AI agents in customer service: a practical guide for German companies

An AI agent in customer service is a language model connected to your help centre, your order and customer data and your written policies, so that it can answer questions in its own words, look things up and carry out defined actions such as starting a return. Deployed well, it resolves the routine half of your inbox in German and English, around the clock, and hands everything else to a person with a clean summary. Deployed badly, it invents policies, traps customers in loops and hides the damage behind a flattering containment rate. This guide covers what to automate, where answers must come from, hand-off rules, integrations, honest metrics, the GDPR and AI Act duties, and a staged rollout.

#AI chatbot vs AI agent: what actually changes

Most companies in Germany already had a chatbot: a decision tree with buttons, a few keyword triggers and a fallback to a contact form. It never said anything wrong because it never said anything it was not given verbatim. It also rarely solved anything.

An agent works differently. It reads the customer's message, retrieves the relevant passages from your sources, calls tools (look up order 48213, check the return window, create a ticket) and writes a reply. That makes it far more useful and far more capable of being confidently wrong. Gartner predicts that agentic AI will resolve 80% of common service issues without human intervention by 2029. Treat that as a forecast, not a target for your first quarter.

#What to automate first, what to hand off, what never to automate

Export three months of tickets and tag them by intent. In most help desks a handful of intents make up a large share of the volume, and the best first candidates share three traits: the answer exists in writing or in a system, the customer can be identified safely, and a wrong answer is cheap to correct.

The never list is not about capability. A refusal that significantly affects someone and is made by software alone raises Article 22 GDPR on automated decisions. Cancellations and withdrawals have their own statutory routes in Germany: the cancellation button under § 312k BGB and, since 19 June 2026, the electronic withdrawal function under § 356a BGB. An agent may point customers to them, but it must never become the obstacle in front of them.

Hand-off rules

Write hand-off rules down before you configure anything, and make them hard triggers rather than suggestions to the model. The agent should pass the conversation to a person when:

• the customer asks for a human, in any wording, once; never make them ask twice
• the topic is on the never list, detected by intent and by keywords such as Anwalt, Beschwerde, Datenschutz or Widerruf
• retrieval finds no source above your confidence threshold, so the agent would have to guess
• an action fails, or the same question has been asked three times without progress
• sentiment turns clearly negative, or the order value or customer tier crosses a set limit

A good hand-off carries a summary, the customer's identity check status, what was already tried and the sources consulted, so the person never asks the customer to repeat themselves. Gartner's customer survey found that 64% of customers would prefer companies did not use AI in service, and their top concern was that it would become harder to reach a person. A visible, fast route to a human is how you answer that concern.

#Where the agent gets its answers: retrieval, grounding and citations

An agent should answer from your sources, not from what the underlying model happens to know. The usual pattern is retrieval: your help centre articles, policy documents and macros are split into passages and indexed; for each question the most relevant passages are fetched and the model is instructed to answer only from them. Live facts (order status, tracking, invoice amounts) come from tool calls, never from documents.

• Grounding: if the sources do not contain the answer, the agent says so and hands off. This one instruction, tested hard, prevents most invented policies.
• Citations: the agent links the help centre article it used. Customers can check, and reviewers can see at a glance whether the answer matched the source.
• One source of truth: contradictions between an old PDF and the current returns page will surface in answers. Clean the help centre before launch; it is usually the largest piece of work.
• Ownership: every source has an owner and a review date, so a price or policy change reaches the agent the same day it goes live.

German and English

Current models handle German and English well, and customers in the DACH region switch between them, especially in B2B. Decide the rules rather than leaving them to the model: reply in the customer's language, use Sie unless your brand uses du, and in Switzerland write ss instead of ß. Keep one set of sources in German if that is your master language; the agent can answer in English from German passages, but test that product names, legal terms and units survive translation. Build your test set in both languages from real tickets.

#Connecting Zendesk, Freshdesk, HubSpot, Shopify and your ERP

You have two routes. The first is the agent built into your help desk: Zendesk AI agents, Freddy AI Agent in Freshdesk, or the Customer Agent in HubSpot, which ships with configurable hand-off triggers. These are fastest to start, priced per resolution or session, and strongest when your knowledge already lives in that tool. The second is a custom agent on a model API that connects to the help desk as one more channel. It costs more to build but gives you control over hosting, model choice, tools and evaluation, which matters once actions reach into an ERP.

Give the agent the least access that works, and never a general API key. Verify the customer before revealing order details, for example by order number plus postcode or a logged-in session. Shopify, for instance, gates apps that touch personal data behind its protected customer data requirements. Treat every customer message, email attachment and retrieved web page as untrusted input: prompt injection, where text tries to override the agent's instructions, is the top entry in the OWASP Top 10 for LLM applications. The defence is architectural: actions are limited by permissions and rules in code, not by the model's good behaviour.

#Measuring it honestly: containment is not resolution

Vendors and dashboards like containment: the share of conversations that never reached a person. It is the easiest number to inflate, because a customer who gives up counts as contained. Vendor billing metrics deserve the same scrutiny; Zendesk, for example, defines its own rules for when an automated resolution is counted. Define your metrics yourself and measure them the same way before and after launch.

#Running it under the GDPR, the AI Act and German labour law

An agent that reads order histories processes personal data, so the usual GDPR toolkit applies: a legal basis (usually performance of the contract, Article 6(1)(b)), a data processing agreement with each vendor under Article 28, an updated privacy notice under Article 13, a retention period for transcripts, and a check whether a data protection impact assessment under Article 35 is required. Read the vendor's terms on whether your data trains their models, and where it is processed. The German supervisory authorities' guidance on AI and data protection is a usable checklist; hosting options are covered in our post on GDPR-compliant AI hosting in Germany.

The AI Act adds a transparency duty that has applied since 2 August 2026. The Digital Omnibus on AI, published in July 2026, postponed high-risk obligations but did not move this one.

Article 50(5) requires the information to be clear and given at the latest at the first interaction, so put it in the agent's greeting and in email replies it sends, not in a footer. If you build the agent yourself, you are likely its provider; breaches of Article 50 can be fined up to EUR 15 million or 3% of worldwide turnover under Article 99(4). Swiss companies are caught when the output is used in the EU. Roles and edge cases are in our guide to the EU AI Act for AI agents.

#A staged rollout, with a worked example

Take a hypothetical spare parts retailer with 40 staff, six support agents and 9,000 conversations a month, 70% in German. Tagging three months of tickets shows order status at 28%, returns at 14% and invoice copies at 6%: 48% of volume, or about 4,300 conversations, in three low risk intents. The shop runs on Shopify, the help desk on Zendesk, the ERP on weclapp.

1. Shadow mode (weeks 1 to 3). The agent drafts internal notes on every ticket in the three intents; nothing reaches customers. Agents grade 400 drafts. Suppose 81% are correct, 12% need edits and 7% are wrong, mostly because two returns articles contradict each other. Fix the sources, re-run the test set, repeat.
2. Pilot (weeks 4 to 8). The agent answers live, but only for the three intents, only in chat, and only for 25% of visitors. Suppose it contains 66% of in-scope conversations, but 8 percentage points return within 7 days, so resolution is 58%. Two support agents review a daily sample and every hand-off.
3. Go-live (from week 9). Extend to all chat and email for the three intents, then add one intent at a time, each through its own shadow phase. In this example, 58% of 4,300 is roughly 2,500 conversations a month resolved without a person: real time back, but far from the headline figures vendors show.

#Common failure modes

• Invented policy. The agent fills a gap with a plausible rule. Cause: weak grounding, or a test set that never asked about the gap.
• The loop. The customer asks for a person and gets the same answer reworded. Cause: hand-off left to the model's judgement instead of a hard trigger.
• Stale sources. Prices or delivery times changed last week, the article did not. Cause: no owner and no review date.
• Over-broad access. One API key that can refund, cancel and read every customer. Cause: integration done for speed, not with least privilege.
• Vanity metrics. Containment rises while repeat contacts and complaints rise too. Cause: no resolution metric and no sampled review.
• Scope creep. New intents added because the pilot looked good, without their own shadow phase. Cause: no release process for the agent.

#How we can help

If you are weighing an AI agent for your support team, Bespoke IT can run an AI audit: we tag a sample of your tickets, size the intents worth automating, check your sources, integrations and GDPR position, and give you a staged plan with the metrics to judge it by.