The question about AI in customer contact almost always arrives as a labelling question. Do we have to write somewhere that a machine is answering here? What people mean is the assistant that has been drafting replies in the customer mailbox for a few weeks, or the window in the bottom right of the website that now answers on its own.
The answer is yes, and it costs you one sentence on the page and one line in the mail footer. What gets expensive is the duty sitting right next to it in the law: if a machine decides about a customer, that customer can demand that a human review the decision. And that human has to exist before the request arrives.
The whole effort sits between these two duties: one is copywriting, the other is an assigned responsibility.
Does AI in customer contact have to be labelled?
Your customers have a right to know that they are corresponding with a machine. An explicit labelling duty under Article 21 of the Data Protection Act, by contrast, applies only to federal bodies. For your company the disclosure follows from transparency, not from a labelling rule. In practice that means: write it down, where the conversation starts.
The Federal Data Protection Commissioner put this on record on 8 May 2025. The Data Protection Act is formulated in a technology-neutral way, he writes, and is therefore directly applicable to the use of AI-supported data processing. Manufacturers, providers and users of AI systems have to make the purpose, the way it works and the data sources of AI-based processing transparent. And in the case of language models that communicate directly with users, those users have a legal right to know whether they are speaking or corresponding with a machine, and whether the data they enter is processed further to improve the self-learning programs or for other purposes.
In our experience this is what gets asked about first, and this part is done in two sentences. One says that an assistant is answering here. The other says what happens to what the customer writes.
In the text of the law itself, labelling sits in a narrower place. Article 21 paragraph 4 of the Data Protection Act requires that where the automated individual decision is taken by a federal body, that body must mark the decision accordingly. A federal body. Not your company.
That shifts the work rather than removing it. You owe the disclosure to transparency and you discharge it with one sentence. The duty with operational consequences sits three paragraphs further up.
The two paragraphs that cost you operations
Article 21 of the Data Protection Act starts by requiring the controller to inform the data subject about a decision that is based exclusively on automated processing and that has a legal consequence for them or significantly affects them. The second paragraph then gives the data subject the opportunity, on request, to state their position, and lets them demand that the automated individual decision be reviewed by a natural person.
Translated plainly: if a machine in your customer channel decides something on its own that legally counts for the customer or significantly affects them, you have to inform them about it. And if they ask afterwards, a human has to look at the decision again.
Three conditions hang on this, and all three are narrow. The processing has to run exclusively automatically, so with no human in between. It has to carry a legal consequence or significantly affect the customer, which is not the case for an information request. And the customer triggers the right to a review themselves, you do not have to offer it unprompted.
The third paragraph even carves out cases: where the decision relates directly to a contract between you and the customer and their request is granted, or where they have expressly consented. Saying yes is easier than saying no. That is legally clean and a useful rule of thumb in daily work.
Three levels, and only one triggers the duty
What AI in customer contact means for you depends on what the assistant actually does in the channel. In practice there are three levels.
On the first it suggests an answer to an employee, and that employee sends it. There is a human in the process, so there is no exclusively automated processing. What counts here is general transparency and the question of which customer data flows where.
On the second it answers on its own but decides nothing. Opening hours, delivery status, where to find a form. Article 21 does not apply here either, because no legal consequence arises. You should still disclose it, because the customer has a right to know.
On the third it decides. It rejects an application, refuses a credit note, assigns a condition or closes an enquiry as unjustified. This is the territory of the automated individual decision, and this is where you need the person from paragraph 2.
In our experience companies place themselves one level below where they technically stand. That has to do with how the jump to the third level happens.
The jump to level three happens without a decision
Hardly anyone sits down and resolves to automate a customer decision. The jump happens as a side effect of an integration.
The assistant started as a writing tool. Then somebody connected it to the ticket system so it could look up a status. During setup, read and write permissions came in the same package, and since then it can also close a ticket. Or somebody connected it to the shop, and since then it may confirm and reject a return, not only check one.
Technically that is a checkbox. Legally it is the switch from providing information to taking a decision. Inside the company the switch rarely gets noticed, because it appears in no log as a decision.
So the question that gets you somewhere with a tool in the customer channel is this: what may it change without asking? We have described how to test that in our post on how deep the review of AI tools has to go. And which assistants are already running in your company is something an AI inventory clarifies, and in many companies it gets longer than expected.
The person who reviews exists before the request or not at all
The right in paragraph 2 looks harmless because it only applies on request. But the preparation for it cannot be made up once the request is there.
Three things belong to this review. The responsible party is a person with a name, not a department. That person needs sight of what the assistant answered the customer, and of the information that answer was based on. And they need the authority to change the outcome, because a review that cannot overturn anything is not one.
Sight is the point that is missing, in our experience, and it only shows up when it matters. Without retained conversations, nobody can say afterwards what was promised to the customer. The logging for this usually already sits in the admin console of the system you are paying for anyway. It is rarely switched on, and even more rarely does anybody know how long it retains.
On responsibility, the uncomfortable version of the question is worth asking. Who does this when that person is away for two weeks? A responsibility that hangs on a single person is not one during holiday season.
If you have customers in the EU
Then a second layer comes in. The EU AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, and the transparency rules belong to that step.
Article 50 addresses providers first: "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system." So the duty hangs on building and making available, not on using.
For a Swiss SME buying a finished product, that means the design duty sits with the provider, and your lever for it is the contract. If your company instead ships an assistant to customers under its own name, look more closely at which role you take on under this regulation. We have placed the Swiss situation next to it in our post on AI law in Switzerland, and the framework of the regulation itself in our post on the EU AI Act.
What you do not need for this
This exercise needs no platform. The disclosure is a sentence, not a product.
It needs no legal opinion on the labelling question either, because the answer sits in two paragraphs of the same article. And in most cases it needs no additional logging tool, because the function is already in the licence you hold. Spending money here often buys documentation of what you already have. We have put together the basics of the Data Protection Act in our post on the revised Swiss data protection law.
The only thing that costs is the unspectacular part: naming someone, giving that person access, switching retention on and walking through the three levels once per channel. That is exactly where our mandates for AI governance and safe AI adoption start. None of it is hard. The task sits between marketing, IT and customer service, and in that gap it stays undone.
Who is answering in your name right now
Take the channel with the most customer traffic and check three things: whether it says there that an assistant is involved, whether it can confirm or reject something without a human agreeing, and whether there is a person with a name who may overturn such an outcome.
The first is copywriting. The last decides whether you can explain a case when it matters, or only guess at it.
Which decisions does your customer channel already take today without asking?
If you have no clear answer to that, it usually comes down to an open question of responsibility rather than to technology. We are happy to talk it through in an informal first conversation.
Frequently asked questions
Do I have to label it when an AI answers in customer contact?
Your customers have a right to know that they are corresponding with a machine, so a note belongs where the conversation starts. The explicit labelling duty in Article 21 paragraph 4 of the Swiss Data Protection Act, by contrast, applies to federal bodies and not to your company.
When is an AI answer an automated individual decision?
When two things come together: the processing runs exclusively automatically, with no human in between, and the outcome carries a legal consequence for the customer or significantly affects them. Information about opening hours or delivery status does not count, a refused credit note does.
Who has to be able to review an AI decision?
A named natural person, not a department. Under Article 21 paragraph 2 of the Swiss Data Protection Act the customer can demand that this person review the decision. They need sight of what the assistant answered and the authority to change the outcome, and they must be named before the first request.
