Voice assistant

Rules for AI on the phone

An AI that answers the phone falls under two sets of rules: the European AI Act and the GDPR. Both are manageable, if you arrange them beforehand. This is what applies since 2 August 2026 and what you agree in practice.

Saying that it is AI

Article 50 of the AI Act applies since 2 August 2026. Providers ensure that AI systems that interact directly with people are built so that those people know they are dealing with AI. The exception is when that is already obvious to a reasonably well-informed person from the context. On the phone that is rarely the case. So let the assistant introduce itself as AI.

Recording calls

The Dutch Data Protection Authority is clear: say at the start of the call that it is being recorded and what for, whether the customer calls or is called. A notice on the website or in the terms is not enough. Asking consent is not needed when the recording is necessary for the contract or for a legitimate interest, such as improving the service.

What a caller may ask

A caller can request or listen to the recording. The Dutch consumer authority ACM points consumers to this, and refers to the Data Protection Authority for the privacy rules. So make sure you can find recordings and hand them over.

How long you keep it

Keep no longer than the purpose requires. As an example: the GDPR register of the Dutch central government states that recordings of customer calls are automatically deleted at the latest 28 days after the recording date. Pick a period, write it down and let the system enforce it.

Agreeing it in practice

The assistant introduces itself as AI in the first sentence.
If calls are recorded, it says so and what for, in those same first sentences.
Calls and notes are processed on EU servers, with a data processing agreement.
A retention period the system enforces itself.
A person who can listen in and step in, and whom the caller can reach.

Frequently asked questions

Does this also apply to a small company?

Yes. The transparency duty and the GDPR apply regardless of company size.

Do I need consent to record?

Not when the recording is necessary for the contract or for a legitimate interest. Informing at the start of the call is always required.

Who is responsible, me or the vendor?

The provider of the AI system ensures it makes itself known as AI. You are responsible for your callers' personal data. That is why we put it down together in a data processing agreement.