The consultation: why now?
The Dutch Data Protection Authority (AP) and the Authority for Consumers and Markets (ACM) have jointly launched a consultation for guidance on the responsible use of chatbots in customer service. This is no coincidence: both regulators are receiving increasing signals from the market about bottlenecks and risks in the deployment of AI-driven chatbots. There are examples of customer service chatbots providing incorrect information about opening hours or return policies. And there are also reports of chatbots giving rude or strange responses to customer questions.[1]
For compliance officers, this is a good moment to critically review internal practices and policies. In this blog post, we discuss the five core themes that are expected to take center stage in the upcoming guidance.
1. Transparency: be honest about what (or who) is answering
Chatbots are increasingly presented in a human-like manner. They are given names like "Lisa" or "Max", adopt an informal tone. Some voice bots even produce human-like sounds such as "uhm", brief pauses or a sigh. Visually, we see 'typing dots' that suggest someone on the other end is thinking and typing.
This humanization can have a misleading effect. Consumers may wrongly believe they are communicating with a human, which influences their expectations and behavior.
Actions to take?
-
Configure the chatbot to clearly disclose, both at the start and throughout the conversation, that the customer is interacting with an automated system.
-
Avoid deliberately misleading elements that simulate human contact, such as the typing dots or human emulation such as sighs or laughing.
-
Give the chatbot a clear name, that shows the user its interacting with AI. Use ‘AI’ or ‘Chatbot’ in the name, instead of simple ‘Lisa’ or ‘Max’.
2. Access to human contact: the chatbot as gatekeeper
In many organizations, the chatbot has become the first and only point of contact in customer service processes. Customers who want to speak with a human encounter endless loops or simply find no option to be transferred. This is problematic, particularly in situations where human judgment is essential.
When is human contact indispensable? When errors need to be corrected. A chatbot can rarely independently correct a mistake in an invoice or contract. Or when there is a complaint or problem. Complaint handling requires empathy, nuance and judgment. Human qualities that a chatbot can imitate but cannot genuinely deliver. In addition, we often see things go wrong in practice with complex situations. Think of overlapping regulations, exceptional cases or legal disputes. These kinds of nuances and deviations are difficult for a chatbot to process into an adequate response. And finally, urgent situations, such as acute problems (disconnection, fraud, security incidents) in which human judgment and the choice to escalate are important.
Actions to take?
-
Decide which topics may and may not be handled by the customer service chatbot.
-
Ensure a clear path to reach a human agent when needed.
- Make this route findable and accessible, not hidden behind five menu options.
3. Accurate and reliable answers: maintain control over the output
With chatbots, interactions often fall outside the direct view of employees. What the bot says to customer is not visible for the company, until a complaint is filed. With AI systems, such as a chatbot used for customer service activities, there is also the risk of "hallucinations". The chatbot makes up answers that sound plausible but are factually incorrect. The all hours availability is a selling point for chatbot used in customer service. This also means that customers can interact with the chatbot, outside of office hours, when employees are not available in case of escalation or needed support.
As indicated in the previous section, it is very important to make a careful assessment of which topics the chatbot may and may not advise on. Also consider the authority granted to it. What is the bot allowed to commit to? Can it offer discounts, make appointments or handle complaints?
Action to take?
-
Measure customer satisfaction specifically for chatbot interactions.
-
Actively request feedback from users and assess it systematically.
-
Periodically review the dataset with company information, such as business hours, services and locations.
4. Accessibility: not everyone can (or wants to) chat
A customer service chatbot sounds like a modern, efficient solution. But not everyone can handle it equally well. Think of people with visual impairments, those with low literacy and elderly people who are less digitally skilled. In addition, there are also people who simply prefer telephone contact. These people must also have ways to reach customer service.
Additional laws and regulations must be taken into account in this area. So when implementing a customer service chatbot, look not only at the AI Act, but also at the European Accessibility Act (EAA) and the Web Content Accessibility Guidelines (WCAG).
Actions to take?
-
Offer alternative contact channels that are equally accessible.
-
Ensure the chatbot can work with screen readers and keyboard navigation.
-
Safeguard clear communication by the chatbot at B1 language level.
5. Privacy and security: the invisible risks
You have no control over the information that customers share with the customer service chatbot. Customers are known to type or speak freely to a chatbot. They share complaints and personal situations. Sometimes a customer may, without thinking, share special categories of personal data. Such as health complaints, financial problems, or sensitive family circumstances. The question is: what happens to this data?
In addition, new security risks arise that organizations must guard against. In the case of customer service chatbots, there is the danger of prompt injection. Malicious actors who try to manipulate the chatbot into revealing confidential information or carrying out unwanted actions.
Actions to take? Privacy:
-
Don't forget the DPIA and carry it out before the chatbot goes live.
-
Consider excluding processes with a high likelihood of special categories of personal data from chatbot handling.
-
Inform users about the data processing, for example in the organization's privacy statement.
Action to take? Security:
-
Test the chatbot for vulnerabilities to prompt injection and other manipulations.
-
Implement input validation and restrictions on what the bot can do.
-
Monitor for anomalous behavior that may indicate misuse.
-
Involve security expertise in the design and configuration.
- Finally: the organization is responsible.
A common thread running through all five themes: the organization remains responsible for what the customer service chatbot does. So, make sure you have a firm grip on this.
Do you have questions about deploying chatbots within your organization, or would you like your current setup reviewed? Please feel free to contact us.
[1] NOS. (2024, January 20). Pakketdienst haalt AI-chatbot offline na gedicht over slechte service [Delivery company takes AI chatbot offline after poem about poor service]. https://nos.nl/artikel/2505573-pakketdienst-haalt-ai-chatbot-offline-na-gedicht-over-slechte-service
Radar. (n.d.). Jullie chatbot-ergernissen: "Stel de vraag steeds anders, maar met hetzelfde resultaat" [Your chatbot frustrations: "Ask the question differently each time, but with the same result"]. AVROTROS. Retrieved November 14, 2025, from https://radar.avrotros.nl/artikel/jullie-chatbot-ergernissen-stel-de-vraag-steeds-anders-maar-met-hetzelfde-resultaat-61569
