AI voice agent compliance is mostly not a new body of law. It is existing telephone regulation that now explicitly covers synthetic voices, plus a set of obligations that happen to be unusually testable. This is a practitioner's guide, not legal advice.
The short version:
-
In February 2024 the FCC confirmed that the TCPA's restrictions on "artificial or prerecorded voice" cover AI voices. There is no exemption for an AI that sounds human.
-
Identifying the responsible entity at the start applies to every artificial or prerecorded message. Consent, opt-out mechanisms, calling hours and the three percent abandonment cap are scoped to telemarketing and solicitation, so an inbound support agent is in a different position from an outbound dialer.
-
Federal law makes you identify who is responsible for the call. It does not currently require you to say the voice is AI. The FCC has proposed that separately. California already requires it, so treat AI disclosure as a state duty and a sensible default rather than something you can skip because the federal rule is silent.
-
Where a call introduces an advertisement or constitutes telemarketing, the standard is prior express WRITTEN consent, not merely prior express consent. Do not build a consent flow to the lower standard.
-
Most of those are behaviors, which means they can be tested before the agent ever dials a real number. That is unusual in compliance work.
-
Card data is the other live risk, because a call recording is storage and redaction has to happen before the file is written.
-
None of this is legal advice. Verify against your own counsel, and re-check it, because rulemaking on AI calls has not stopped.
What Did the FCC Actually Rule About AI Voices?
On 2 February 2024 the Commission adopted a declaratory ruling, released on 8 February, in CG Docket No. 23-362. The operative sentence is short. The FCC confirmed that the TCPA's restrictions on the use of "artificial or prerecorded voice" "encompass current AI technologies that resemble human voices and/or generate call content using a prerecorded voice".
Two things follow from that wording, and both matter more than they look.
Quality is not a defense. The ruling turns on the voice being artificial, not on whether it is convincing. An agent good enough to be mistaken for a person is squarely inside the rule, not outside it. If anything, the better it sounds the more clearly it is the thing the rule describes.
Nothing was newly invented. The Commission framed the ruling as resolving a perceived ambiguity rather than creating a duty, agreeing with commenters that "the existing consumer protections under the TCPA apply to these calls". Teams who read a live-sounding model as sitting outside prerecorded-call rules were relying on that ambiguity. It is now closed.
What Does the TCPA Require of an AI Voice Agent?
Most of AI voice agent compliance in the United States resolves to one regulation, 47 CFR 64.1200. The provisions an agent runs into are below, quoted from the regulation rather than paraphrased, because the exact wording is what a test has to check against. Read the scope column before the requirement column. Most of these are not general duties, and an inbound support agent is bound by far fewer of them than an outbound telemarketing dialer.
| Requirement | What the regulation says | Who it binds | Where |
|---|---|---|---|
| Identify yourself | "At the beginning of the message, state clearly the identity of the business, individual, or other entity that is responsible for initiating the call" | All artificial or prerecorded voice messages. The broadest duty here | 64.1200(b)(1) |
| Consent | Bars an artificial or prerecorded voice call made without "the prior express consent of the called party" | Only calls to emergency lines, hospital and patient rooms, and mobile or paging numbers. Not a general rule for all artificial-voice calls | 64.1200(a)(1) |
| Consent, written | Where the call "include[s] or introduce[s] an advertisement or constitutes telemarketing", the standard rises to "the prior express written consent of the called party" | Telemarketing and advertising calls. This is the standard most outbound programs actually need | 64.1200(a)(2), (a)(3) |
| Opt-out mechanism | "An automated, interactive voice- and/or key press-activated opt-out mechanism that enables the called person to make a do-not-call request prior to terminating the call, including brief explanatory instructions on how to use such mechanism" | Telemarketing campaigns, where no live representative is available | 64.1200(a)(7)(i)(B) |
| Calling hours | "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)" | Telephone solicitations to residential subscribers only. Not inbound, not transactional calls | 64.1200(c)(1) |
| Do-not-call registry | Bars telephone solicitations to "a residential telephone subscriber who has registered his or her telephone number on the national do-not-call registry" | Telephone solicitations to residential subscribers only. Not inbound, not transactional calls | 64.1200(c)(2) |
| Abandonment | Do not "abandon more than three percent of all telemarketing calls that are answered live by a person, as measured over a 30-day period for a single calling campaign" | Telemarketing campaigns. Calls by or for tax-exempt nonprofits are carved out at (a)(7)(iv) | 64.1200(a)(7) |
The abandonment rule is worth reading twice, because the limb that governs an AI agent is not the one usually quoted. The familiar wording is about connecting to "a live sales representative within two (2) seconds". For a telemarketing call that delivers an artificial or prerecorded voice message with the subscriber's prior express written consent, a separate limb at 64.1200(a)(7)(ii) governs: such a call "shall not be considered an abandoned call if the message begins within two (2) seconds of the called person's completed greeting".
So the clock runs to the moment your agent starts speaking, measured from the moment the human finishes saying hello. That is a latency requirement wearing a compliance hat, and it lands on the connect path and the first response together.
It is a tighter budget than it sounds. Two seconds has to absorb the network path, speech recognition on the greeting, model inference and the first audio out. It is also a tail requirement rather than an average one: a median first-response time comfortably inside two seconds is entirely compatible with breaching this limb on a meaningful share of calls, and the calls it breaches are the ones a regulator hears about.
What Happens If an AI Voice Agent Breaks the TCPA?
The TCPA carries a private right of action, which is what makes it expensive. Under 47 U.S.C. 227(b)(3) a person who receives a violating call can sue for actual monetary loss or "$500 in damages for each such violation, whichever is greater". Where the court finds the violation was willful or knowing it may increase the award "to an amount equal to not more than 3 times" that figure, which is where the commonly quoted $1,500 per call comes from.
Two features of that structure matter for an automated dialer. The damages attach per call rather than per campaign, so a defect that ships in a prompt is multiplied by volume rather than averaged across it. And the statute sets no aggregate cap, so a campaign's exposure is a function of how many calls went out before anyone noticed.
That is the practical argument for asserting identification and opt-out handling as release gates rather than sampling them afterwards. A supervision model that catches a defect after ten thousand calls has already priced that defect at ten thousand violations.
Which State Laws Reach an AI Voice Agent?
Federal rules are the floor, not the ceiling. Three state layers sit on top of them, and each one changes what AI voice agent compliance means for a given call depending on where the person you dialed is sitting.
Some states already require the AI disclosure the FCC has only proposed. California amended Public Utilities Code 2874 through AB 2905, effective 1 January 2025. Where a call is placed with an automatic dialing-announcing device, the live announcement must "Inform the person called if the prerecorded message uses an artificial voice". The statute defines an artificial voice as "a voice that is generated or significantly altered using artificial intelligence". That is the duty federal law has proposed and not yet adopted, in force today in one of the largest calling markets in the country.
Mini-TCPAs set a stricter consent bar than the federal one. Florida Statutes 501.059(8)(a) bars an unsolicited telephonic sales call that "involves an automated system for the selection and dialing of telephone numbers or the playing of a recorded message when a connection is completed to a number called without the prior express written consent of the called party". Several states run comparable statutes with their own private rights of action, which is what makes them expensive rather than merely inconvenient.
Recording consent is a separate question from card data. California Penal Code 632(a) reaches anyone who, "intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication". A one-party-consent assumption baked into your recording policy is a coverage gap in every all-party state, and it applies to inbound support calls as much as outbound campaigns.
Two of these three are testable, and one is not. Announcing an artificial voice and announcing that the call is recorded are both opening-turn behaviors, which is the same assertion as identification and costs nothing extra to add. Whether consent was validly obtained under a state statute is a records question your test suite cannot see.
How Do You Write One Script for Fifty States?
State duties differ, so a single national opening script is usually wrong somewhere. There are two ways out. Write the strictest state's opening and use it everywhere, which costs you a longer preamble on every call. Or branch the opening by the called party's location, which costs you a test matrix rather than a test. Both are defensible. Not choosing is not.
The strictest-opening approach is the one most teams should take first. It costs a few extra seconds of preamble on every call and it removes an entire class of routing bug, because there is no state lookup to get wrong. The tradeoff is worth naming: a longer opening gives the person more time to hang up before you reach the point of the call, and on a high-volume outbound program that is a revenue question rather than a cosmetic one. Measure it on your own traffic before assuming either way.
If you branch instead, the thing to test is the branch itself rather than the scripts. Assert that a number in an all-party state gets the recording notice and a number in California gets the artificial-voice announcement, then assert the same for the states where neither applies. The failure mode is not a bad script. It is the right script played to the wrong state.
Which Compliance Duties Can Actually Be Tested?
This is where AI voice agent compliance diverges from the human kind. Compliance for a human floor is a supervision problem: you sample calls after the fact and coach what you find. Several TCPA duties, self-identification and opt-out handling in particular, are behaviors a model either performs or does not, on every call, and you can find out before the agent dials anyone.
Identification, opt-out handling and first-response time are agent behaviors, so a test suite can assert them on every build. Whether consent was validly obtained and whether the dialer respects calling hours are not agent behaviors at all.
| Duty | Testable before going live? | What a test looks like |
|---|---|---|
| Identify at the start | Yes, fully | Assert the opening turn names the responsible entity. Deterministic, and it should be a release gate |
| Honor an opt-out | Yes, and this is the important one | Scenario suite where the caller asks to stop, phrased many different ways, including indirectly. Assert the agent stops and records the request |
| Announce an artificial voice, where a state requires it | Yes, fully | Same assertion as identification, on the same opening turn. Branch it by the called party's state or say it everywhere |
| Announce recording, in all-party consent states | Yes, fully | Assert the notice lands before any substantive turn. Cheap, and it is the one most often missing from inbound scripts |
| Response time under two seconds | Yes | Measure first-response latency at percentiles, not averages. The tail is what breaches |
| Consent | Partly | The agent cannot verify consent it was never given. Test that it refuses to proceed when the consent flag is absent |
| Calling hours | No, this is scheduling | Enforced by the dialer and the caller's timezone, not by agent behavior |
| DNC list scrubbing | No, this is list hygiene | Enforced by the dialer against the registry and your company-specific list, not by agent behavior |
| Abandonment rate | No, this is production measurement | Monitored across a campaign, though the latency that causes it is testable |
The opt-out case is where AI agents fail in ways humans do not. A human hears "take me off your list", "stop calling me", "I'm not interested, don't call again" and "who gave you this number" and treats all four as the same request. A model trained to be helpful will often keep going on the last two, because they read as questions or objections rather than instructions. That failure is invisible to a scorecard that only checks whether the word "unsubscribe" appeared.
The same applies to adversarial input. A caller who insists, reframes the request, or claims authority can push a helpful model past a rule it would otherwise follow, and a compliance duty that holds on the first ask but not the third is not a duty your agent meets. Pressure belongs in the same suite as the opt-out phrasings: ask for the supervisor's override, claim the do-not-call request was a mistake, insist the recording notice does not apply. The failure is the same shape as the opt-out one, which is that helpfulness wins over the rule.
Testing it means generating the request in many phrasings, including the oblique ones, and asserting on the behavior rather than the keyword. The guide to outbound voice AI QA covers building that kind of scenario coverage.
What About Card Data in Call Recordings?
This one catches teams out because the recording is the problem, not the agent.
PCI DSS holds that sensitive authentication data must not be stored after authorization even if it is encrypted, and the Security Standards Council confirms this applies even in environments where no primary account number is present. Card verification codes fall inside that definition.
A call recording is storage. If your agent takes card details by phone, redaction has to happen before the audio file is written, not during later analysis. A pipeline that records first and redacts in post-processing has already created the artifact the standard prohibits, and every copy of it, including the one your QA platform ingested.
The costs are real and worth stating plainly. Pausing recording around the payment turn is cheapest and loses you the ability to review that part of the call at all. Real-time redaction keeps the recording usable and costs more per minute, plus it will occasionally mis-detect. Moving payment capture out of the conversation entirely, to a keypad or a link, is the most robust and the most disruptive to the call flow.
What If the Calls Contain Health Information?
Briefly, because this deserves its own treatment. The HIPAA Security Rule's technical safeguards at 45 CFR 164.312 require covered entities to "implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information". That is an implementation requirement, not a definition.
The consequence here is a boundary question rather than a technical one. A QA or monitoring platform that ingests call recordings from a healthcare deployment is handling electronic PHI on the covered entity's behalf, which ordinarily makes it a business associate and brings it directly under the Security Rule in its own right rather than only through your contract. Scope your vendors accordingly, and expect to paper it.
How Do You Put AI Voice Agent Compliance in a Test Suite?
Every option below works. They differ in what they cost, so choose on that basis.
Make identification a release gate. Assert on the opening turn of every scenario. Nearly free once written, and it fails loudly if a prompt change drops the disclosure. The cost is that it will block releases, which is the point and will still annoy someone.
Build an opt-out scenario family, not a case. Twenty phrasings, including indirect ones, run on every release. Costs the authoring effort once and some runtime per release. This is the highest-value compliance test available for an outbound agent.
Track first-response latency at percentiles. The two-second abandonment definition is a tail problem, so a median tells you nothing. The scale of it is measurable: Cekura's benchmarks of six voice orchestration platforms put per-turn response latency between 1,730 ms and 3,160 ms at the median, and between 2,950 ms and 5,419 ms at the 95th percentile. Only two of the six sit inside two seconds even at the median, and none does at the 95th percentile.
Cekura measures per-turn latency generally rather than the greeting turn specifically, so read those figures as indicative rather than as a compliance measurement. Costs whatever your measurement stack costs, and it is the same instrumentation you should already want for quality.
Test the refusal path, not just the happy path. Assert the agent declines to proceed when a consent flag is missing. Cheap to write, and it fails in the direction you want. The cost is that it needs your consent state modeled in the test environment.
Keep a labeled regression set of past failures. Every real compliance miss becomes a permanent test. Costs ongoing curation, and it is the only one of these that gets more valuable over time.
Where Does Cekura Fit?
Cekura tests, monitors and self-improves voice and chat AI agents, which puts the testable half of AI voice agent compliance in its natural territory. Cekura runs scenario suites as simulated calls before release, so identification, opt-out handling and refusal behavior can be asserted on every build rather than sampled after the fact.
Because scenarios carry their own state, Cekura can assert the state-specific opening too: that a California number hears the artificial-voice announcement and an all-party number hears the recording notice, without a separate suite per jurisdiction.
Cekura scores conversational behavior from the call audio, including response latency at percentiles, which is what the two-second abandonment limb actually turns on. For production, monitoring AI chat and voice agents covers the runtime half.
The honest limit is worth stating. Testing proves an agent behaved correctly against the scenarios you wrote. It does not prove your consent records are in order, it does not schedule your dialer inside permitted hours, and it is not a legal opinion about your program. Those are different problems with different owners.
If you are deciding what to score on those calls in the first place, voice AI evaluation metrics covers the measurement layer a compliance assertion sits on top of.
Frequently Asked Questions
What is AI voice agent compliance?
AI voice agent compliance is the set of obligations that apply when an automated synthetic voice is used on a call. In the United States the core is the TCPA and 47 CFR 64.1200. Identifying the responsible entity at the start of the message binds every artificial or prerecorded call. Consent, opt-out mechanisms, calling hours and the abandonment cap are scoped to telemarketing and solicitation, so they bite on outbound campaigns rather than inbound support. State law sits on top: California requires the call to disclose an artificial voice, several states run stricter mini-TCPA consent rules, and all-party states require every person on the call to consent to recording. PCI DSS applies separately wherever card data is spoken aloud.
Does the TCPA apply to AI voice agents?
Yes. In a declaratory ruling adopted on 2 February 2024 in CG Docket No. 23-362, the FCC confirmed that the TCPA's restrictions on "artificial or prerecorded voice" encompass current AI technologies that resemble human voices. There is no exemption for an AI that sounds convincingly human.
Does an AI agent have to say it is an AI?
The identification duty in 47 CFR 64.1200(b)(1) requires the message to state clearly, at the beginning, the identity of the entity responsible for the call. That is an identification requirement about who is calling rather than an explicit duty to disclose that the caller is a machine. The FCC has proposed one: in a Notice of Proposed Rulemaking adopted on 7 August 2024 in the same docket, FCC 24-84, the Commission proposed to define an AI-generated call and to require callers to disclose AI-generated content on calls. States have already moved: California Public Utilities Code 2874 requires the announcement to inform the person called if the message uses an artificial voice, in force since 1 January 2025. So disclose the voice is AI. It is a state-law duty today, a proposed federal one, and cheap to assert in a test. The narrow point is that the federal identification rule is about who is calling, not about what is speaking.
What counts as an abandoned call for an AI agent?
For an artificial or prerecorded voice, 47 CFR 64.1200(a)(7)(ii) says the call is not abandoned if "the message begins within two (2) seconds of the called person's completed greeting". Abandonment is capped at three percent of telemarketing calls answered live, over a 30-day period per campaign, with a carve-out for tax-exempt nonprofits. That makes first-response latency a compliance measurement on outbound campaigns, not just a quality one.
Can you record a call where a caller reads out a card number?
Not and keep it. PCI DSS prohibits storing sensitive authentication data after authorization even when encrypted, and card verification codes are inside that definition. A recording is storage, so redaction has to happen before the file is written rather than in later analysis.
Which compliance duties can be tested before going live?
Identification, opt-out handling, refusal when consent is absent, and response latency can all be asserted in a scenario suite before the agent dials a real number. Calling hours and campaign abandonment rate cannot, because they are scheduling and production-measurement problems rather than agent behaviors.
Cekura runs your agent through the scenarios that break compliance, including opt-outs phrased the way real callers phrase them, before it takes a real call. Book a demo to see how yours behaves.