and back to VERA, maybe the main issue about this is privacy, do all activity from user will be stored on a database to personalized activity or it will destroyed after the event already done. as your example "Hi, VERA, book me a ticket", when she is doing the task, what happen after this activity?
IMHO, as long as Elitium complies with the GDPR, it won't be a problem (from the legal perspective) because companies always have their customers record. The problem is with security, like how to prevent data leak, stolen, etc.
Since we don't have GDPR here, when we use local online booking platforms, our privacy is at higher risk.