← Industries/Customer Support SaaS
Promethean for Customer Support SaaS
AI Act Art. 50 mandates disclosure: customers interacting with an AI agent must know it's AI. GDPR Art. 22 applies when refund eligibility or service decisions are AI-decided. Consumer-protection regulators are turning attention to AI agent accuracy. Promethean is the evidence layer that makes 'we know what every AI agent said, to whom, under which policy version' structurally verifiable — without proxying your LLM calls.
Who this is for
Product + compliance teams in support-automation SMBs (AI agents · ticket routing · autoresponders · sentiment + intent classification). Typically:
- Seed–Series B support SaaS or in-house support team with 5–80 engineers; 1–5 AI features in production.
- Customer base mixes B2C consumer products + B2B SaaS — both have AI-agent disclosure obligations.
- Ticket volume: 100k–10M AI-touched interactions per month across all customers.
- Multi-tenant by customer brand; each customer may have its own policy + tone-of-voice spec.
- Procurement pressure: enterprise customers ask for AI accuracy + disclosure evidence in SOC 2 vendor reviews.
The regulatory pressure
EU AI Act Art. 50 — transparency obligations
AI systems intended to interact with humans must be designed and operated so that the natural person is informed they are interacting with an AI. Synthetic content (text, image, audio) must be machine-readably marked as AI-generated.
GDPR Art. 22 — automated refund / eligibility decisions
When the AI agent decides refund eligibility, service tier changes, or account-status outcomes, Art. 22 applies. Solely-automated decisions need explicit consent or contractual necessity + meaningful human intervention.
Deep-dive →Consumer Protection Cooperation (CPC) Regulation 2017/2394
EU consumer-protection authorities coordinate on misleading commercial practices. AI agents giving inaccurate information about products, refunds, or rights are within scope under Unfair Commercial Practices Directive 2005/29/EC.
GDPR Art. 5 + 32 — data minimisation + security
Customer conversations contain personal + sometimes special-category data. The substrate's hash-only design avoids storing the raw content in the audit chain; security obligations apply to your retained transcripts.
Where LLMs typically run in Customer Support SaaS
AI support agent (frontline chatbot)
Drafter producing conversational responses to customer queries. AI Act Art. 50 disclosure built into the spec; reviewer-gate on schema violations + sensitive-topic flags; deterministic fallback to human handoff on schema failure.
Ticket routing + priority classification
Classifier assigning incoming tickets to queues + priority bands. Closed-enum output; chain provides evidence of SLA assignment fairness across customer cohorts.
Refund / eligibility recommendation
Classifier producing refund-eligible / not-eligible / escalate verdict. Always-human reviewer gate on high-value refunds; Art. 22 challenge evidence per decision.
Sentiment + intent classification
Per-message classifier producing sentiment score + intent label. Schema-bound output; chain shows distribution + drift over time.
How the substrate maps to your audit
| Your LLM feature | What the regulator asks | Promethean evidence |
|---|---|---|
| AI agent disclosure | Art. 50: was the user informed they're interacting with AI? | Spec's promptTemplate forces disclosure in opening turn; specHash binds requirement to every entry. |
| Ticket routing fairness | Are SLA assignments biased against any customer cohort? | tenantId + verdict per L12 entry; statistical analysis against chain export. |
| Refund decision | GDPR Art. 22: was a human meaningfully involved? | Reviewer-gate firings + verdicts; override rate computable from chain. |
| AI agent accuracy | Consumer-protection: did the agent give materially wrong information? | outputCanonicalHash binds the response; spec + model identity per entry enable accuracy auditing. |
| Enterprise customer SOC 2 vendor review | Per-customer audit bundle showing AI behaviour in their tenant. | Multi-tenant chain export filtered by tenantId; verifier validates with verify.mjs. |
Which Promethean tier fits
Recommended for typical SMBs in Customer Support SaaS
Team€79 / spec / month
Unlimited specs; €79 per active spec per month. 100k entries per spec. Daily OTS anchoring. Single-tenant.
Support SaaS typically runs 2–5 specs (agent, router, refund-classifier, sentiment) — Team tier at €79/spec/month is the natural starting point. Upgrade to Production (€499 flat) once you cross ~6 active specs or hit 1M entries/month, especially when serving multi-tenant enterprise customers needing per-tenant audit bundles. Federation read-only fits naturally for support platforms with regional data residency requirements.
Larger Customer Support SaaS operators with multi-tenant or framework-template needs upgrade to Production (€499 / month flat).
What this looks like in practice
Hypothetical: a B2C support-AI SMB during a consumer-protection inquiry
A support-automation SMB serving 80 D2C brands receives a consumer-protection inquiry: the AI agent allegedly told several customers they were eligible for refunds outside the published returns window, then the brand refused to honour them. The authority asks: 'Provide evidence of what the AI agent told customers in the affected period; demonstrate which policy version was active; demonstrate the disclosure (Art. 50) was given.' Without Promethean: chat-log reconstruction across customers; no clean evidence of which prompt template was active when. With Promethean: chain-export shows specHash transitions over the affected period; each AI-response L12 entry carries the spec + model identity; the operator demonstrates that policy-conflicting responses were caused by a specific spec version + reverted on date X. The inquiry concludes with a corrective action, not a fine.
Frequently asked
We don't decide refunds — we just answer questions. Is GDPR Art. 22 still in play?
Probably not for pure informational responses (status updates, product Q&A) — those typically don't produce legal effects. But the moment the AI agent's output influences a service decision (eligibility, account closure, fee waiver), Art. 22 attaches. The L12 chain helps establish where the AI's authority actually ends; if the chain shows your agent only ever drafted text for human approval on consequential decisions, that's strong evidence the AI didn't decide.
How does AI Act Art. 50 disclosure enforcement actually work?
Art. 50 says the user must be informed at the latest at the first interaction. The spec's promptTemplate can require the disclosure in the system prompt or opening turn; the spec hash binds that to every chat-response L12 entry. If someone removes the disclosure from the spec, the spec hash changes — visible in the chain. A regulator inspecting your chain can see exactly which disclosure language was active across what time window. The substrate doesn't enforce the text content; it enforces that the spec (which contains your disclosure language) was the version active.
AI agents hallucinate. How does Promethean help when ours gets caught giving wrong information?
Two ways. First, the schema-bound output: closed-enum verdicts (e.g. 'eligible / not eligible / escalate') prevent free-text drift on consequential decisions. Second, the reviewer-gate + override-rate. If your spec requires human review on refund recommendations and the override rate is non-trivial, that's empirical evidence the human review is meaningful — a defence against 'the AI was operating without oversight'. For pure conversational agents (where free-text is the product), the spec hash + model identity per entry let you isolate which version produced the bad output and what its operating envelope was.
Customer conversations contain personal data. Where does it sit?
Not in the L12 chain. The substrate's hash-only design (inputHash + outputCanonicalHash are SHA-256) means raw conversation content never enters Promethean. Your platform retains the transcripts under your retention policy — Promethean is the audit-trail layer that proves what decisions the AI made, not the store for the conversation itself. GDPR Art. 5(1)(c) data-minimisation is satisfied by construction.
Procurement at enterprise customers is asking for AI-evidence in vendor reviews. Does Promethean help?
Yes — increasingly directly. Enterprise customers buying AI-touched support tooling now ask vendors for evidence of: per-decision audit trails, model + prompt versioning, human-in-the-loop verification, disclosure compliance. Production tier provides a per-tenant audit bundle (filtered to the enterprise customer's tenantId) that they can verify with verify.mjs. The bundle is the answer to 'show me how your AI made decisions in our tenant during Q3' — concrete, verifiable, and not vendor-attested.
Definitions used on this page
The substrate primitives referenced above (L12 receipt chain, spec hash, reviewer gate, fallback behaviour, OpenTimestamps anchor, tenant ID) all have canonical definitions in the glossary: