The EU AI Act stopped being a future problem on August 2, 2026 — the day its transparency obligations for AI systems that interact with people became enforceable. If your AI voice agent answers calls, or your chatbot carries on conversations with customers, and any of those customers are in the EU, Article 50 applies to you: the person must be informed they are interacting with an AI, and AI-generated content must be marked as such. This post lays out what that actually means for communications platforms and their customers, which parts Orbit ships as tenant-configured controls, and a checklist with the three worked configurations a CPaaS deployer needs in place.
This is an engineering read, not legal advice. Which obligations apply to your traffic depends on your deployment; confirm with qualified counsel. What you can confirm here, concretely, is which controls exist and where they live.
What the EU AI Act actually changes for voice and AI-agent comms
The Act regulates AI systems by risk tier, but for a CPaaS buyer the operative tier is the transparency tier. Article 50 puts two duties on deployers of AI systems that interact with humans:
- Disclose the AI. A person must be informed that they are interacting with an AI system, unless that is obvious from the context. A customer chat whose first reply reads like a human wrote it, and a voice agent that introduces itself the way a human agent would, are the two cases regulators point at — "obvious from context" is a high bar, not a default.
- Mark AI-generated content. AI-generated or synthetically-modified audio, image, video, and text must be marked as machine-generated in a machine-readable way. For a voice platform this is the generated TTS audio of an AI voice agent; for chat and messaging it is the agent's outgoing text.
Two qualifications matter for the way you scope the work:
- You are the deployer. The transparency duty lands on whoever deploys the AI system in front of people — on a communications platform, that is the tenant running the agent, i.e. you, not your CPaaS vendor. The vendor's job is to give you the controls; turning them on is yours.
- Article 50 is not the high-risk tier. The guillotine-shaped obligations (Annex III high-risk systems with conformity assessments) are a separate, later-timeline tier. A support or outbound voice agent is usually a transparency-tier system, not an Annex III one — but that classification is your counsel's call, not your vendor's.
The penalty backdrop is not theoretical: the Act's fines run into the tens of millions of euros or a percentage of global turnover, and Article 50 sits inside that enforcement frame.
How this maps to Devotel Orbit
Orbit ships a tenant-scoped AI-disclosure surface designed for exactly this shape of obligation, documented in EU AI Act Article 50 transparency for AI agents. The frame to hold: these are tenant-owned controls — the platform supplies the surface and the evidence, the tenant assembles the posture. The compliance posture overview states the model explicitly: controls are tenant-owned, everything relevant defaults open, and the platform enforces what you set rather than picking a posture for you.
On that surface, the controls a tenant actually turns, specifically:
- Voice intro — a configurable spoken announcement ("This call is being handled by an AI agent…") played before an AI voice agent begins a call. Set the text, or supply a pre-recorded audio URL. Per the EU AI Act docs page, the voice intro is off by default; a tenant operator enables the rules that apply to their traffic.
- Chat notice — a configurable notice prepended to an AI agent's first reply in a conversation, sent once per conversation.
- AI-generated content marking — agent-sent messages are stamped with
metadata.ai_generated: true, and recorded calls with AI involvement carry Article 50 provenance metadata on the archived recording.
The disclosure surface is deliberately jurisdiction-rulable: one settings area drives the same behavior for the EU AI Act, Korea's AI Basic Act, California SB 243, and the Utah AI Policy Act, so an operator with mixed traffic turns on the union of rules rather than maintaining four mechanisms.
Two Orbit properties carry the compliance story end to end:
- Suppression and consent enforcement. The disclosure goes out in-band on the conversation, and the suppression layer — the mechanism that stops outreach to a contact who withdrew consent — is what the GDPR posture guide maps to the withdrawal duty. Opt-outs, STOP keywords, and the preference center all write into one per-channel suppression list that every send reads, so the transparency signal and the consent state are enforced by the same send gates.
- One-click evidence export. The conformity dossier compiles a per-agent evidence pack — transparency configuration, evaluation results, oversight approvals, decision audit log — mapped to Articles 12, 14, 15, and 50. And the evidence binder assembles the wider compliance data your workspace already produces into a signed, download-ready pack for an auditor or a buyer's procurement team. The binder reflects what you configured; an empty posture exports as an empty binder.
None of this asserts compliance on your behalf — it is a control surface plus an evidence trail. The legal determination is yours.
Timeline and enforcement milestones for 2026
The Act entered into force on August 1, 2024 and phases in rather than flipping on at once:
- February 2, 2025 — prohibited AI practices became enforceable (these do not touch a standard customer-facing voice agent, but the date is in the timeline).
- August 2, 2025 — general-purpose AI model obligations applied (a concern for model providers, not for deployers on a CPaaS).
- August 2, 2026 — the transparency obligations of Article 50 became enforceable, alongside most of the Annex III high-risk regime. For deployers of human-interacting AI systems, this is the date that changed 2026 compliance work from preparation to operation.
- Post-2026 — the remaining staged deadlines run out to 2027, mainly for high-risk systems embedded in regulated products.
If you run AI voice agents or chat agents touching EU contacts today, the discrepancy you must close is the current one: disclosure active, marking on, evidence retrievable.
A deployer checklist for CPaaS deployers — with worked configurations
Work through these four in order. Each maps to a shipped Orbit control.
1. Voice agent announcement flow
For an AI voice agent, the disclosure is a spoken statement at call start. In Orbit's flow builder you build that as a voice workflow: a Make Call action to originate or connect, a spoken introduction before the agent engages, then a Run Agent node that hands the conversation to the AI agent. The announcement belongs before the Run Agent node — the person hears it before the agent says anything, which is what "at call start" means operationally. The voice intro setting on the AI-disclosure surface is the same statement at the agent layer: it plays before the agent begins, on every call, with your configurable text or your pre-recorded audio.
2. Recording consent flag
Disclosure and recording consent are different duties and travel together. While Article 50 covers "this is an AI," recording law covers "this call is being recorded." Orbit's recording consent model is two-axis and per-organization: the eligibility_mode axis decides which calls are captured (manual, inbound_only, outbound_only, all_calls), and the consent_announcement_mode axis decides how participants are notified (none, announce_caller, announce_all). For EU-facing traffic where two-party consent applies, the pairing is an auto-record eligibility with announce_all — the platform explicitly warns the operator when auto-recording runs with none, because the announcement is missing. Set it under Voice → Calls → Recording settings.
3. Evidence binder export
When a regulator, enterprise buyer, or procurement security review asks "show me your AI-disclosure posture," you need an artifact, not a description. The evidence binder generates exactly that: pick GDPR as the framework, generate, and download the signed pack (rendered PDF, or a ZIP of per-control files for a GRC import). The pack is assembled from what your workspace already produced — audit logs, consent records, retention settings, DSAR history — and the download is a signed link valid for 24 hours. Every generation is audit-logged, and only the workspace's owner or admin roles can run it. Generate the binder after you assemble the posture, not before — it reports what you did.
4. Verify, then re-verify on change
Configuration drifts. A working check takes two minutes: start a new chat with your AI agent and confirm the chat notice appears on the first reply; place a test call and confirm the voice intro plays before the agent speaks; inspect one agent-sent message and confirm metadata.ai_generated is true. Run it again whenever anyone touches the bot's opening copy, the voice settings, or the recording policy.
What Orbit ships vs. what remains tenant responsibility
Drawn plainly, with no compliance mandate asserted:
Orbit ships today:
- The AI-disclosure settings surface (voice intro, chat notice, jurisdiction rules) and the enforcement that stamps agent messages and AI-involved recordings.
- The two-axis recording consent policy on every voice number.
- The suppression and consent ledger that send gates read.
- The conformity dossier and evidence binder exports, signed, with audit-logged generation.
What remains tenant responsibility:
- Deciding which obligations apply to you — whether your agent is a transparency-tier system, whether your recording consent posture meets the jurisdictions you call.
- Turning the controls on for the workspace, and writing disclosure copy specific enough to inform — a vague notice is the tenant's gap, not the platform's.
- Assembling the posture before exporting the binder.
- The legal determination itself. Nothing on this page, and nothing in the posture overview, is a compliance claim on your traffic — the controls are the surface, the determination is yours.
Frequently asked questions
Does the EU AI Act apply to my AI voice agent?
Yes if the agent interacts with people in the EU. Article 50 applies to deployers of AI systems that interact with humans, wherever the deployer is based, and the obligation has been enforceable since August 2, 2026. The two duties are disclosure (the person is informed they are interacting with an AI) and AI-generated content marking (the output is machine-readably identified as generated by an AI).
Who is responsible for Article 50 compliance — Orbit or my organization?
Your organization. The Act places the transparency obligation on the deployer of the AI system — the tenant operating the agent — not on the communications platform it runs on. Orbit's role is to ship the control surface (voice intro, chat notice, content marking, evidence exports) and enforce what you configure; enabling the controls and making the legal determination are the tenant's work.
Is my customer-support voice agent a "high-risk" system under the Act?
Usually not. The transparency tier of Article 50 and the high-risk tier of Annex III are different regimes. A support, reception, or outbound voice agent typically falls under the transparency obligations, not the high-risk conformity regime — but the classification depends on your use case and is a call for your counsel, not your vendor.
What disclosure do EU-facing AI interactions need, concretely?
Two operational pieces. At interaction start, the person is told they are dealing with an AI — on Orbit that is the configurable voice intro played before an AI voice agent begins, and the chat notice prepended to an AI chat agent's first reply. In the data, AI output carries marking — Orbit stamps agent-sent messages with metadata.ai_generated: true and attaches Article 50 provenance metadata to AI-involved recordings. Both are tenant-configured, never silently on.
How do I prove my disclosure configuration to an auditor or buyer?
Export the evidence. Orbit's conformity dossier compiles a per-agent pack — transparency settings, evaluation results, oversight approvals, decision audit log — mapped to Articles 12, 14, 15, and 50. The evidence binder assembles the broader GDPR framework evidence into a signed download. Generate after configuring; the exports reflect your posture as built.
Does the AI-disclosure setting also cover recording-consent obligations?
No — they are separate duties on separate surfaces. The AI disclosure (voice intro, chat notice, marking) answers Article 50's "this is an AI" duty; recording consent answers call-recording law's "this call is being recorded" duty, and is configured separately under the recording settings for your voice numbers. Configure both; neither substitutes for the other.
The full AI-disclosure configuration surface, including the jurisdiction-rule table and the per-agent exports, is documented in EU AI Act Article 50 transparency for AI agents. If you have a requirement that page doesn't cover, contact trust@devotel.io.