OnClarity Insights
2027: the year customer service gets audited
For two years, AI in customer service was judged by the team that bought it, on the vendor’s dashboard. In 2027 the questions start coming from outside: from finance, from regulators and from customers.
6 min read
The short answer
In 2027 three auditors will check what customer service AI actually did. Finance will ask for the saving on a baseline it signed. Regulators will ask what the AI told customers and whether people could reach a human. Customers will audit by behaviour: coming back, complaining, leaving. The companies that pass can show what their AI fixed, not just what it answered.
Why does 2027 change who checks service AI?
Because the pilots are over and the rules have caught up.
Most AI in service was approved in 2025 and 2026 on a business case and a dashboard, both usually supplied by the vendor. That was reasonable while it was an experiment. It is not reasonable once the AI talks to millions of customers, carries a budget line and falls under rules with fines attached.
Boards know they are not seeing the right information. In PwC’s 2026 Annual Corporate Directors Survey of 599 US directors (September 2026), 82% rated the information they get linking AI outcomes, risks and business performance as fair or poor, or said they do not receive it at all.
Audit one: what will finance ask?
Finance will ask a simple question: show me the saving, on a baseline we agreed, in money.
A containment rate does not answer it. A conversation the AI “handled” can come back tomorrow through another channel, and the business pays for it twice. The number finance will accept is repeat cost removed: repeat contacts at baseline minus repeat contacts after a fix, multiplied by the company’s own cost per contact, counted only for fixes that held through their test window.
Expect three follow-ups. Who set the baseline? Who graded the result, and was it the vendor? What happened to the contacts the AI handed to people?
Audit two: what will regulators ask?
Regulators will ask what the AI told customers, whether customers knew it was AI, and whether they could reach a person when they needed one. The rules are different in each market, and several dates have already moved, so the calendar below lists only obligations checked on primary sources on 12 October 2026.
Sources: EUR-Lex and the European Commission AI Act Service Desk; FCA Handbook PRIN 2A.8; UK CMA guidance; Colorado General Assembly; California Privacy Protection Agency. Checked 12 Oct 2026.
European Union. Since 2 August 2026, Article 50 of the EU AI Act has required AI systems that talk directly to people to be designed so those people are told they are dealing with AI, at the latest at the first interaction. Breaches can be fined up to EUR 15 million or 3% of worldwide turnover. The stricter high-risk rules were moved by Regulation (EU) 2026/1744 and now apply from 2 December 2027. They cover, for example, AI used to assess creditworthiness or to price life and health insurance, so a service agent that touches those decisions needs a closer look.
United Kingdom. There are no AI-specific rules for financial services. The existing ones apply. Under the FCA’s Consumer Duty, the board must review and approve a report on customer outcomes at least once a year (31 July for most firms). The Duty covers retail customer outcomes whoever or whatever handled the conversation, so AI-handled service belongs in that report. Separately, the Competition and Markets Authority’s guidance of March 2026 is plain: “you are responsible for what an AI agent does”, even when a third party supplies it.
United States. There is no federal rule, and federal policy is pushing against state rules. State duties still apply. Utah and Maine already require AI disclosure in some consumer conversations. From 1 January 2027, California’s rules on automated decision-making technology require notice, opt-out and access for significant decisions. Colorado’s replacement AI law also applies from 1 January 2027, but a federal court order has put its enforcement on hold, so treat that date as unsettled.
None of this is a reason to slow down. It is a reason to keep the evidence.
Audit three: how do customers audit service AI?
Customers do not file reports. They audit by what they do next. They come back about the same problem. They ask for a person. They complain in public. They leave at renewal.
Gartner found in September 2026 that only 27% of customers would try a chatbot again after a negative experience. A customer who gives up on the AI does not disappear: they reappear as a phone call, an email or a complaint, which usually costs more than the conversation the AI was meant to handle.
So the customer’s audit has one question: did it stay fixed?
What evidence should a CEO already hold?
Four pieces of evidence answer all three auditors.
The outcome, written down before the fix. For every important problem, what was supposed to happen, registered when the work opened. Not chosen after the results came in.
The recontact check. Did the same customer come back about the same issue, in any channel, within a fixed window? A resolution that comes back was not a resolution.
Repeat cost removed. The money, on a baseline finance signed, for fixes that held.
A record of what the AI said and did. Readable transcripts of what customers were told, when a person was offered, and who approved changes to the AI’s knowledge and instructions. You cannot audit a conversation nobody can read.
Together these mean one thing: closed means it worked. A ticket marked closed is a claim. The outcome that was registered at the start, checked on the company’s own data, is the proof.
The five-point readiness list
Run this with the leadership team before the 2027 budget is locked.
Inventory. List every place AI talks to customers, which vendor runs it, and in which markets.
Disclosure and escalation. Check that customers are told they are talking to AI where the rules require it, and that the route to a person works.
One definition of fixed. Agree, in writing, what counts as resolved and over what window. Make it the company’s definition, not the vendor’s.
A finance-signed baseline. Eight weeks of contacts, every channel, seasonally adjusted, signed before the next change ships.
An owner and a report. Name the person who signs each result, and put repeat cost removed and recontact rate in front of the board every quarter.
The honest trade-off
Rules differ by market and some dates have moved before; they may move again. Many companies are not in scope of every rule listed here. Getting audit-ready costs effort before it saves any, and the first audit is rarely comfortable. The alternative is worse: being asked what the AI told a customer and not being able to answer.
Questions people ask
Does the EU AI Act apply to customer service chatbots?
Yes, in part. Since 2 August 2026, Article 50 requires AI systems that interact directly with people to tell them they are dealing with AI, unless it is obvious. Most service chatbots are not high-risk systems, but AI that assesses creditworthiness or prices life and health insurance is, from 2 December 2027.
Who is responsible when an AI agent gives a customer wrong information?
In the UK, the CMA’s March 2026 guidance says the business is responsible for what its AI agent does, as it would be for an employee, even when a third party provides the agent.
What should a board ask about AI in customer service?
Three questions: what did our AI fix last quarter, measured on our own data; how do we know it stayed fixed; and can we show what it told customers? If those answers come from the vendor’s dashboard, they are not yet evidence.
Sources
European Commission AI Act Service Desk, Article 50 (transparency obligations) and Article 99 (penalties), checked 12 Oct 2026.
EUR-Lex, Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (high-risk dates), checked 12 Oct 2026.
European Commission AI Act Service Desk, Annex III.
FCA Handbook, PRIN 2A.8 (Consumer Duty board report).
UK Competition and Markets Authority, Complying with consumer law when using AI agents, 9 Mar 2026.
California Privacy Protection Agency, CCPA regulations on automated decision-making technology, announced 23 Sep 2025.
Colorado General Assembly, SB 26-189; X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), minute order of 27 Apr 2026.
Utah Code 13-77-103; Maine 10 MRSA §1500-Y (P.L. 2025 c. 294).
PwC, 2026 Annual Corporate Directors Survey, 23 Sep 2026.
Gartner newsroom, only 27% of customers would try a chatbot again after a negative experience, 2 Sep 2026.
This page is general information, not legal advice. Check how each rule applies to your business with your own counsel.
