AI in Customer Service: When Must a Human Take Over?

In brief: In Germany there is no general right to a human contact person; an AI agent may answer customer enquiries on its own. The law requires a human at specific points: for decisions taken solely by the machine that have legal or similarly significant effects (Article 22 GDPR), since 19 June 2026 for financial contracts with consumers concluded without meeting in person (distance contracts) where the company uses chatbots or other online tools, and from 20 November 2026 for automated contract decisions based on scores and for creditworthiness assessments involving automated processing for consumer credit other than mortgage credit (§ 37a and § 30(6) of the Federal Data Protection Act, BDSG). What the bot says counts as your own statement: on 12 May 2026 the Higher Regional Court of Hamm ordered a company to cease and desist over specialist titles its chatbot had invented, and the judgment is now final (4 UKl 3/25). And what customers write to the bot, a withdrawal for instance, can be effective even if nobody reads it; the bot should therefore recognise such statements and pass them on to a human.

Anyone who lets a chatbot, a phone assistant or a WhatsApp agent answer customer enquiries sooner or later asks whether a human still has to be reachable behind it. Customers have a clear view: in a Gartner survey of 5,728 customers from December 2023, 64 percent said they would prefer companies not to use AI in customer service, and 53 percent would consider switching to a competitor if they found out a company was going to use AI for customer service. Their top concern was that it would become more difficult to reach a person (press release of 9 July 2024).

Legally, the picture is more fragmented than the debate suggests: there is no general obligation, but a series of individual points at which a human becomes mandatory, and two of them are added on 20 November 2026. This article sorts them by three questions: when must a human decide, what are you liable for when the bot speaks on its own, and what applies to statements customers send to the bot? Which other data protection duties apply to an AI agent in customer service, from the data processing agreement to the impact assessment, is set out in the table of duties in the overview of AI agent types. For context: ArkeonTech is itself a provider of AI chatbots and phone assistants.

Is there a right to a human contact person?

No, not in general. According to the consumer advice centre of North Rhine-Westphalia, customers have no statutory right to advice by telephone or to a human contact person (t-online, 26 August 2026). Customers can only demand a human where a law expressly provides for it; the table shows the most important of these points for Germany, plus a planned EU rule.

The AI Act is not in the table. Since 2 August 2026 it requires chatbots and phone assistants to disclose that they are AI (Article 50), but not a human behind them. It only prescribes human oversight for high-risk systems (Article 14 and Article 26(2)). A customer service bot is usually not one of them, but a system that assesses the creditworthiness of natural persons is, with obligations from 2 December 2027 (Annex III point 5(b)).

When does the GDPR require a human decision?

When the bot itself takes a decision that has legal effects for the customer or similarly significantly affects them, and no human reviews it on the merits. Article 22 GDPR prohibits this in principle. It is only permitted if the decision is necessary for the contract, permitted by law or based on the customer's explicit consent.

Most answers in customer service are not decisions in this sense: opening hours, delivery status, a question about the product. It is different when the agent itself rejects an application, for instance for payment in instalments, or terminates a contract. If one of the exceptions for contract or consent applies, Article 22(3) requires the company to enable at least three things: human intervention, the customer expressing their point of view and contesting the decision. In practice this means there must be a route on which a human reviews the bot's decision, and the customer has to be able to find it. Under Article 12(2) the company must also facilitate the exercise of these rights.

How far the concept reaches was shown by the Court of Justice of the EU in its SCHUFA judgment of 7 December 2023 (C-634/21): even the automatically generated score of a credit agency is an automated decision if a third party's decision to establish, implement or terminate a contract with the person depends on it to a decisive extent. The German legislator has responded: from 20 November 2026, § 37a BDSG replaces the previous scoring provision (Federal Law Gazette 2026 I No. 139). It is also the law that permits automated decisions based on such scores under its conditions (Article 22(2)(b) GDPR). Scores about a person's future behaviour that serve a decision about a contract with them may then only be generated or used if their calculation did not include special categories of data such as health data, nor age, gender, name, data from social networks, bank account transactions or addresses, if no minors are scored and if a scientifically recognised mathematical-statistical method demonstrates that the data used are significant for the prediction; the scores may not be used for any other purpose (§ 37a(2)). Whoever generates scores must, on request, disclose the data and criteria used, their weighting, the informative value of the score and the scores generated together with their recipients (paragraph 4). Against an automated decision based on such a score, the customer has the right to contest it, to express their point of view and to a decision by a human (paragraph 5).

This affects anyone who generates scores themselves or uses them for their own contract decisions, for example with an in-house model that predicts payment defaults and decides who may buy on invoice. For such a model it must then also be possible to demonstrate with a recognised statistical method that the data used are significant for the prediction. Anyone who lets a bot take such decisions needs the route to a human in any case: under Article 22 GDPR and, from 20 November, also under § 37a BDSG.

What applies to financial contracts concluded via a chatbot?

Since 19 June 2026, consumers can demand human intervention when a company uses online tools such as chatbots for financial contracts concluded at a distance: on request before the contract is concluded, afterwards in justified cases (Article 246b § 3(3) EGBGB). The rule transposes EU Directive 2023/2673, which all EU member states have had to apply since that date.

This covers financial contracts such as accounts, loans, investments or payment services concluded without simultaneous physical presence, for instance online, by telephone or by messenger. The recitals of the directive expressly mention fully automated online tools such as chatbots, robo-advice and interactive tools: before the contract is concluded, the consumer should always be able to reach a human free of charge during the trader's business hours, and after conclusion in justified cases, without placing an excessive burden on the trader, for instance when a contract is renewed, when the consumer faces significant difficulties or needs further explanations of the contract terms (recital 40). The same German act of 3 February 2026 (Federal Law Gazette 2026 I No. 28) introduced a second obligation as of 19 June 2026 for everyone concluding contracts with a right of withdrawal with consumers via a website or app: the electronic withdrawal function, more on that below.

For credit, § 30(6) BDSG is added from 20 November 2026; it transposes Article 18(8) of the EU Consumer Credit Directive 2023/2225. If the creditworthiness assessment for a general consumer credit agreement, that is consumer credit other than mortgage credit, involves automated processing, the borrower can demand human intervention. This includes a clear and comprehensible explanation of the assessment, including the logic and risks of the automated processing, the opportunity to express their own point of view and a review of the decision, and the lender has to inform the borrower of these rights. Unlike under Article 22 GDPR, it does not matter whether the machine takes the final decision alone; purely procedural automated steps that are independent of the assessment do not trigger the right, however (explanatory memorandum, Bundestag document 21/1851). Under paragraph 9 this also applies to providers and intermediaries of corresponding financing aids such as instalment plans or deferred payment, for instance retailers who offer instalment plans themselves, from 20 November 2026 also free of interest and charges. Exceptions include free payment periods of no more than 50 days that a retailer grants itself, provided only limited costs can arise in case of late payment; for large online providers this applies only up to 14 days and only if no third party acquires the claim (§ 506(1) BGB as applicable from 20 November 2026).

For payment services a third right is on its way. According to the European Parliament's announcement of the provisional agreement on the EU Payment Services Regulation (PSR) in November 2025, users are to have access to human customer support, not only chatbots. The regulation has not yet been adopted; the European Parliament lists it as close to adoption (as of 20 September 2026).

Who is liable if the chatbot says something false?

The company that deploys it. On 12 May 2026 the Higher Regional Court of Hamm ruled that the answers of an AI chatbot are commercial practices of its operator; the bot is not a third party, and the operator cannot rely on the black box (4 UKl 3/25). The court had granted leave to appeal on points of law to the Federal Court of Justice; according to the case-law database NRWE, the judgment is now final.

The case: the chatbot on the website of a provider of beauty treatments, through which patients could also book appointments, described the two managing directors, both physicians, as "specialists in plastic and aesthetic surgery", "specialists in aesthetic medicine" and "specialists in aesthetic treatments" when asked. They did not hold the first title, and the other two do not exist. The consumer advice centre of North Rhine-Westphalia issued a warning letter and sued for an injunction, based on the prohibition of misleading statements about the trader's qualifications (§ 5(1) and (2) no. 3 of the Act against Unfair Competition, UWG).

The company argued that the bot worked autonomously on the basis of statistical probabilities and had only been trained on the correct texts of its own website. The court did not accept this: the operator defines the chatbot's scope of activity and has sufficient influence over it. This became evident when, after the warning letter, the bot was reconfigured with a prompt instruction and a downstream keyword filter so that it no longer stated the false titles (paragraphs 12 and 70). The senate also rejected the argument that customers know anyway that AI makes mistakes. In its view, a large proportion of the consumers addressed place particular trust in the accuracy of the computer-generated answer, since machines are generally perceived as less error-prone than humans (paragraph 104, our translation).

Particularly instructive for practice is the auxiliary reasoning for the case that one assumed only a duty of care: the company would have been liable even then. The court considered it foreseeable that prospective patients would ask about the practitioners' qualifications, and reasonable to ensure, before the chatbot was first put into operation, that it gave no false information on that point (paragraphs 89 to 95); in doing so it applied the particularly strict standards that apply in healthcare (paragraph 93). Switching the bot off and fixing it was not enough: although the bot could no longer state the false titles after the changes, the risk of repetition persisted without a cease-and-desist declaration backed by a penalty (paragraphs 12 and 106). The result was an injunction with a threatened court-ordered fine (Ordnungsgeld) of up to 250,000 euros for each infringement. The senate left open whether anything different applies if a user provokes a false answer with tendentious or leading questions (paragraph 96).

Alongside unfair competition law there is the contract: contractually, too, false information can give rise to customer claims, whether it came from an employee or from an agent. How far this goes and what the new German Product Liability Act changes from 9 December 2026 is described in the article on liability for AI errors.

What applies when customers cancel, withdraw or complain to the bot?

Such statements can be effective even if they only reach the bot. Under German law a consumer declares a withdrawal to the trader without any particular form; it only has to be unequivocal, and sending it in time is enough to meet the deadline (§ 355(1) BGB). A notice of defects between merchants is not tied to any form either, and sent in time it preserves the buyer's rights (§ 377 HGB). The bot should therefore recognise such messages and pass them on to a human.

When a declaration takes effect is governed by § 130 BGB: on receipt. For e-mails in business-to-business dealings, the Federal Court of Justice has ruled that they are in principle received as soon as they are available for retrieval on the recipient's mail server during normal business hours; whether anyone reads them is irrelevant (judgment of 6 October 2022, VII ZR 895/21). The judgment concerns e-mails. Anyone who offers the chat as a contact channel should assume that the same applies to messages there and treat their receipt like that of an e-mail.

There are two functions the chat does not replace in any case. Anyone concluding contracts with a right of withdrawal with consumers via a website or app has had to provide a withdrawal function since 19 June 2026, labelled "Vertrag widerrufen" (withdraw from contract) or equivalent, with its own confirmation function and an acknowledgement of receipt with date and time on a durable medium (§ 356a BGB). Anyone who enables consumers to conclude subscriptions or other continuing obligations for payment on their website has needed the cancellation button "Verträge hier kündigen" (cancel contracts here) since 1 July 2022; financial services are exempt (§ 312k BGB). The bot may help with withdrawing and cancelling, but it must not be the only route.

Requests under the GDPR also belong with a human. If a customer asks in the chat for access to or erasure of their data, the company must say without undue delay what action it has taken, at the latest within one month of receipt; only for complex or numerous requests can the deadline be extended by two months, and the company must inform the customer of this within the first month, giving reasons (Article 12(3)). The bot should therefore forward such requests to the responsible function instead of answering them with a standard text.

May the chatbot be the only contact channel?

No. Anyone operating a business website in Germany must provide information that enables rapid electronic contact and direct communication, including the e-mail address (§ 5(1) no. 2 of the German Digital Services Act, Digitale-Dienste-Gesetz, DDG). Anyone concluding distance contracts with consumers must also state their telephone number and e-mail address in advance (Article 246a § 1(1) sentence 1 no. 3 EGBGB). A chat comes on top; it replaces neither.

What suffices as a second channel was clarified by the Court of Justice of the EU on 16 October 2008 (C-298/07): in addition to the e-mail address there must be a channel that enables rapid contact and direct and effective communication. A telephone number is not mandatory for this; an electronic enquiry form that the company answers by e-mail can suffice. However, a user who has no access to the electronic network after the first electronic contact can request a non-electronic channel. On 10 July 2019 the Court added that a company may encourage customers to use a chat or a call-back system, provided the mandatory information, in particular the telephone number, remains accessible in a clear and comprehensible manner (C-649/17, paragraph 52).

You list a chat in the mandatory information for distance contracts in addition if the customer can store the conversation, including date and time, on a durable medium, for instance as a download or a copy by e-mail. If the chat is part of an online service through which consumers conclude contracts, it has had to be accessible like the rest of the website since 28 June 2025; micro-enterprises with fewer than ten employees and an annual turnover or balance sheet total of no more than 2 million euros are exempt for services (§ 3(3) and § 2 no. 17 of the Accessibility Strengthening Act, BFSG). Whether a phone assistant that refuses every handover is sufficient as a contact channel is not expressly regulated by the law. According to the Court of Justice of the EU, "direct" does not necessarily require a conversation, only that no third party is interposed between the parties; communication is only effective, however, if the customer receives adequate information within a period compatible with their needs or legitimate expectations (C-298/07, paragraphs 29 and 30). The least vulnerable set-up is an assistant that passes requests it cannot resolve on to a human who can be reached via the same number or address.

When should the bot hand over to a human?

Whenever one of the statutory points is touched, whenever the customer asks for it and whenever a question belongs to the foreseeable topics where a wrong answer becomes expensive. A handover that holds up has fixed triggers, carries the conversation so far with it and leads to humans who can be reached at known times.

The list of risk topics follows the standard of the Higher Regional Court of Hamm: from launch, the bot must not give false answers to foreseeable questions. Where correct answers cannot be ensured, the question belongs in fixed answers or with a human. Gartner adds: "For example, AI-infused chatbots must communicate to the customer that they will connect them to an agent in the event that the AI cannot provide a solution. It must then seamlessly transform into an agent chat that picks up where the chatbot left off." (Keith McIntosh, Gartner, 9 July 2024)

Two requirements from other areas of law feed into the same process. The European Commission's guidelines on Article 50 consider it likely to be necessary to repeat the AI disclosure in sensitive conversations, for instance in complaints, health, financial and legal matters and towards vulnerable persons, and if someone asks the bot whether they are talking to an AI, the system must disclose it (paragraph 40); what the disclosure can look like is described in the article on the AI labelling obligation under Article 50. And Germany's Data Protection Conference (DSK) names customer support using AI as a typical field of application in its list of processing operations that require a data protection impact assessment (no. 11); the handover triggers belong in that documentation. What the agent should do when it simply does not know an answer, and how to test this before launch, is described in the article on the knowledge base of AI agents.

What changes in the coming months?

§ 37a and § 30(6) BDSG take effect on 20 November 2026. The European Parliament's research service expects the Commission's proposal for a Digital Fairness Act in mid-November, and the European Parliament lists the Payment Services Regulation with its right to human customer support as close to adoption.

What the Digital Fairness Act will contain is open. The consultation on the preceding fitness check of EU consumer law produced a figure that fits the topic: 69 percent of respondents reported difficulties cancelling an online contract (EPRS, 5 October 2026).

Does this also apply in Austria and Switzerland?

In Austria the GDPR and the AI Act apply directly, and the two EU directives oblige all member states to provide for human intervention for financial contracts via online tools from 19 June 2026 and for creditworthiness assessments involving automated processing for consumer credit other than mortgage credit from 20 November 2026. The ruling of the Higher Regional Court of Hamm and § 37a BDSG are German law, as are the sections of the BGB, HGB and DDG mentioned here. Several of them, however, transpose EU directives that also apply in Austria, such as the withdrawal function and the contact information on websites; there, the Austrian implementing act is decisive.

For Swiss companies the GDPR applies insofar as they offer goods or services to people in the EU or monitor their behaviour there (Article 3(2) GDPR). In addition, the Swiss Federal Act on Data Protection applies and contains a right of its own. The company has to inform the person about a decision based exclusively on automated processing that has legal consequences for them or significantly affects them, and the person can demand that a natural person reviews the decision (Art. 21 FADP). Decisions directly connected with a contract are exempt if the person's request is granted, as are cases of explicit consent. Swiss companies whose chatbot serves customers in the EU are also covered, for those customers, by Article 22 GDPR and by the AI Act, the latter because the output of the system is used in the Union (Art. 2(1)(c) AI Act).

Frequently asked questions

---

Which rules apply to chatbots, phone assistants and WhatsApp bots in detail is shown in the legal tables on the pages for the AI chatbot, the AI phone assistant and WhatsApp AI. This is not legal advice; for reviewing a specific process a specialist lawyer remains the right contact.

Sources

• EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation - territorial scope (Art. 3(2)), facilitating data subject rights and deadlines (Art. 12), automated individual decision-making (Art. 22)
• Federal Law Gazette: Gesetz zur Änderung des Verbrauchervertrags- und des Versicherungsvertragsrechts sowie zur Änderung des Behandlungsvertragsrechts of 3 February 2026, BGBl. 2026 I No. 28 - human intervention with online tools (Art. 246b § 3(3) EGBGB), electronic withdrawal function (§ 356a BGB), entry into force on 19 June 2026 (Art. 10)
• EUR-Lex: Directive (EU) 2023/2673 on financial services contracts concluded at a distance - right to human intervention (Art. 16d(3) of Directive 2011/83/EU), chatbots and robo-advice (recital 40), application from 19 June 2026 (Art. 2)
• Federal Law Gazette: Gesetz zur Umsetzung der Richtlinie (EU) 2023/2225 über Verbraucherkreditverträge und zur Regelung der Förderung klimaneutraler Mobilität of 12 May 2026, BGBl. 2026 I No. 139 - human intervention in credit assessments (§ 30(6) and (9) BDSG), scoring (§ 37a BDSG), financing aids (§ 506 BGB), entry into force on 20 November 2026 (Art. 16)
• German Bundestag: Government bill implementing Directive (EU) 2023/2225, document 21/1851 of 29 September 2025 - explanatory memorandum on § 30(6) BDSG
• EUR-Lex: Directive (EU) 2023/2225 on credit agreements for consumers - human intervention in automated creditworthiness assessments (Art. 18(8)), application from 20 November 2026
• Higher Regional Court of Hamm: Judgment of 12 May 2026, 4 UKl 3/25 - answers of an AI chatbot as commercial practices of the operator (paras. 12, 70 to 73, 77), checks before first operation (paras. 89 to 96), trust in machine answers (para. 104), risk of repetition (para. 106); final according to NRWE
• Higher Regional Court of Hamm: Press release of 12 May 2026 - parties to case 4 UKl 3/25, leave to appeal on points of law
• Court of Justice of the EU: Judgment of 7 December 2023, C-634/21 (SCHUFA Holding) - a credit agency's score as an automated decision
• Court of Justice of the EU: Judgment of 16 October 2008, C-298/07 - second communication channel besides the e-mail address, direct and effective communication (paras. 29 and 30), electronic enquiry form
• Court of Justice of the EU: Judgment of 10 July 2019, C-649/17 (Amazon EU) - chat and call-back system alongside the telephone number (para. 52)
• Gesetze im Internet: § 5 Digitale-Dienste-Gesetz and Art. 246a § 1 EGBGB - contact information on websites, telephone number and e-mail address for distance contracts
• Gesetze im Internet: § 130 BGB, § 312k BGB, § 355 BGB and § 377 HGB - receipt, cancellation button, withdrawal, notice of defects
• IHK Hannover: BGH zum Zugang von E-Mails im unternehmerischen Geschäftsverkehr - Federal Court of Justice, judgment of 6 October 2022, VII ZR 895/21
• Gesetze im Internet: Barrierefreiheitsstärkungsgesetz - services in electronic commerce (§ 1(3) no. 5), micro-enterprises (§ 2 no. 17, § 3(3)), in force since 28 June 2025
• EUR-Lex: Regulation (EU) 2024/1689 on artificial intelligence, consolidated version of 27 July 2026 - scope (Art. 2(1)(c)), human oversight (Art. 14, Art. 26(2)), transparency (Art. 50), creditworthiness assessment (Annex III point 5(b))
• European Commission: Guidelines on the transparency obligations for providers and deployers of AI systems, C(2026) 5054 - repeating the AI disclosure in sensitive conversations, disclosure when asked (para. 40)
• Datenschutzkonferenz: Liste der Verarbeitungstätigkeiten, für die eine DSFA durchzuführen ist, Version 1.1 - no. 11, customer support using AI
• European Parliament: Payment services deal: More protection from online fraud and hidden fees of 27 November 2025 and Legislative Train, Payment Services Regulation (as of 20 September 2026) - access to human customer support, state of the procedure
• European Parliamentary Research Service: Towards a digital fairness act of 5 October 2026 - timetable for mid-November, consultation on cancelling online contracts
• Fedlex: Federal Act on Data Protection (FADP) - duty to inform and review of automated individual decisions (Art. 21)
• Gartner: Gartner Survey Finds 64% of Customers Would Prefer That Companies Didn't Use AI For Customer Service of 9 July 2024 - 5,728 customers, rejection and willingness to switch, concern about reaching a person, advice on the handover
• t-online: KI im Kundenservice: Kein Anspruch auf menschlichen Ansprechpartner of 26 August 2026 - assessment by the consumer advice centre of North Rhine-Westphalia