AI Act Compliance for Sales Assistant Tools in the EU: A Checklist for Sellers

BOTrento Team31 October 20268 min read

To check whether a sales AI assistant fits the EU AI Act, work out your own role (usually "deployer", meaning you use the tool), judge what the tool actually does with your enquiries and quotes, and get the vendor to confirm its side in writing. No tool is "compliant" in the abstract: it depends on the use, the vendor's documentation and how you run it.

For most small B2B teams, using AI to draft replies, quotes and follow-ups is a lower-risk use than the headline cases in the Act. You still need to be able to explain what the tool does, who checks its output and what happens to your data. This is general guidance, not legal advice, so take specific cases to a lawyer.

Start with your role: deployer, not provider

The AI Act separates the companies that build and place AI systems on the market (providers) from those that use them in their own business (deployers). If you buy an AI sales tool and use it for your enquiries, you are normally a deployer. The vendor, and the company behind the underlying language model, carry the provider-side duties.

That does not make you a bystander. Deployers are generally expected to use a tool as intended, make sure the people using it understand it, keep sensible human oversight and be open with people where the rules require it. Our overview of what the AI Act means for small businesses using AI on enquiries and quotes covers the deployer side in more depth, including an internal policy template.

One caution: if you rebrand a tool, change what it is meant to do or build your own system on top of a model, your role may shift. That is a question for a lawyer.

Judge the risk level by what the tool does

The Act works by use case, not by the word "AI". Ask what the tool does to the people and companies it touches.

Lower-risk uses in sales

Drafting replies, quotes and follow-ups that a person reads before anything goes out.
Summarising an email thread or listing open enquiries.
Reminding you of a promise such as "I will get back to you by Friday".

Uses that need a closer look

Automated decisions about individuals, such as refusing service or setting terms based on a profile.
Scoring or ranking people in ways that could seriously affect them.
Chatbots that talk to customers directly without a human involved, where people should be told they are speaking to a machine.
Anything touching employment decisions about your own staff.

If your use sits in the first group, the practical burden is mostly about training, transparency and oversight. If it drifts into the second, get legal advice before you switch it on.

The seller's compliance checklist

Work through these eight points before adopting a tool, then again once a year.

Write down the use case. One paragraph: which data goes in, what comes out, who reads it.
Keep a person in the loop. Every email and quote is approved by a named person before it leaves.
Train the people using it. Short and practical: what the tool can get wrong, what never to paste in, how to correct output.
Be open with customers where needed. If an AI talks to people directly, say so. If a human reviews and sends drafts, check with your lawyer whether any notice is needed in your case.
Know the data flow. Where it is stored, which provider's model processes the text, and whether that provider trains on your data.
Get the vendor's answers in writing. See the questions below.
Keep records. Who approved what, and a log of problems and fixes.
Have an exit. You should be able to export your data and outputs if you leave.

Data protection runs alongside all this. Our GDPR checklist for AI sales tools covers that side, so we will not repeat it here.

What to ask the vendor before you sign

The AI Act puts most of its detailed obligations on providers, so your best protection is a clear written answer. Ask these six things:

Question	What a good answer looks like
What is the intended use?	A specific description, not "anything you like".
Does a human approve outputs?	Yes, by design, and nothing is sent automatically.
Which model provider processes our text?	Named, with the data route explained.
Is our data used for training?	A clear statement, backed by the provider's terms.
Where is data stored and processed?	Honest about storage versus model processing.
What documentation and support do you give deployers?	Usage instructions, limits, a contact for incidents.

For a longer list, see seven questions to ask an AI sales vendor before you sign. Be wary of the phrase "EU-hosted". An EU server tells you where data is stored, not where the model processes it; this article explains the difference.

An email you can send to a vendor

Copy, adjust and send this to any vendor on your shortlist:

Subject: AI Act and data questions before we start a trial
Hello [name],
We are a [number]-person B2B company considering your tool for drafting replies and quotes to customer enquiries. Before we start, could you confirm in writing:
1. The intended purpose of the system and any uses you advise against.
2. Whether a person approves every output before it is sent, and whether anything can be sent automatically.
3. Which company's language model processes our text, and whether our data is used for training.
4. Where our data is stored and where it is processed.
5. What instructions and documentation you provide to customers using the tool.
6. How we export our data if we stop using it.
Thank you,
[name]

Vague or evasive answers are information too. Score them side by side before you decide.

How BOTrento approaches this

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-ups, built around human control. It watches enquiries in your mailbox and uploaded data, shows a "Today 1+3" overview each working morning, and prepares draft replies, quotes and follow-ups in four languages. It sends nothing itself: a person approves every draft. See the process walkthrough for how that looks day to day.

On data, we store it on servers in Germany (EU). The language model processes only the text needed for the task, through a commercial provider's API, by default our account or optionally your own key (currently Anthropic only; see API key help). Commercial API providers do not use that data for training. An EU server that calls an external AI API is not a closed environment, and we do not claim it is.

We do not claim that using BOTrento makes you "AI Act compliant". That depends on your wider use and context. What we can give you is a clear intended use, human approval, a known data route and an export when you leave. AI is included in the plan with a monthly usage limit, and the 14-day free trial needs no card and no API key of your own. The 14 days start with your first successful data upload, so you test on your real enquiries.

Keep it simple: a one-page internal rule

Whatever tool you pick, write a one-page rule your team can follow:

Which tool is approved, and for what.
What must never be pasted in, such as confidential attachments or special-category personal data.
Who approves drafts, and that nothing goes out unreviewed.
Who to tell when the AI gets something wrong.

This works the same whether your team lives in Gmail, Outlook, HubSpot or Pipedrive. Teams in events and production, equipment rental and B2B services often juggle many quotes at once, which is exactly where unreviewed AI output would hurt.

FAQ

Is my sales AI assistant compliant with the AI Act?

It depends on what it does and how you use it. For drafting replies and quotes with human approval, the risk is generally lower, but ask the vendor for written confirmation of intended use, data handling and documentation, and check unclear cases with a lawyer.

Do small businesses have to comply with the AI Act?

The Act applies to companies of all sizes, but the obligations depend on your role and the use case. If you simply use a vendor's tool, you are usually a deployer, with duties around oversight, staff understanding and transparency.

Does the AI Act apply to generative AI used in sales emails?

Generative AI is covered, and providers of the underlying models have their own duties. As a user, you should keep a person in the loop, know your data flow and be open with people where required.

Is an EU-hosted AI tool automatically AI Act compliant?

No. EU hosting only says where data is stored. It does not tell you where the language model processes text or whether the tool suits your use case.

Do I need a risk assessment before using an AI sales tool?

A short written assessment is good practice: the use case, the data involved, who approves output and what could go wrong. Formal obligations depend on the risk category, so ask a lawyer if your use is more than drafting.

Summary

If you buy an AI sales tool, you are usually a deployer; the vendor carries most provider duties.
Judge risk by use: human-approved drafting is generally lower risk than automated decisions about people.
Keep a person approving every email and quote, and train the people who use the tool.
Get written answers on intended use, model provider, data route, training and export.
"EU-hosted" is not the same as "processed in the EU"; ask about both.
Take unclear or higher-risk cases to a lawyer.

Try BOTrento free for 14 days

Start the 14-day free trial of BOTrento and review the draft replies, quotes and follow-ups yourself before anything is sent. Our person will contact you within 24 hours on working days to help connect your mailbox. Fill in a few details and your access arrives by email right away. We are happy to help you connect your mailbox.

14 days free, no card and no API key of your own. The trial starts only once your data is first loaded. Then from €79 per month excl. VAT, AI included.

Nothing is sent without your approval. You add a card at the end, only if you continue; without payment access is blocked until you pay, we keep your data for 30 days and the export stays available. Pricing · See the process demo