Approve the specific workflow, suppliers, data and actions—not a generic claim that the platform is compliant. Start this review during scoping, before identifiable recordings or production credentials are shared.
Which US controls need separate review?
| Area | Source-grounded distinction | Buyer’s next action |
|---|---|---|
| Outbound AI voice | The FCC’s ruling released on 8 February 2024 places AI-generated human voices within the TCPA’s artificial/prerecorded-voice restrictions; consent, emergency purposes and exemptions remain material. (docs.fcc.gov) | Have counsel classify each proposed campaign, number population and consent basis before dialling. |
| Telemarketing | FTC guidance describes written-agreement and interactive opt-out requirements for covered prerecorded telemarketing, subject to its stated exceptions. (ftc.gov) | Review applicable TCPA and Telemarketing Sales Rule obligations, suppression processes, scripts and retained consent evidence. |
| Recording and interception | Washington’s statute, for example, generally requires all participants’ consent for covered private communications, with specified exceptions and an announcement provision. (apps.leg.wa.gov) | Obtain a jurisdiction-specific assessment of recording, transcription, interception and disclosure—not a blanket “US calls” answer. |
| Healthcare information | HHS says a cloud provider creating, receiving, maintaining or transmitting ePHI on a regulated entity’s behalf can be a business associate; the required BAA does not replace risk analysis. (hhs.gov) | Map the actual PHI flow and approve the configuration before live patient data is processed. |
| Healthcare subcontractors | HHS describes BAA requirements between business associates and their relevant subcontractors. (hhs.gov) | Establish which party contracts with each downstream provider; do not stop at the front-end vendor’s BAA. |
| Payments | PCI SSC states that card-validation codes must not remain in digital audio recordings after authorisation, even if encrypted. (pcisecuritystandards.org) | Prefer a separately approved payment route; verify that audio, transcripts and logs do not retain prohibited data. |
These are review triggers, not a complete legal opinion. Require counsel to check effective requirements for the launch date, relevant states, call purposes and sector. In particular, do not treat an inbound approval as authorisation for AI callbacks or marketing.
What should the technical evidence pack include?
- A diagram covering telephone transport, speech services, models, integrations, recordings, transcripts, logs and analytics.
- Named suppliers and subprocessors, processing locations and approved uses of data.
- Retention, deletion, backup and model-training terms for each relevant data store.
- Restricted credentials and an explicit list of permitted read/write actions.
- Identity checks appropriate to the information disclosed or action taken.
- Transaction logs linking calls to system actions and resulting records.
- Tested handling of timeouts, repeated requests and uncertain transaction results.
- A customer-facing explanation of automation and an approved route to assistance.
NIST’s generative-AI profile supports third-party inventories, supplier-risk assessment, defined contractual responsibilities and contingency planning. Our checklist applies those principles to telephone workflows. (nvlpubs.nist.gov)
Decision: keep unresolved controls as explicit blockers. A commercial score must not compensate for an unacceptable data or operating risk.
Owners: legal/privacy, security and system owner. Deliverable: approved data-flow map, control register and access boundaries.