The demo went well. The head of customer service at an insurer watched a week of her own team’s calls come back scored, every one of them, with the line from the transcript behind each score. On Friday she forwarded the proposal to compliance.
On Monday it came back with five questions.
They were the right questions. Most banks and insurers ask some version of them, and the ones who ask before the pilot rather than after it buy faster, because nothing surprises them in procurement. Here are the five, what the rules actually say, and the answer a vendor should be able to give in writing.
AI call scoring in a bank or insurer touches four sets of rules: the GDPR, DORA, the EU AI Act and the complaints-handling guidelines. Each asks for something specific. Know where every call goes. Put the contract on your DORA register. Treat AI that scores your agents as high-risk from December 2027. And use the scores to find the root causes of complaints, which the guidelines already ask you to do.
1. Where do our customers’ calls go?
Start with the data, because every other answer depends on it. A recorded call holds personal data about your customer and your employee, often things neither would put in writing. You remain the controller, and Article 28 of the GDPR lets you use only processors that provide “sufficient guarantees”.
In practice that means a list: every company that touches the calls, what it sees and in which country. Ask for it before the demo. Then ask the two follow-ups that vendors tend to answer vaguely. Does any step run outside the EU? And does the language model hear the audio, or only read a transcript?
Our answers are on our security page. We transcribe recordings on speech models we host ourselves and store everything in Stockholm. Removing personal data and scoring the call are done by a language model that reads the transcript, never the audio. By default that model runs on a global AWS profile, so transcript text, before personal data is removed, can be processed outside the EU. For organisations that need every step in the EU, we run both on a model pinned to AWS’s EU regions instead.
2. Is this an ICT service under DORA?
Almost certainly. DORA defines ICT services as digital and data services provided “on an ongoing basis”, and a hosted tool that stores and analyses your calls is one. DORA has applied in the EU since 17 January 2025, and in Norway since 1 July 2025.
That has two consequences for the purchase:
- The register. Article 28(3) requires you to keep a register of every contractual arrangement for ICT services, and to report on it to your supervisor at least once a year. The scoring tool goes on it.
- The contract. Article 30(2) sets the minimum terms: a full description of the service, where it is provided and where the data is processed, service levels, whether subcontracting is allowed, and your right to terminate.
If the service supports a critical or important function, Article 30(3) asks for more, including precise performance targets. For most firms, quality assurance won’t qualify. But that call is yours to make, not the vendor’s, and it changes which contract you need, so make it before anyone drafts one.
3. Is AI that scores our agents high-risk?
Probably. Annex III of the AI Act lists, as high-risk, AI systems intended “to monitor and evaluate the performance and behaviour of persons” at work. Software that scores how each agent handles each call is hard to describe any other way.
Those obligations were due on 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved them to 2 December 2027. Most of the work falls on you, as the employer using the system:
- Human oversight. People with the competence and the authority have to be able to check the scores and correct them. A score nobody can trace back to the call can’t be checked.
- Telling your people. Before you put a high-risk system into use at work, Article 26(7) requires you to inform the affected workers and their representatives. In Norway, the Working Environment Act already requires you to discuss control measures with employee representatives; in Sweden, the Co-Determination Act usually means negotiating with the union first.
- Logs and monitoring. You keep the system’s logs for at least six months (Article 26(6)), and you watch how it performs in use.
One rule isn’t deferred at all. Since 2 February 2025, Article 5 has banned AI that infers the emotions of people at work, apart from narrow medical and safety uses. The Act defines emotion recognition by biometric data, such as a voice. So ask every vendor how they judge “tone” or “empathy”: from what the agent said, or from how they sounded? Scoring a transcript against criteria like “acknowledged the problem before offering a fix” is a judgement about words. Reading feelings from a voice at work is banned.
In Norway, the AI Act isn’t law yet. Plan for the EU dates anyway.
4. Will it help us with complaints?
The complaints guidelines for banks, investment firms and insurers ask for more than a register of complaints. The ESMA and EBA guidelines and EIOPA’s guidelines for insurers both ask firms to analyse complaints data on an ongoing basis, “to identify root causes common to types of complaint”, and to fix them. Finanstilsynet’s circular 4/2019 asks the same of Norwegian firms.
Complaints are a poor place to look for root causes. They arrive weeks after the call that caused them, only from the customers who bothered, and they describe the symptom. When Sweden’s Finansinspektionen reviewed insurers’ complaints handling, it found that most were not analysing their complaints data continuously.
Scoring every call moves the analysis upstream. Turn your most common complaint causes into criteria, such as “explained the excess before the customer agreed” or “confirmed the cancellation terms”, and you see how often they’re missed on the calls that never became complaints. When a complaint does arrive, you can find the call, the moment, and every other call with the same miss. That is root-cause analysis with evidence attached.
5. Can you show us why one call got its score?
Ask the vendor to open a scored call and show you the line in the transcript behind each score. Then ask what happens when an agent disagrees.
The first four questions all end here. Human oversight under the AI Act depends on it. Internal audit will test it. Agents will only accept scores they can see and challenge. And when a supervisor asks how a complaint was handled, “the model gave it a 2” is not an answer. The call, the moment and the criterion are.
In Future Ready, every score comes with the quotes from the call that led to it. Agents can dispute any score. A manager rules on it, the ruling is logged next to the score, and it counts towards how often the AI agrees with your people, so you can see where it doesn’t.
A checklist before you sign
- Get the sub-processor list, with what each company sees and where it runs.
- Decide whether every step must stay in the EU, and put the answer in the contract.
- Add the service to your DORA register, and check the contract against Article 30(2).
- Assess the system against Annex III now, and talk to employee representatives early.
- Ask how the vendor judges tone: from words, or from voice.
- Put your top complaint causes on the scorecard.
- Open three scored calls and check the evidence behind every score.
Answered in writing, the five questions are most of what procurement will ask for.
Send us your compliance team’s questions. We’ll answer them in writing, with our sub-processor list and ISO 27001 and 27701 certificates, before a single call is scored.
