Zaplar’s Compliance with the EU AI Act

1. Scope and approach

Zaplar provides AI-enabled software for hotel operations. This statement explains the intended use of our AI features, the controls supporting compliance with the EU AI Act, and the responsibilities of Zaplar and its hotel customers. It concerns Regulation (EU) 2024/1689, as amended, and should be read alongside our Terms of Service, Service Description and Data Processing Agreement.

The applicable requirements depend on each feature’s intended purpose and use. Our assessment focuses on hospitality operations, configurable automation, human oversight and transparency. Features available to a particular hotel depend on its subscription and configuration.

2. How Zaplar uses AI

Zaplar’s agents help hotel teams retrieve operational information, prepare proposals, work with bookings and contacts, respond to guest enquiries and complete operational tasks. Depending on the hotel’s settings, an agent either completes permitted work or routes an action to the person responsible for approval.

The dedicated Guest Replies agent prepares email responses using relevant conversation and booking information. Its write actions, including sending replies, require human approval. The telephone assistant supports guest enquiries and booking-related requests. Revenue-management functionality uses models adapted to the hotel’s context to support pricing and apply qualifying automated pricing decisions within configured controls.

Zaplar uses existing AI models and does not train its own AI models. Hotel-specific adaptation for revenue management supports the hotel’s operations. Zaplar does not sell customer data.

3. Risk classification

For the intended uses described here, Zaplar assesses its AI features as falling outside the high-risk categories in Article 6 and Annex III. Booking administration, guest correspondence, ordinary hotel enquiries and room-price optimisation are not, by themselves, listed high-risk uses.

Zaplar does not use these features to evaluate employee performance or allocate work based on employees’ behaviour, personal traits or characteristics. Operational automation completes tasks or routes approvals according to the hotel’s responsibilities and configuration. It is not an employee assessment system.

An operational action can still be sensitive—for example, a significant booking change—without making the AI system “high-risk” under the Act. Approval safeguards address the consequences of the action. A materially different intended use would require its own classification assessment.

4. Hotel control and human oversight

Hotels choose the level of autonomy appropriate to their operations. Settings range from requiring staff approval for each change or outbound communication to extensive automation of permitted work. Designated sensitive actions remain subject to staff approval even at the highest available autonomy level.

Server-side controls restrict actions by the agent’s permitted tools, capabilities and action policy. Where a member of staff acts through the Assistant, applicable user permissions also constrain its actions. Background agents operate under their own registered permissions. Increasing autonomy does not grant unrestricted access to the platform.

Authorised staff can review pending actions and approve or decline them. The console provides activity information and a stop control for running chat turns. Administrators can disable event-driven work or revoke an agent’s authority. Stopping a run does not reverse actions already completed; those require the relevant operational correction.

5. Guest transparency and telephone safeguards

Staff use dedicated agent interfaces showing conversations, activity and approval requests. Contextual notices identify AI functionality and remind users that AI can make mistakes. The telephone assistant identifies itself as an AI assistant at the start of the call, including calls from returning guests.

For booking-related enquiries, callers are asked to provide their booking reference, email address and name. Major changes to a booking require staff approval. These steps form part of the caller-handling workflow and the separation between guest requests and authorised changes.

Interaction notices and machine-readable identification of generated content are distinct requirements under Article 50. Their application depends on the output and workflow. Standard editing and exclusively machine-to-machine outputs can fall outside marking requirements. Human approval alone does not establish a general marking exemption.

External providers’ technical measures are relevant to this assessment. For example, ElevenLabs states that its generated audio carries a watermark. Provider measures must be considered in the context of the feature and delivery channel; a spoken AI introduction serves a different purpose.

6. Reliability, traceability and incident handling

Agent actions are constrained by tool schemas, backend validation, permission checks and approval policies. Guest Replies instructions distinguish guest messages from trusted system instructions and direct the agent to seek human assistance when it cannot answer reliably. These safeguards support controlled use; AI-generated content can still contain errors and requires review appropriate to the task.

The system records action inputs, outcomes, policy decisions and approval information, together with run-level event history. These records support operational review and investigation. Revenue-management controls include validation of incoming pricing decisions, protection for newer manual pricing changes and limits on automated price movement.

Hotels can report errors through Intercom, contact their dedicated Zaplar contact person, or call the support number to reach the team on duty. Automated monitoring through Datadog alerts the Zaplar team to detected incidents. The hotel and Zaplar coordinate investigation and corrective action, using available activity and approval records to understand what occurred. These arrangements operate within the agreed support terms.

7. Data processing and providers

AI workflows may process guest correspondence, booking and contact information, staff instructions and, for telephone functionality, audio and transcripts. External model, speech and execution services process information relevant to the configured workflow.

The Data Processing Agreement describes processing on customers’ behalf, security commitments and subprocessor arrangements. GDPR obligations concerning lawful processing, access, retention and international transfers apply separately from AI Act classification. Hotel-specific model adaptation does not change those obligations or establish a blanket exemption from the AI Act.

8. Responsibilities and AI literacy

Zaplar is the provider of the AI systems it supplies under its name. Hotels generally act as deployers when using those systems in their operations. External general-purpose model providers have their own obligations. Each party remains responsible for the legal duties applicable to its role.

Zaplar provides a staff training programme and supporting documentation to help personnel understand and use its AI features. Together with contextual product notices and the available oversight controls, these measures support informed use of AI.

Under Article 4, providers and deployers each have responsibilities to support the AI literacy of relevant personnel. This concerns understanding the system’s capabilities and limitations, autonomy settings, approvals and escalation. Hotels are responsible for use and supervision by personnel acting under their authority; Zaplar has corresponding responsibilities for its own personnel.

This statement addresses Zaplar’s described hospitality uses and supporting controls. It does not represent an AI Act certification or extend the services and commitments agreed with a customer.