Voice assistants must disclose they are AI and can be used as generative models. Voice-cloning and synthetic-voice tools face deepfake disclosure rules. Sensitive biometric authentication raises the risk tier considerably.
The EU AI Act reaches any company whose AI output is used in the European Union — regardless of where the company is based. If your product has EU users or clients, the rules apply to you. The first question is always the same: which risk tier does your system fall into, and what duties come with that tier?
The Act sorts AI into four tiers: prohibited (banned outright), high-risk (heavy duties), limited-risk (transparency only), and minimal-risk (no mandatory duties). Most software starts in limited or minimal risk. The expensive surprises live in high-risk and prohibited — which is exactly why scanning early matters.
Article 50(1) requires systems that interact with people to disclose they are machine-based. A voice assistant that picks up a phone call, greets a customer, or answers a support ticket must openly state it is not human before or at the start of the interaction. Saying nothing because it is 'obvious from context' only applies when no reasonable person could be fooled — which, for natural synthetic voices, is rarely true.
Synthetic-voice and clone tools output content that resembles a real person, so they sit in the deepfake regime: machine-readable marking built in by the provider, disclosure by whoever publishes. If the clone is used for identity or authentication (banking, contact centres), you add biometric obligations and, depending on use, a high-risk classification under Annex III.
AI that infers a person's emotions in workplaces and educational institutions has been a prohibited practice since February 2025. Call-centre 'sentiment scoring' can drift into this if it claims to detect emotional state — separate customer-satisfaction signals are safer than emotion labels.
See your score in 2 minutes. No signup, no code stored.
Scan Your Codebase NowYes. The disclosure must happen at the start of the interaction, so your call-flow needs a line like 'You are speaking with an AI assistant' before any conversation.
The technology is legal; the output is what is regulated. Cloning requires consent, machine-readable marking, and disclosure — and is banned outright for non-consensual intimate imagery from December 2026.
When it makes access decisions (banking, recruitment, public services) or performs biometric identification of individuals. Otherwise it usually stays limited-risk.