An AI voice agent is an automated assistant that holds phone conversations on behalf of a company: it takes calls, books appointments or calls customers for confirmations. Technically, this has become accessible. The part that needs the most care is the relationship with the person on the other end of the line.
People have the right to know who they are talking to, whether they are being recorded and what happens to their data. Below you will find the practical principles to keep in mind before launching a voice agent.
The good news is that these principles don't hold the project back. An agent that introduces itself properly, respects refusals and transfers quickly to a person creates a better experience for customers and fewer problems for the team.
In short
The agent says from the start that it is an automated assistant, announces whether the call is being recorded, makes commercial calls only with a valid legal basis (usually documented consent), immediately honours the request “don't call me again”, transfers to a person on request and keeps data only as long as necessary.
For information, not legal advice
This article provides general guidance and is not legal advice. The rules that apply depend on your company's specific situation, the type of calls and the legislation in force. Before launch, have your scripts, disclosures and legal basis checked by a lawyer or a data protection specialist.
Make it clear the caller is speaking to an automated assistant
The first principle is transparency. At the start of the conversation, the agent must say simply that it is the company's automated assistant. A short, natural phrase is enough, for example: “Good morning, you are speaking with the automated assistant of company X.”
Beyond the legal considerations, including the transparency obligations in the European rules on artificial intelligence, it is also a matter of trust. A customer who discovers halfway through a conversation that they have been talking to an automated system without being told may feel deceived. A very natural voice doesn't replace disclosure; it makes it all the more necessary.
Recording and transcribing calls: what to announce
Voice agents usually work with transcripts of the conversation, and sometimes with the audio recording too. Both contain personal data: the voice, the phone number and everything the caller says.
- Announce at the start of the call whether it is being recorded and for what purpose (for example, service quality or keeping a record of appointments).
- Establish the legal basis for recording and document it.
- Tell the caller where they can find out more, usually the privacy policy.
- Don't record more than you need: if the transcript is enough, you may not need the audio.
- Mask or avoid collecting sensitive data that isn't needed for the purpose of the call.
Inbound vs. outbound calls
The difference between the two types of call is essential. With inbound calls, the person calls you themselves, usually with a specific need: an appointment, a question, a complaint. The agent's role is to help them, inform them correctly and transfer them to a person when needed.
Even with inbound calls, disclosure remains mandatory, and the data collected must be used only for the purpose of the call. If, for example, someone calls to book an appointment, that doesn't automatically mean they can then be included in a promotional campaign.
With outbound calls, the company initiates the contact. Here the rules are stricter, especially when the call has a commercial purpose. Automated calls made without a valid legal basis may breach both data protection rules (GDPR) and the legislation on electronic communications and unsolicited commercial communications.
Consent and legal basis for outbound calls
Before any automated calling campaign, the basic question is: on what basis are we calling this person? For commercial calls made by an automated system, the general rule is that you need the person's prior consent, obtained properly and documented.
- Consent must be specific: agreeing to an email newsletter doesn't automatically mean agreeing to automated calls.
- Keep proof of consent: when, how and for what it was given.
- Service calls (confirming an appointment the customer requested, for example) may have a different basis from promotional ones, but the difference needs to be analysed case by case.
- Contact lists that are bought or taken from unknown sources are a major risk and should be avoided.
- Stick to reasonable calling hours and a frequency that doesn't become harassment.
The rules for automated commercial calls differ depending on the recipient (an individual or a company), the purpose of the call and how you obtained the data. A lawyer or a data protection specialist can help you confirm the legal basis before your first campaign.
The right to refuse and transfer to a person
Anyone must be able to say simply “don't call me again” and have that respected. The voice agent must recognise this request, confirm it politely and record it in an exclusion list that is checked before any future call.
Transfer to a person is just as important. The caller should be able to ask at any time to speak to an operator. Some subjects, such as complaints, medical, financial or legal issues, or situations where the person seems upset or confused, should be routed automatically to a colleague, without the agent trying to resolve them on its own. If no operator is available, the agent can take the details and promise a call back within a realistic timeframe.
How long to keep recordings and transcripts
Call recordings, transcripts and summaries shouldn't be kept indefinitely. Set a retention period for each type of data, according to the purpose for which you collect it, and apply it automatically.
- Decide what is kept: audio, transcript, summary or just the outcome of the call.
- Set the retention period for each category and the reason for it.
- Limit access to recordings to the people who need them.
- Check where the data is stored and which providers process it, including whether there are transfers outside the EU.
- Make sure you can respond to access or deletion requests from individuals.
Providers of voice technology, transcription or language models process the data on your behalf. Check what data processing agreements they offer, whether they use conversations to train their own models and whether this option can be switched off.
What to document before launch
Documentation isn't pointless bureaucracy; it is how you show you have designed the system responsibly. If a customer or an authority asks how your voice agent works, you need to be able to answer clearly.
- The disclosure scripts used at the start of calls and their versions.
- The legal basis for each type of call and proof of consent, where applicable.
- The rules for transfer to a person and the subjects that are not handled automatically.
- The data retention policy and the list of providers involved.
- The data protection impact assessment, if your specialist considers it necessary.
- The log of exclusion requests and how they are applied.
How we build voice agents
At WEB-AZ we build voice agents with caller disclosure, transfer to a person and data retention rules included from the start, not added later. We work with scripts validated by the client and their legal advisers, and we don't promise guaranteed compliance, because it depends on how the system is actually used. If you want to see whether a voice agent fits your call flow, an initial assessment helps you clarify the requirements.
Next steps