US AI calling controls: TCPA, recording, HIPAA and buyer evidence
Question. Which calling-control questions must be answered before procurement?
Direction, consent, recording disclosure, retention, subprocessors, training use and sector obligations each need a named reviewer and documentary evidence. No tool or supplier statement substitutes for qualified review.
A working agent is not permission to make the call. Before procurement, legal and security reviewers need a clear description of what the agent does, which direction calls flow, what is recorded, where audio and text go, and who owns each control.
Outbound calling
In February 2024 the FCC confirmed that AI-generated voices are “artificial” voices under the TCPA. Outbound calls using them are subject to the same consent requirements as prerecorded calls. That does not make every AI call unlawful, but consent records, purpose and revocation handling must be reviewed.
Recording and disclosure
Several states require all parties to consent to recording. Disclose recording and automation at the start of the call, and have counsel confirm the position for every state your callers are in.
Data handling
- Retention and deletion schedules for audio and transcripts.
- Named subprocessors and their locations.
- Whether the supplier may train models on your calls.
- HIPAA business associate agreements where protected health information is discussed.
- PCI DSS scope if card details are spoken.
- Biometric consent if voiceprints or cloning are used.
This article is not legal advice and supplies no legal clearance.