AI disclosure, recording consent and calling rules

0:00 The legal checklist

A voice agent can be brilliant and still get your business fined, sued or banned from a carrier network. Phone and marketing laws are detailed and they differ by country, and sometimes by state. This lesson isn't legal advice, but it gives you a checklist built around five questions every voice agent must answer: disclosure, recording, outbound calling rights, data protection, and content rules, across the EU, UK, US, the Gulf and Pakistan.

0:32 Why calling rules matter

Why take calling rules so seriously? Because they're some of the most actively enforced consumer protection rules in many markets, with per-call penalties, carrier blocking and regulator attention. A single outbound campaign without proper consent can create liability far larger than the value of the leads. Inbound agents carry lighter duties, but disclosure and recording notices still matter everywhere.

0:58 1. Disclosure

First, disclosure. Under the EU AI Act, from August twenty twenty-six, AI systems that interact directly with people must be designed so people know they're talking to AI, unless it's obvious. For a voice agent, say it in the first turn. In the US, several states have bot disclosure rules, and the FCC treats AI-generated voices in calls as artificial voices under the Telephone Consumer Protection Act. In the Gulf and Pakistan, guidelines emphasize transparency. So make disclosure your baseline everywhere. And if a caller asks, am I talking to a real person, always tell the truth.

1:40 Analogy: taxi rules

An analogy: compliance for voice agents is like the rules for driving a taxi. You need a license, which is consent to call. You follow the rules of each city you drive in, which are local calling hours and registries. You display your ID badge, which is the AI disclosure. You tell passengers if there's a camera, which is the recording notice. And you don't drive people who asked not to be picked up, which is honoring opt-outs. Break any one and you can lose the right to drive.

2:19 2. Recording

Second, recording and transcription. In the EU and UK, recording and transcribing calls is personal data processing, so you need a notice, a lawful basis, and short, purpose-bound retention. In the US, federal law allows one-party consent, but several states, including California, require all parties to consent. When in doubt, announce recording at the start. In the UAE and Saudi Arabia, privacy laws restrict recording and sharing communications. In Pakistan, announce it as good practice. One early line can cover both: hi, I'm Nova Dental's AI assistant, this call is recorded to help us improve our service.

3:01 3. Outbound rights

Third, outbound calling, the riskiest area. In the US, the TCPA requires prior express consent for artificial-voice calls to mobiles, and prior express written consent for telemarketing with artificial or prerecorded voices. Add the Do Not Call registry and calling hours, federally eight a m to nine p m local time, stricter in some states. In the UK, automated marketing calls need prior specific consent, and live calls must respect the Telephone Preference Service. The UAE's telecoms regulator, Saudi regulators and Pakistan's telecom authority all have telemarketing rules. Verify current rules per market, and keep evidence of consent.

3:44 4. Data protection

Service calls, like reminders a customer asked for, are treated differently from marketing in many places, but consent and fairness still matter. Fourth, data protection. Update your privacy notice for the voice agent, recordings, transcripts and vendors. Pick a lawful basis per purpose. Don't take card numbers by voice unless you have compliant handling, like keypad masking or a secure payment link. Set retention, for example thirty to ninety days for recordings. Know where audio is processed. And don't create voiceprints to identify people without the specific legal basis and safeguards.

4:24 5. Content rules + example

Fifth, content and sector rules. Health agents never diagnose and always give emergency guidance. Finance agents must respect rules on regulated advice, disclosures and complaints. Debt collection has strict conduct rules in many markets. And any sales claim must be accurate and substantiated. Here's a worked example: a UK solar installer calls US and UK leads. US leads are only those who ticked a written consent box naming the company and AI voice calls, called within local hours, scrubbed against Do Not Call, with disclosure up front. UK leads get AI calls only with specific consent; others get a human call after TPS screening.

5:09 Rules in code

Put these rules in code, not in the prompt. The lesson text includes a Python compliance gate that runs before every outbound call. It checks consent for automated calls, opt-outs and suppression lists, US Do Not Call status, the local time in the lead's time zone against a calling window, and daily attempt limits, and it returns a reason you can log. The time windows in the example are conservative placeholders. Set real ones from verified rules for each market. Never let the language model decide whether a call is allowed or whether to disclose AI.

5:51 Example 2: Leeds dental clinic (inbound only)

A simple example. A dental clinic in Leeds runs an inbound-only receptionist agent. No outbound calls, so the heaviest calling rules don't apply. Their checklist is short: the first sentence says it's an AI assistant and that calls are recorded; the privacy notice covers the agent and the vendor; recordings are kept for sixty days; card payments are never taken by voice; and callers asking for a person are transferred during opening hours. Proportionate compliance, done properly, in a day.

6:26 Common mistakes

Common legal mistakes. Treating a purchased lead list as consent. Recording without notice when some callers are in all-party-consent jurisdictions. Letting the language model decide whether to disclose AI, instead of fixing it in the first message. And forgetting opt-outs: every outbound call should make it easy to say stop, and the system must honor it immediately across all campaigns.

6:52 Watch me do it: compliance section

Watch me do it. I open the compliance section of Aria's config and fill a one-page checklist for each market. UAE, inbound only for now: first message includes AI disclosure and recording notice in English and Arabic, approved text; privacy notice updated; recordings kept sixty days; no card numbers by voice, we send a secure payment link instead. UK, inbound: the same, plus the notice follows UK data protection expectations. Now outbound reminders, which we plan for next quarter. I open the compliance gate function from the lesson text. I set the calling windows from our verified market rules rather than the placeholders, and I add a note citing where each rule came from and the date I checked it. I wire the function in front of the outbound call so nothing dials without passing it. Then I test it with five fake leads: one without consent, refused; one on the suppression list, refused; one where it's nine p m locally, refused; one who was already called today, refused; and one with consent inside the window, allowed. Every decision writes a log line with the reason. Finally, I add an opt-out phrase handler: if someone says stop calling me, the agent confirms, ends politely, and a tool adds them to the suppression list immediately.

8:25 Recap and next step

Recap. Every voice agent must answer five questions: disclosure, recording, outbound rights, data protection and content rules. Disclose AI in the first turn everywhere. Announce recording. Treat outbound calls as consent-gated and time-bound, with evidence. Minimize and secure voice data. And enforce rules in code. Your next step: build a one-page legal checklist for each market you call, confirm it with counsel, and wire the compliance gate into your outbound flow.