Kollie and the EU AI Act

1. AI models and purpose

Kollie is an AI-powered telephony assistant platform. The following AI models are used in production:

Microsoft no-training guarantee

All Azure OpenAI usage is covered by Microsoft's enterprise data protection commitments:

• Customer data is not used to train, retrain or improve Microsoft or third-party models.
• Customer data is not available to other Azure OpenAI customers.
• This is contractually guaranteed under the Microsoft Product Terms and the Azure OpenAI Data, Privacy, and Security documentation.

2. EU AI Act risk classification

Classification: limited risk (with elements of minimal risk)

Under the EU AI Act (Regulation (EU) 2024/1689), AI systems are classified into four risk tiers: unacceptable, high, limited and minimal.

Kollie does not fall under high risk (Annex III) because it:

• Does not perform biometric identification or categorization.
• Does not make decisions in critical infrastructure, education, employment, essential services, law enforcement, migration or justice.
• Does not perform social scoring or emotional recognition.
• Does not autonomously make legally significant decisions about natural persons.

Kollie falls under limited risk primarily due to Article 50 (transparency obligations), which requires that persons interacting with an AI system are informed that they are interacting with AI, unless this is obvious from the circumstances.

The conversational telephone agent is the primary interface, and callers may not immediately recognize they are speaking with an AI system. This triggers the Article 50 transparency obligation (see section 6).

The remaining components (embeddings, vector search, transcript extraction) are minimal risk: they perform back-end processing tasks with no direct human interaction.

3. Risk minimization measures

3.1 Human oversight

• Call transfer capability: agents can transfer calls to human operators at any point if configured.
• Configurable behavior: each agent's instructions, persona and scope are defined by the operator (Kollie's client); the AI does not autonomously expand its own scope.
• Transcript review: all calls are transcribed and stored, allowing human review of AI interactions.
• Structured data extraction: post-call processing extracts structured data from transcripts for operator review.

3.2 Transparency

• Agent behavior is prompt-defined: the operator controls what the agent says and how it identifies itself.
• Call recordings and transcripts: a full audit trail of every AI interaction is maintained.
• No autonomous decision-making: the agent operates strictly within the boundaries set by the operator's prompt configuration.

3.3 Accuracy and reliability

• RAG (retrieval-augmented generation): knowledge base queries ground the agent's responses in operator-provided factual content, reducing hallucination risk.
• Temperature control: transcript extraction uses temperature=0 for deterministic, reproducible outputs.
• Model selection per tenant: operators can be assigned specific model versions, allowing controlled rollouts.

3.4 Audit trail

• All conversations are logged with full transcripts.
• Structured data extraction results are stored per call.
• Agent configuration changes are tracked.

4. Data protection (GDPR alignment)

GDPR does not require data to be stored in the EU; it requires that data transfers outside the EU have adequate safeguards (for example Standard Contractual Clauses or the EU-US Data Privacy Framework). All sub-processors listed below provide such safeguards. EU data residency is available as an optional configuration for organizations with specific contractual or regulatory requirements to keep data within EU borders.

4.1 Data processing overview

4.2 Sub-processors, data residency and training policy

4.3 Data minimization

• Only conversation-relevant data is sent to LLM providers.
• Knowledge base embeddings are generated locally; source documents are not sent to external services.
• Call audio recording is optional and client-controlled: clients can enable or disable recording at their discretion. When enabled, recordings are retained for a maximum of 30 days on Kollie's infrastructure (Azure). The voice provider (Vonage) independently retains call audio for up to 30 days on its side, per its own data retention policy.

5. IT security

5.1 Authentication and access control

• API authentication via API keys and bearer tokens.
• Agent configuration access is scoped per organization (multi-tenant isolation).
• Vector database collections are namespaced per organization and knowledge base (org_{id}_kb_{kb_id}).

5.2 Encryption

• In transit: all external API calls use HTTPS/TLS.
• At rest: Azure-managed encryption for PostgreSQL; Qdrant on an Azure VM benefits from Azure disk encryption.

5.3 Secret management

• API keys for all external services (Azure OpenAI, Deepgram, ElevenLabs) are stored as environment variables, not in source code.
• Production secrets are managed via deployment configuration, not committed to version control.

5.4 Network security

• The Qdrant instance operates within a private network / virtual network.
• Database access is restricted to application services.

6. AI disclosure: transparency obligation (Article 50)

Current state

Today, AI disclosure (informing callers they are speaking with an AI) is configured by you as the operator, through the agent's prompt and greeting text. You are responsible for ensuring your agents include appropriate AI disclosure in their interactions.

Upcoming requirement

The EU AI Act Article 50(1) requires that AI systems interacting directly with people must inform them they are interacting with AI. This obligation enters into force on 2 August 2026.

As the platform provider, Kollie will introduce a built-in AI disclosure mechanism before the enforcement date to ensure compliance at the platform level. This will include a default disclosure in the agent's initial greeting that satisfies Article 50 requirements.

What this means for you

• Now: we recommend including AI disclosure in your agent greetings (for example, "Hello, you are speaking with an AI assistant from [Company]. How can I help you?").
• By August 2026: Kollie will provide platform-level enforcement so that Article 50 compliance is handled automatically.

For reference: Article 50 and Recital 132 of the EU AI Act (Regulation (EU) 2024/1689).