Use case · Customer operations
Keep customer-support AI inside a clear and reviewable operating boundary.
A support assistant can draft text, answer customers, retrieve account information or take actions. Those are materially different uses. EU AI Fit helps teams record what the system may do, how people are informed, when a human takes over and what evidence shows the controls operate.
Product demonstration · 2 minutes 14 seconds
Operational AI assurance
Connect risks, controls, indicators, incidents, FRIA readiness, recovery exercises and recurring managed reviews using hypothetical data. All organisations, people and systems shown were created for demonstration, and no client data appears.
Watch on its own page with the full transcriptRead the video transcript
Putting an AI system into use is not the end of governance. It is where operational assurance begins. EU AI Fit gives the team one view of the risks, decisions and follow-up work that need attention. Instead of relying on a static register, the command centre brings together current risk ratings, overdue reviews, open incidents, and actions requiring an owner. Each risk has a clear cause, possible harm and accountable owner.
Controls record what the organisation is doing to reduce the risk, while indicators define what the team will observe, how often it will review the result, and when it must escalate. Here, fictional housing provider Harbourlight records a near miss after an urgent heating outage was suggested as routine. The team can examine the facts, decide whether the event meets an internal or regulatory reporting threshold, and retain the rationale.
EU AI Fit supports that decision. It does not declare an event reportable automatically. Readiness exercises help people rehearse before the pressure is real. Roles, communication templates, escalation steps, and lessons learned are preserved as evidence. Recovery exercises separately test whether governance records can be restored within the organisation's own recovery objectives, with corrective actions retained when improvements are needed.
For public bodies and certain deployers, the FRIA workflow structures the Article 27 fact-finding process. A not-required outcome is still a reviewable decision based on recorded facts, and it should be reconsidered after a material change. The managed compliance desk brings these signals into a recurring review cycle, inventory, classification, evidence, supplier assurance, incidents, training, regulatory updates, and actions.
The result is not a certificate. It is a practical operating record that helps people see what changed, who must respond, and what happens next. All organisations, people and operational events shown here are fictional. EU AI Fit supports governance workflow and evidence. It does not replace qualified legal or regulatory judgement.
Why this needs control
A helpful chatbot can become an uncontrolled decision or action channel.
Risk changes when a system moves from drafting a reply to giving authoritative information, interpreting vulnerability, making an eligibility judgement or changing a customer account. The organisation needs to govern those changes as new purposes, not ordinary feature releases.
Transparency is also contextual. The team must establish whether and when people should know they are interacting with AI, how escalation works and what evidence proves the disclosure and oversight controls are present.
In this scenario
Harbour Support Copilot
A subscription business wants one assistant to draft agent replies and answer routine customer questions directly.
- The internal drafting use is reviewed separately from the public chatbot.
- The public version may retrieve account facts but cannot change billing or cancellation status.
- Approved disclosure wording and human hand-off rules are not yet implemented.
- The model provider can change the underlying version with notice.
The organisation separates the two use cases, records the public interaction trigger, assigns disclosure and hand-off evidence, and creates a reassessment trigger for model or action-scope change.
Every organisation, person and system in this scenario is hypothetical and contains no client data.
Practical workflow
From proposed use to a maintained decision.
- 01
Separate each purpose
Record drafting, direct interaction, retrieval, recommendation and account action as distinct uses where their facts or controls differ.
- 02
Review transparency
Identify direct-interaction and synthetic-content triggers, approved wording, timing, accessibility and implementation evidence.
- 03
Define human authority
Set the hand-off conditions, prohibited actions, review sampling, override route and response to vulnerable or disputed cases.
- 04
Monitor the live boundary
Track output failures, complaints, security events, model changes and attempted use outside the approved purpose.
What the record should retain
Evidence follows the use case.
- Purpose-specific inventory records
- Direct-interaction disclosure decision
- Approved wording and interface evidence
- Human hand-off and override instructions
- Supplier model and change information
- Quality indicators, complaints, incidents and reassessment
Continue the review
Read the connected guidance.
Next step
Start with the system and use you are actually proposing.
Run the initial exposure check, then retain the deeper assessment, responsibility and evidence work inside a controlled workspace.
Run the free check