Inbound service, outbound lead response, recording, healthcare data and payments need separate reviews. This section organises procurement questions; it is not legal clearance or a complete state-by-state survey.
| Deployment or data issue | Source-backed distinction | Evidence to request |
|---|---|---|
| Outbound artificial-voice calling | On 8 February 2024, the FCC announced its ruling that AI-generated voices fall within the TCPA’s artificial-voice restrictions. The FCC also identifies prior express written consent requirements for telemarketing robocalls. This is not a blanket prohibition on every AI call. (docs.fcc.gov) | Counsel-approved calling purpose, consent basis, exemptions where applicable and suppression controls |
| Telemarketing messages | FTC guidance addresses written agreement, interactive opt-out, do-not-call and other TSR requirements for covered prerecorded telemarketing calls. Its treatment should not be reduced to a generic “TCPA compliant” label. (ftc.gov) | Approved campaign design, consent records, opt-out operation and evidence retention |
| Recording and transcription | Recording requires a separate jurisdictional analysis. California’s confidential-communication protections illustrate why one nationwide assumption is inadequate. (oag.ca.gov) | A jurisdiction-reviewed disclosure/consent procedure and a documented alternative when appropriate |
| Healthcare information | HHS describes BAAs and risk analysis for cloud processing of ePHI; a BAA does not replace the rest of the compliance work. (hhs.gov) | Applicable BAAs, data-flow map, permitted uses, security review and configured retention |
| Healthcare subcontractors | HHS’s model contract provisions address subcontractor safeguards, incident reporting and return or destruction of PHI at termination where feasible. (hhs.gov) | Contractual coverage through the service chain and an executable exit/deletion process |
| Card payments | PCI SSC states that retaining sensitive authentication data, including card validation codes, in audio recordings after authorisation violates the relevant storage restriction, even if encrypted. (pcisecuritystandards.org) | A payment design reviewed for PCI scope, recording suppression and sensitive-data handling |
Our recommendation is to identify the service as an AI assistant in the opening experience and provide an accessible human route. Treat that as a trust and design policy, not as proof that the call, recording or subsequent processing is lawful.
Do not assume an inbound enquiry automatically authorises every later outbound marketing call. Put outbound callbacks, lead reactivation and promotional campaigns through their own approval process. Detailed consent-revocation implementation dates, state AI-disclosure requirements and biometric identification rules are outside this report’s verified scope and must be refreshed before deployment.