. Barge-in and escalation to an agent are the visible layer; the harder requirement is that the human has enough context to actually change the outcome.
• Post-market monitoring (Article 72).A plan for collecting and analysing real-world performance, feeding back into the risk management system.
• Serious incident reporting (Article 73). Notification to the market surveillance authority immediately and no later than 15 days after becoming aware: 10 days where a death is involved, 2 days for widespread infringement or serious disruption to critical infrastructure. Fifteen days is not long if you cannot reconstruct what your agent said and why.

The role trap: how a buyer becomes a provider

The Act's obligations divide by role. Providers carry the bulk of Chapter III. Deployers carry a shorter but real list under Articles 26 and 27: operate the system per its instructions, assign competent human oversight, ensure input data is relevant, keep the automatically generated logs for at least six months, and (where you are an employer) inform workers' representatives and affected workers before putting a high-risk system to work in the workplace. Public bodies, private operators delivering public services, and deployers doing creditworthiness or life and health insurance pricing additionally owe a fundamental rights impact assessment.

Article 25 is the provision that catches enterprise buyers off guard. A deployer becomes a provider (inheriting the full provider obligation set) if it puts its own name or trademark on a high-risk system, makes a substantial modification to it, or modifies the intended purpose of a system such that it becomes high-risk.

Consider how ordinary each of those is in a voice programme. You white-label the agent under your brand. You rewrite the system prompt, add tools, wire in your own retrieval and change the decision logic. You take an agent procured for appointment booking and point it at symptom triage. Every one of those is a live Article 25 question, and the answer determines whether your vendor's conformity work covers you or whether you have quietly taken it on yourself.

The model underneath your agent

Voice agents are assembled, not monolithic: an ASR model, one or more language models, a TTS voice, and an orchestration layer. General-purpose AI model obligations have applied since August 2025, which means the model providers beneath you owe technical documentation, downstream information, a copyright policy and a training-data summary; and, where a model is deemed to carry systemic risk, evaluation, adversarial testing, incident reporting and cybersecurity duties on top.

That matters to you for a practical reason. Your Annex IV documentation and your Article 15 accuracy claims depend on information you do not generate. If your voice vendor cannot tell you which model versions served which calls, you cannot make a defensible accuracy declaration, and you cannot answer a regulator asking why a specific answer was given on a specific call. Model pinning and version disclosure stopped being an engineering preference and became a compliance dependency.

If you are a UK business, you are probably still in scope

The UK has no equivalent statute. That is not the relief it is sometimes read as. Article 2 gives the Act extraterritorial reach: it applies to providers placing AI systems on the EU market or putting them into service in the EU regardless of where they are established, and to providers and deployers established outside the EU where the output produced by the system is used in the EU.

A UK voice AI vendor with an Irish, Dutch or German customer is a provider under the Act. A UK enterprise running one estate that handles calls from EU customers is in scope for that estate. And in practice the commercial pressure arrives before the legal one: EU-facing procurement teams are already asking for Annex IV documentation, and UK regulators (the FCA's Consumer Duty work in particular) are converging on the same evidence, if not the same paperwork.

What to put in your next RFP

If you are buying conversational AI this year, six asks separate vendors who have done the work from vendors who have written a paragraph about it.

1. A written classification of the specific system against Annex III, with the reasoning, and, where Article 6(3) is claimed, the documented assessment behind it.
2. The Article 13 instructions for use, in full, before contract, not a datasheet.
3. Declared accuracy metrics with the test conditions attached, including narrowband telephony performance and accent coverage.
4. A description of what Article 12 logging actually captures, how long it is retained, and whether you can reconstruct a single turn end to end on demand.
5. Model provenance and version pinning, plus notice before any model change reaches production.
6. A clear Article 25 position: which modifications the vendor considers substantial, and at what point their conformity work stops covering you.

Build for the audit, not the deadline

The AI Act is often read as a compliance cost. Read more closely, it is a specification for a voice system that an enterprise can actually defend: documented purpose, governed knowledge, declared accuracy, logged decisions, real human oversight, traceable model versions. That is the same architecture we argued for in Beyond RAG, and the same posture that decides the true cost of a wrong answer in hallucination economics.

Buyers who treat the 2nd of August as a paperwork date will spend the autumn retrofitting logging into a stack that was never designed to be reconstructed. Buyers who treat it as an architecture date will find the paperwork mostly writes itself.