AI voice agents can now hold a natural conversation, book appointments and follow up with customers. Regulators have noticed. In the US, an AI voice on an outbound call is legally the same as a robocall, with damages of up to $1,500 per call. In the EU, every AI agent must now say that it is an AI. And on both sides of the Atlantic, recording a call without the right basis can turn a helpful assistant into a liability.
The good news: the rules are knowable, and almost all of them can be built into the product. This guide summarises what applies in the US, the EU and Germany as of October 2026, and turns it into a checklist you can hand to your team or vendor.
This article is practical guidance, not legal advice. Rules change and details depend on your use case, so have a lawyer review your consent forms and scripts before you launch outbound campaigns.
The short version
| Market | Rule | What it means for an AI call |
|---|---|---|
| United States (federal) | TCPA as applied by FCC ruling 24-17 | AI voice = artificial voice; consent before AI calls; identification and opt-out on every call |
| United States (states) | Texas SB 140, Florida rules, California SB 1001 and AB 489 | Early AI disclosure, consent that names AI, bot disclosure, extra rules in healthcare |
| European Union | AI Act, Article 50(1) | Tell people they are talking to an AI, no later than the first interaction |
| European Union | AI Act, Article 5(1)(f) | No emotion recognition of employees |
| European Union | GDPR | Legal basis and notice for recording, processing agreements, transfers, retention |
| Germany | §201 StGB, §7 UWG | Recording without consent is a crime; automated advertising calls need prior express consent |
United States: the TCPA after the FCC’s 2024 ruling
On 8 February 2024 the FCC issued declaratory ruling 24-17: voices generated by AI are “artificial or prerecorded voices” under the Telephone Consumer Protection Act (FCC 24-17). Every rule that applies to robocalls therefore applies to AI voice agents placing calls.
| Call type | Consent required | Notes |
|---|---|---|
| Marketing or sales call with an AI voice | Prior express written consent (PEWC) | The consent should name your business; in Florida it must explicitly mention AI |
| Informational call (appointment reminder, order status) | Prior express consent; oral consent can be enough | Keep a record of when and how consent was given |
| Inbound call answered by an AI | TCPA consent rules target calls you place | Disclosure, recording notices and privacy rules still apply |
Every outbound call must identify the business on whose behalf it is made and provide a way to opt out (Retell TCPA playbook, CallSphere). The operational rules that trip companies up most often:
- Revocation of consent. Since April 2025, customers may revoke consent “by any reasonable means”, and the revocation must be honoured within 10 business days. The broader rule that one opt-out applies to all of a company’s messages has been deferred until 31 January 2027.
- Do Not Call. Lists must be checked at least every 31 days.
- Calling hours. Only between 8 a.m. and 9 p.m. in the recipient’s local time, which means your system needs to know each contact’s time zone.
Penalties are $500 to $1,500 per call with no overall limit, and class actions are common. Reported settlements include QuoteWizard at $19 million and Gen Digital at $9.95 million (Retell TCPA playbook).
Federal disclosure and state rules
The FCC proposed a rule (NPRM 24-84) that would require AI disclosure at the start of every call, but as of 2026 it has not been finalised (CallSphere). States have moved faster:
- Texas (SB 140): disclose the use of AI within the first 30 seconds.
- Florida: written consent must explicitly mention AI.
- California: SB 1001 requires bot disclosure; AB 489 adds rules for healthcare.
- Fifth Circuit: in Bradford v. Sovereign Pest Control (February 2026), the court held that oral consent can be sufficient in its states (Texas, Louisiana, Mississippi). Written consent remains the safer national standard.
Recording. Several states require the consent of all parties to record a call. The standard practice is a clear notice at the start: “This call is recorded.”
Marketing claims are regulated too
The FTC also watches what AI calling vendors promise. It sued Air AI in August 2025 over deceptive claims about business growth and earnings; the March 2026 settlement included an $18 million judgment, mostly suspended, and a ban on marketing business opportunities (FTC). If a vendor promises an autonomous sales team that pays for itself, ask for evidence.
European Union: AI Act transparency and prohibited practices
Article 50(1) applies from 2 August 2026: AI systems that interact with people must be designed so that those people are informed they are interacting with an AI, no later than the first interaction, unless this is obvious from the context (AI Act, Article 50). Violations can be fined up to €15 million or 3% of worldwide annual turnover (AI Act, Article 50, Jones Walker); for SMEs, the lower of the two amounts applies (ActuIA).
Two clarifications matter in practice:
- The Digital Omnibus did not delay this. Regulation 2026/1744 postponed the high-risk obligations to December 2027 and August 2028, but the transparency duties of Article 50 still apply from August 2026 (Jones Walker).
- Do not rely on “obvious”. A modern voice agent is designed to sound natural, so the exception rarely fits a phone call. Put the disclosure in the first sentence.
In Germany, the Bundesnetzagentur has been designated as the supervisory authority under the KI-MIG act, in force since 29 July 2026 (ActuIA). For the wider picture of deadlines, read our EU AI Act guide for small and mid-sized businesses and the deep dive on Article 50 transparency.
Article 5(1)(f) has prohibited emotion recognition in the workplace since 2 February 2025 (AI Act, Article 5). For call centres this rules out tools that infer how stressed or engaged employees are from their voices. Quality control is still allowed, but it must assess behaviour and outcomes, not emotions.
Voice cloning. Do not clone the voice of a real person without explicit consent. Using a stock synthetic voice is the simpler and safer default.
GDPR: recording, transcripts and vendors
An AI call creates personal data at every step: audio, transcript, summary, CRM fields. The essentials:
- Legal basis. Recording requires a legal basis, typically legitimate interest or consent, documented before launch.
- Notice at the start of the call. Who is processing the data, why, and where to find the privacy notice.
- Processing agreements. A data processing agreement under Article 28 with every vendor in the chain (telephony, speech, LLM, voice platform) and an up-to-date list of subprocessors. US platforms require a transfer mechanism such as standard contractual clauses or the EU-US Data Privacy Framework.
- Retention. Define how long recordings and transcripts are kept, and delete them automatically.
- Impact assessment. Call recording and especially voice biometrics usually call for a data protection impact assessment.
- Data location. Minimise transfers to the US and offer EU hosting where clients expect it.
Our separate guide on GDPR for AI chatbots and assistants covers processing agreements, logs and data residency in more depth.
Germany: the strictest common case
- Recording: under §201 of the Criminal Code, recording the spoken word without consent is punishable by up to three years in prison (§201 StGB).
- Automated advertising calls: §7 of the Act against Unfair Competition requires prior express consent for advertising calls placed with automated calling systems (§7 UWG).
If your setup works in Germany, it will usually satisfy the rest of the EU on these two points.
Inbound versus outbound: the risk profile
| Scenario | Risk level | Key requirements |
|---|---|---|
| AI receptionist answering inbound calls | Low | Disclosure, recording notice, GDPR basis, processing agreements |
| Outbound informational calls (reminders, confirmations) | Medium | Prior consent, identification, opt-out, calling hours |
| Outbound marketing or database reactivation | High | Written consent (US), express consent (Germany), DNC checks, consent logs |
| Cold calling with an AI voice | Very high | In most cases, simply do not |
| AI quality control of employee calls | Medium | No emotion recognition in the EU, recording basis, transparency towards staff |
This is why we usually recommend starting with inbound use cases such as an AI receptionist: the business value is clear and the legal exposure is low.
The compliance kit: a checklist
| # | Item | Market |
|---|---|---|
| 1 | Consent form that names your brand and explicitly mentions AI | US, especially Florida |
| 2 | Opening line: “This is the AI assistant of [company]. This call is recorded.” | All |
| 3 | Voice opt-out command that writes a block to the CRM immediately | All |
| 4 | Do Not Call checks and calling windows by the contact’s time zone | US |
| 5 | Consent evidence log: when, where, which wording, which channel | US, EU |
| 6 | No cloning of real people’s voices without consent | All |
| 7 | Data processing agreement template, subprocessor list, EU hosting option | EU |
| 8 | Retention schedule with automatic deletion | EU |
| 9 | Transfer to a human on request | All |
| 10 | No emotion recognition of employees in QA | EU |
Consent wording that holds up
Consent is only as strong as its wording and its evidence. For a US web form that leads to AI calls, a checkbox that is not pre-ticked and sits next to text like this is a sound starting point for your lawyer to adapt:
“I agree that [Company] may call and text me at the number provided, including with an AI-generated voice and automated technology, about [appointments / offers]. Consent is not a condition of purchase. I can opt out at any time by saying or replying STOP.”
Store the evidence with every contact: the exact wording shown, the page URL, the timestamp, the IP address or channel, and the phone number entered. When a complaint arrives months later, that record is your defence. In the EU, align the same form with your privacy notice and, for German advertising calls, make the consent explicit and specific.
Disclosure lines that work
Keep it short, friendly and first:
- “Hi, you’re speaking with the AI assistant of Bright Dental. This call is recorded. How can I help?”
- “This is an automated call with an AI assistant on behalf of Smith Plumbing, about your appointment tomorrow. Say ‘stop’ at any time and we won’t call again.”
Common mistakes
- “It’s inbound, so no rules apply.” TCPA consent may not apply, but disclosure, recording and GDPR rules do.
- Buying leads with vague consent. Consent that does not name your business, or AI where required, does not protect you.
- Opt-outs that do not propagate. A “stop” captured by the voice agent must reach the CRM, the dialler and every vendor.
- Ignoring time zones. A national list called from one office’s clock breaks calling-hour rules.
- Recording first, informing later. The notice belongs in the first seconds of the call.
- Relying on the vendor’s badge. A platform’s SOC 2 or HIPAA status covers its infrastructure, not your consent records and scripts.
Conclusion
AI phone calls are legal when consent, disclosure and recording are designed in from the start, and expensive when they are bolted on later. Start with inbound calls, disclose the AI in the first sentence, give every caller an easy way out, keep evidence of consent, and treat processing agreements and retention as part of the product. That combination keeps you compliant in the US and the EU and also makes the experience more trustworthy for callers.
If you would like your voice setup or call scripts checked against these rules, book a free 15-minute AI audit. Compliance is built into every voice agent we deliver.