Use an evidence-based release gate with named owners. The following is the desk’s proposed control pack, not a statutory certification scheme.
| Release gate | Accountable buyer owner | Minimum evidence | Do not approve if… |
|---|---|---|---|
| Calling purpose and jurisdiction | Legal with operations | Written classification of each inbound, callback and outbound workflow. | A marketing campaign is described as “customer service” without reviewing its content. |
| Consent and suppression | Legal with revenue operations | Reproducible consent records; tested preference updates and queued-call cancellation. | Permission exists only as a vendor assurance or CRM checkbox of unknown origin. |
| AI and recording disclosures | Legal with customer experience | Approved wording, timing, refusal path and version history. | The agent can omit or improvise a required notice. |
| Patient and sensitive data | Privacy and security | Data map, relevant agreements, access controls and retention schedule. | An unidentified subprocessor receives sensitive information. |
| Booking and system actions | Operations with IT | Tool permissions, transaction logs and downstream reconciliation tests. | The agent can claim success without confirmation from the system of record. |
| Human fallback | Contact-centre or location leader | Named receiving team, coverage hours and tested failure procedures. | “Transfer to human” means an unattended queue with no alternative. |
| Change management | IT with procurement | Model/configuration versioning, regression testing and rollback rights. | Material behaviour can change without notice or retesting. |
| Audit and exit | Procurement with security | Export rights, incident cooperation, deletion and transition provisions. | Evidence disappears when the contract ends. |
What should the next 30 days look like?
Days 1–5: define and classify. Inventory each phone number, workflow, purpose, jurisdiction, data category and permitted system action. Disable unapproved outbound campaigns and identify which existing contracts or configurations need review.
Days 6–15: assemble evidence. Obtain consent provenance, relevant contractual protections, data-flow diagrams, disclosure scripts and a written responsibility matrix. Have counsel resolve applicability questions rather than leaving them in a supplier’s sales response.
Days 16–25: execute tests. Use synthetic or appropriately redacted cases to test refusal, opt-out, interruption, wrong-person contact, restricted data, unavailable appointments, failed writes and failed transfers. Record the observed result—not only the supplier’s expected result.
Days 26–30: approve, remediate or stop. Sign off only on the tested scope. Schedule rechecks for regulatory commencement, material model changes and expansion into new states, campaign purposes or decision-making functions.
What should count as a successful outcome?
Our recommended governing metric remains cost per successfully completed, policy-compliant task. Report technical task completion, compliance-control exceptions, human rescue, repeat contact and unresolved work separately. A booking that exists in the calendar but was obtained through an unapproved calling workflow should not be counted as an unqualified success.
Bottom line: favour a small, evidenced deployment over a broad “compliant AI receptionist” label. The most useful procurement deliverable is a control register that connects each applicable requirement to an owner, configuration, executed test and retrievable record.