Intercom Fin and the EU AI Act: A Deployer's Compliance Guide
Intercom Fin resolves support queries autonomously on third-party GPAI. For deployers that means Article 50 disclosure, Article 4 literacy, and data governance.
Probably not high-risk. If you switch Fin on to answer product, billing, and policy questions and route tickets, you sit at limited risk under the EU AI Act — the real duties are transparency, AI literacy, and governing what the bot reads. The autonomy is the headline; the obligations are not where most readers expect them. This page is written for the deployer: the company running Fin on its own support channel.
What Intercom Fin is, in EU AI Act terms
Fin is an AI support agent that resolves customer queries end to end. Unlike a suggest-and-assist tool that drafts a reply for a human to send, Fin can answer and close a ticket without a human in the loop. That autonomy is the thing the rest of this guide turns on.
Under Regulation (EU) 2024/1689, Fin meets the Article 3(1) definition of an AI system: a machine-based system that infers from inputs to generate outputs — here, customer-facing answers and resolution actions. It is built on a third-party general-purpose AI (GPAI) model accessed over an API. The model sits at one layer; Fin is the deployed system on top of it, and that split decides who carries which obligation.
What risk tier does Intercom Fin fall into?
Classification follows function and context, never the product name or how autonomous the agent feels (Article 6). A Fin agent that answers product questions, explains policies, processes returns, and routes tickets is limited-risk under Article 50 — no Annex III category applies. The full high-risk obligation stack does not attach: no Article 9-15 requirements, no Article 43 conformity assessment, no Annex IV documentation, no CE marking.
The filter that does the work is Article 6(3): a system performing a narrow procedural or conversational task does not pose a significant risk to health, safety, or fundamental rights, so even a system touching a listed area can stay outside high-risk. The one carve-out — if the system profiles natural persons, the filter is removed and high-risk classification returns.
Your core duty: Article 50 transparency when an AI agent does the talking
Article 50(1) requires that natural persons be informed they are interacting with an AI system, at the latest at the start of the interaction. The exception — where it is obvious to a reasonably well-informed person — is narrower for Fin than for a scripted bot, since an agent that resolves queries convincingly can be mistaken for a human. The safe reading is to disclose.
The disclosure must live in the Fin interface itself: a line buried in your terms of service does not satisfy the timing-and-clarity requirement. Keep hand-offs clear too — where Fin escalates to a human or a human hands back, the transition should be equally visible.
Article 50 limited-risk transparency applies from 2 August 2026; this date was not moved by the Digital Omnibus. The content-marking duty for generative output applies from the same date — synthetic outputs must be marked machine-readably as artificially generated; only generative systems already on the market before 2 August 2026 have until 2 December 2026.
What changes when the bot resolves without a human in the loop
This is where Fin differs from a copilot. Because Fin resolves and closes queries autonomously, there is often no human gate between the AI output and the customer: a wrong, fabricated, or out-of-date answer reaches them directly, with no reviewer to catch it. The tier usually stays limited-risk, but the deployer carries a heavier burden for accuracy, escalation rules, and monitoring.
Watch the narrow edge. If an autonomous answer effectively decides access to an essential service — gates eligibility, denies a benefit, controls account access — reassess against Annex III point 5. Function, not form, governs: a conversational wrapper does not exempt a system that is, in substance, deciding something consequential about a person.
Contrast the human-assist model, where a person reviews every output and the risk surface is lower. Closed-loop resolution shifts that governance burden onto you, the deployer — same legal tier, materially more responsibility.
Data governance over the knowledge sources Fin draws on
Fin answers from a configured knowledge base — help-centre articles, internal documents, past tickets, connected sources. Their quality and lawfulness is a core deployer responsibility, because they directly determine what Fin tells your customers: stale, contradictory, or unauthorised content produces wrong autonomous answers. Keep records of which sources Fin can draw on, who approves them, and how outdated content is retired — that record supports both accuracy and an Article 50 due-diligence trail.
The formal Article 10 data-governance duties bind high-risk providers, not a limited-risk deployer, but the underlying discipline — clean, current, authorised sources — is the practical equivalent and worth adopting voluntarily. Where knowledge sources or conversation logs contain personal data, GDPR applies alongside the AI Act as a separate, parallel framework; clearing one does not clear the other.
Who is the provider and who is the deployer?
Intercom places Fin on the market under its own name, which makes Intercom the provider of the Fin system. The company switching Fin on for its own support channel is the deployer — you classify and govern the deployed system by what it does; you do not build it.
The GPAI model obligations under Articles 51-55 stay with the upstream model provider that developed it. They have applied since 2 August 2025 and do not transfer to a company deploying a system built on the model.
The boundary can move. Under Article 25, a deployer becomes a provider if it puts its own name or trademark on the system, makes a substantial modification, or changes the intended purpose so the system becomes high-risk — repurposing Fin into a tool that autonomously decides service eligibility could be such a change. Record the intended purpose precisely so the role boundary stays clear if a regulator asks.
The deployer's actual to-do list
Four things. None of them is a high-risk programme.
Add and place the Article 50 disclosure
Put a clear AI-disclosure inside the Fin widget itself, visible at the start of the interaction, with equally clear hand-off signalling.
Confirm Article 4 AI literacy for staff
Article 4 AI literacy is in force now. Staff who configure Fin, manage its knowledge base, or handle escalations need a role-appropriate understanding of what it does and where it fails.
Govern the knowledge sources and set escalation rules
Approve and retire sources deliberately, and set escalation thresholds so genuinely consequential queries reach a human rather than being auto-resolved. Screen Fin's conversational design against Article 5 prohibitions — no manipulative or deceptive techniques causing harm — especially where the bot is incentivised to retain or up-sell.
Document the classification and reassess on scope change
Keep a short written classification record and rerun it if Fin's role expands toward any Annex III function. Missing these duties is not cost-free: breaches of most obligations, including Article 50 transparency, fall within the €15 million or 3% of total worldwide annual turnover, whichever is higher, tier under Article 99(4), with Article 99(6) capping SMEs and start-ups at the lower of the two.
The duties map to legal bases and dates as follows:
| Duty | Legal basis | What the deployer does | Applicable date |
|---|---|---|---|
| Prohibited-practice screen | Article 5 | Check conversational design for manipulative/deceptive techniques | In force since 2 February 2025 |
| AI literacy | Article 4 | Train staff who configure, feed, or escalate Fin | In force since 2 February 2025 |
| AI-interaction disclosure | Article 50(1) | Place clear disclosure inside the Fin interface | From 2 August 2026 |
| Content marking of generative output | Article 50 | Mark synthetic output machine-readably as generated | From 2 August 2026 (2 December 2026 if on the market before then) |
Worked example: a 200-person SaaS company turns on Fin
Northwind Billing, a 200-employee EU SaaS company, deploys Fin to autonomously resolve billing and account questions across its help centre.
Classification result: limited-risk. Fin answers and resolves support queries, no Annex III category is engaged, and the Article 6(3) filter holds.
Their duties: add an Article 50 disclosure to the Fin widget before 2 August 2026; confirm Article 4 literacy for the four-person support-ops team now; govern which billing documents Fin can draw on; log the classification.
The edge to watch: one Fin flow can suspend a customer's account for non-payment automatically. Because that decision gates access to a service the customer relies on, Northwind reassesses it against Annex III point 5 and routes account-suspension queries to a human — keeping the deployment cleanly limited-risk.
Outcome: a short, defensible workplan rather than a high-risk programme. Honest classification kept the burden proportionate.
One timeline caveat on the high-risk deadline
The Digital Omnibus defers the stand-alone high-risk Annex III deadline to 2 December 2027; it was adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. For a limited-risk Fin deployment this rarely bites, but the 2 December 2027 date now governs even if you push Fin into an Annex III function.
How Confir helps
Add Intercom Fin to your AI register and Confir's classification engine asks how you use it — what Fin answers, whether it resolves autonomously, what data its knowledge base touches, and whether any flow gates access to a service. It runs the Article 5 prohibited-practice check first, then the Article 6 and Annex III scoping, and returns your tier with the rule that fired written in plain language. A standard support deployment produces the short limited-risk checklist; a flow that decides eligibility surfaces the Annex III reassessment. The engine is deterministic and rule-based — no model inference, no hallucination — so the same intake always yields the same finding any reviewer can check.
Frequently asked questions
Is Intercom Fin high-risk under the EU AI Act?
Not by default. Fin's risk tier depends on what it does, not on the fact that it resolves queries autonomously. A Fin agent that answers product, billing, and policy questions and routes tickets is limited-risk under Article 50, with no Annex III category engaged. It climbs toward high-risk only if you configure it for a listed Annex III function, such as autonomously deciding access to an essential service.
Does Intercom Fin's autonomy change my legal obligations?
Usually not the legal tier, but it changes the practical burden. Because Fin can resolve and close queries without a human reviewing each answer, no gate catches a wrong or out-of-date response before it reaches the customer. The deployer therefore carries more responsibility for accuracy, escalation rules, and monitoring. The duties stay the limited-risk set, but closed-loop resolution makes diligent execution of them matter more.
What exactly does the Article 50 disclosure require for Fin?
Under Article 50(1), natural persons must be informed they are interacting with an AI system, at the latest at the start of the interaction, unless it is obvious to a reasonably well-informed person. Because an autonomous agent can be mistaken for a human, disclose clearly inside the Fin interface itself; a buried terms-of-service reference does not satisfy it. This transparency duty applies from 2 August 2026.
Who is responsible for the GPAI model that powers Fin?
The general-purpose AI model obligations under Articles 51-55 stay with the upstream model provider that developed it; they have applied since 2 August 2025 and do not transfer to you. Intercom is the provider of the Fin system itself; your company, switching Fin on for its own support channel, is the deployer. You govern the deployed system by what it does — you do not inherit the model-layer duties.
Do I owe data-governance duties for Fin's knowledge base?
The formal Article 10 data-governance duties bind high-risk providers, not a limited-risk deployer. But governing the sources Fin draws on is your most concrete operational responsibility: stale, contradictory, or unauthorised content produces wrong autonomous answers. Keep current, approved sources, retire outdated content, and record who signs off. Where sources or logs contain personal data, GDPR applies in parallel as a separate framework.
When is the compliance deadline for a Fin deployment?
Article 4 AI literacy and Article 5 prohibitions have been in force since 2 February 2025, so they apply now. Article 50 transparency, content marking included, applies from 2 August 2026 (2 December 2026 for marking by generative systems already on the market). High-risk Annex III deadlines were deferred to 2 December 2027 under the Digital Omnibus, adopted by Parliament and Council in June 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026.
Related guides
- EU AI Act Article 50: transparency and disclosure
- limited-risk AI systems and what Article 50 requires
- customer-support chatbots under the EU AI Act
- Zendesk AI under the EU AI Act
- the full AI tool inventory
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →