AI on the Phone: A Plain-English Compliance Guide for Growing Businesses

Two questions come up the moment a business considers letting an AI answer its phone: is it legal, and what do I have to tell callers? The answers are more reassuring and more specific than most vendor summaries suggest. The federal robocall rules that made headlines govern outbound calls, not an AI that answers inbound ones. A handful of states require you to tell callers they are talking to AI, with definitions that vary. Recording-consent laws apply to AI exactly as they apply to people. And if your calls touch health or payment information, the rules you already follow extend to the AI and to whoever built it.

This guide explains each of those in plain English, with the primary sources listed at the end, as verified on October 12, 2026. It is not legal advice; it is the briefing you should take to your counsel. It also explains the design rule that satisfies nearly all of it at once: disclose that the caller is talking to an AI, and that the call is recorded, at the start of every call, and make a person reachable on request.

Does the TCPA Apply to an AI That Answers the Phone?

In February 2024 the FCC ruled that AI-generated voices are “artificial” voices under the Telephone Consumer Protection Act, which means outbound calls that use them require the consent the TCPA already requires for prerecorded or artificial-voice calls ¹. That ruling was widely reported as making AI calls illegal. It did not, and it does not reach inbound answering at all. The FCC’s own September 2024 notice of proposed rulemaking states that “the TCPA’s requirements do not extend to technologies used to answer inbound calls” ². An AI front desk that answers your customers’ calls is governed by state consumer-protection and disclosure laws and by recording-consent laws, not by the TCPA ruling. If the same platform also places outbound calls (confirmations, reminders), those calls are outbound and the TCPA applies to them.

One federal bill is worth tracking. The Keep Call Centers in America Act (S.2495) would require any business using AI in a customer service communication to disclose it at the beginning and to offer transfer to a human operator located in the United States on request, and would require agents to disclose their physical location ³. It is a bill, not law, and would take effect a year after any enactment.

Which States Require You to Tell Callers It Is AI?

A small but growing number of states address AI that interacts with consumers, and they are not uniform. Maine prohibits using an AI chatbot or other computer technology in trade and commerce in a manner that may mislead a reasonable consumer into believing they are engaging with a human unless the consumer is clearly and conspicuously notified, and its definition expressly covers “textual or aural communications,” so voice agents are included ⁴. Utah requires disclosure when a consumer asks whether they are interacting with AI, and up front for regulated occupations ⁵. Colorado’s HB 26-1263, effective January 1, 2027, requires operators of conversational AI services to disclose that the service is AI, with exclusions for certain transactional and narrow-purpose tools that counsel should confirm ⁶; the state’s broader AI law was stayed in April 2026 and replaced by a narrower framework effective the same date ⁷. Texas’s disclosure duties apply to health care providers and government agencies rather than businesses generally ⁸. California’s AB 1609, signed September 28, 2026, applies only to businesses with more than USD 500 million in national gross annual revenue; for them it bars presenting a chatbot as human, requires disclosure in the medium of interaction, and requires a good-faith effort to connect a requesting customer with an agent within 15 minutes or offer an appointment within one business day ⁹.

Most growing businesses sit below California’s threshold. The law still matters, because it sets the standard customers will come to expect everywhere: know when it is AI, and be able to reach a person.

Recording and Transcribing Calls

An AI front desk records or transcribes calls to work. That makes recording-consent law the most universally applicable rule in this guide. Most states require the consent of one party to a call; a minority require all parties. California requires all-party consent for confidential communications and, under Penal Code §632.7, for any call involving a cellular or cordless phone regardless of confidentiality, and California courts have applied California’s rule to calls between a California party and a party in a one-party state. Florida and Illinois generally require all-party consent; Connecticut imposes civil liability for recording without all-party consent even though it is a one-party state for criminal purposes ¹⁰. Because you cannot know where a caller is standing, the practical rule is to disclose recording at the start of every call.

HIPAA and PCI DSS When AI Answers

If your calls involve protected health information, HIPAA’s business associate rules extend down the whole chain. A business associate must have a business associate agreement with any subcontractor before disclosing protected health information to it, and downstream subcontractors are themselves business associates ¹¹. For an AI front desk, that chain runs from your practice to the provider, to the platform’s developer, to any speech or model vendor the platform uses. Until every link has an agreement, clinical calls should go to a person by rule.

If your calls involve payments, PCI DSS prohibits retaining sensitive authentication data such as card validation codes after authorization, including in digital audio recordings; the PCI Security Standards Council’s June 2025 guidance says every effort must be made to prevent such data from being recorded, that suppression or redaction should be enabled where available, and that if recording cannot be prevented the data must be securely deleted immediately upon authorization ¹². An AI that takes payments must be designed so card data never enters the transcript or the recording; until it is, payments go to a person.

One Greeting That Satisfies Almost Everything

Nearly all of the above, and the consumer research, point to the same design: at the start of every call, the AI says that it is an AI and that the call is recorded, and a person is reachable on request at any point. Consumers want exactly this: 85% say it should be clearly indicated when they are interacting with AI, and 85% would rather a person be reachable (AnswerConnect/OnePoll, 6,000 adults, 2026) ¹³; nearly 8 in 10 say AI should identify itself at the start of a call ¹⁴. Disclosure is not a cost of compliance. It is what keeps callers on the line.

Redial applies this rule to its own programs and to the AI front desk it is previewing, IzzyOps (working name): disclosure of AI and recording at the start of every call, a person reachable on request, payment and clinical calls routed to a person by rule until the platform’s compliance posture is documented, and disclosure compliance measured on every call as one of nine pilot metrics. Redial describes its programs as aligned with HIPAA, PCI DSS, and applicable state disclosure and recording laws, and documents the basis for each.