AI Outbound Calling: How It Works, What Breaks, and How to Test It

AI outbound calling is the practice of having a voice AI agent place calls, hold a real conversation, and record an outcome without a human dialing. The agent screens whoever answers, handles the turn, then books, transfers, or dispositions the call. It works well on narrow, high-volume tasks and poorly on everything else.

That last sentence is the part most guides skip. The technology is available and the unit economics are attractive, so the interesting question is no longer whether an agent can dial. It is which calls it can finish, what the regulator requires of it, and how you find out before a campaign is live in front of ten thousand strangers.

What is AI outbound calling?

An AI outbound calling agent is software that originates a phone call, decides who or what answered it, conducts a two-way conversation using speech recognition and a language model, and writes a structured outcome back to your systems. Nobody is waiting on the line.

The distinction from earlier outbound automation is that the agent handles a reply it did not anticipate. A voice broadcast plays a recording. A predictive dialer connects a human to whoever picks up. An outbound IVR reads a menu and waits for a keypress. Only an agent can be asked a question and answer it.

The honest boundary is scope. An agent that confirms an appointment, collects a date change, and writes it to a calendar is doing a bounded task with a checkable outcome. An agent asked to run a consultative discovery call is being asked to improvise, and improvisation is where these systems fail quietly rather than loudly.

That boundary predicts where teams get value. The work that suits an agent is repetitive, time-sensitive, and has one clear thing to establish:

• Speed to lead. Calling an inbound form fill within minutes instead of hours, at any time of day.
• Reminders and confirmations. Confirming an appointment and handling the reschedule in the same call.
• List reactivation. Working a dormant list nobody has the headcount to call twice.
• Qualification and routing. Establishing two or three facts, then transferring a warm call to a person.
• Collecting one missing field. An address, a policy number, a preferred date.

What these share is a checkable outcome. If you cannot say in one sentence what a successful call produced, you cannot test the agent and you will not be able to tell whether the campaign worked.

How an AI outbound calling agent works, turn by turn

Every AI outbound call runs the same loop, and understanding which stage a failure came from is most of the work of operating one. A single call takes this path:

Queue: number plus context
    ↓
Origination over SIP ─── caller ID and attestation
    ↓
Answer classification ── human, voicemail, IVR, or screener
    ↓
Branch ───────────────── converse, leave a message, or hang up
    ↓
Conversation loop ────── STT, endpointing, LLM, TTS, once per turn
    ↓
Action ───────────────── transfer, booking, or DTMF digits
    ↓
Disposition ──────────── recording, transcript, structured outcome

Stage by stage:

1. Trigger. A schedule, a CRM event, or a form submission puts a number in a queue with the context the agent will need.
2. Origination. A telephony provider places the call over SIP to the PSTN, carrying your caller ID and an authentication signature.
3. Answer classification. Something picks up. The platform decides whether it is a person, a voicemail greeting, an IVR, hold music, or a carrier message.
4. Conversation. Audio streams in, speech recognition transcribes it, a turn detector decides the caller has stopped speaking, the language model produces a reply, and text to speech renders it back. That cycle repeats per turn.
5. Action. The agent transfers to a human, books a slot, sends DTMF digits, or leaves a message.
6. Disposition. A recording, a transcript, and a structured outcome land in your CRM.

Stage 4 is where latency accumulates, because the stages are serial. Transcription cannot finish before the caller stops talking, the model cannot start before transcription commits, and speech synthesis cannot start before the model emits tokens. Each layer's delay adds to the gap the person on the other end experiences as hesitation, which is why per-layer measurement matters more than a single end to end number. Our voice AI latency guide works through where the time actually goes and why p50 and p95 tell you different things.

The first three seconds decide an AI outbound call

Answer classification, usually called answering machine detection or AMD, is the least glamorous part of AI outbound calling and the one that ruins the most campaigns. Get it wrong and the rest of the call is already lost.

Telephony providers expose it as a set of timing knobs rather than a verdict. Twilio's answering machine detection documentation shows the shape of the problem: detection runs on a timeout that defaults to 30 seconds, a speech threshold that defaults to 2400 milliseconds, a speech end threshold of 1200 milliseconds, and a silence timeout of 5000 milliseconds. Two modes are offered, one returning a result as soon as the called party is identified, the other waiting for the end of a voicemail greeting so a message can be left cleanly. The result arrives as one of a small set of labels, including human, machine_start, fax, and unknown.

Twilio is direct about the ceiling on all of this. Because "not all humans and not all voicemail greetings follow similar patterns," the documentation states plainly that "it's possible that AMD will not always return the right answer." A two second voicemail greeting can be classified as a human answer.

Published research puts a number on what is achievable. A Recurrent Neural Network Approach to the Answering Machine Detection Problem, a preprint submitted in October 2024 by Kemal Altwlkany and colleagues, applies transfer learning from the YAMNet audio model and reports "an accuracy of over 96% on the test set," rising to "exceeding 98%" once a silence detection algorithm is added. Read that as what one paper measured on its own test set, not as what your carrier traffic will do. It is still the most useful anchor available, because it says the realistic operating range is a few errors per hundred calls rather than a few per thousand.

A few per hundred is not a rounding error at campaign scale. Dial twenty thousand numbers and a 2% classification error is four hundred calls that started wrong.

The two failure directions cost different amounts. A false machine verdict means the agent talks over a real person or hangs up on them, which burns a lead and generates a complaint. A false human verdict means the agent delivers its opening line into a voicemail greeting, then holds a conversation with silence until the timeout fires. The first is expensive per event, the second is expensive in aggregate. Our guide to voicemail detection covers the detection methods and how they trade speed against accuracy.

There is a newer wrinkle that most guides on AI outbound calls have not caught up with. Handset operating systems now answer on the caller's behalf. Apple's iPhone support documentation describes a Screen Unknown Callers setting with three options, Never, Ask Reason for Calling, and Silence, where the middle option means "the caller is asked why they're calling before your phone even rings." That screener is a machine that speaks conversationally and asks a question. Detection tuned to separate humans from recorded greetings has no reason to label it a machine, so your agent will start pitching a call screener, and the transcript will look like a real conversation that went nowhere.

Where AI outbound calls go wrong

Beyond answer classification, five failure modes account for most of the damage.

Turn detection on a hesitant answerer. People who did not expect the call speak in fragments. An endpointer tuned on clean speech treats the pause after "hi, sorry, who is" as the end of a turn and interrupts. The caller starts again, the agent interrupts again, and the call ends in three turns.

The two second clock. Federal rules on telemarketing calls define abandonment tightly. Under 47 CFR 64.1200, a call "is 'abandoned' if it is not connected to a live sales representative within two (2) seconds of the called person's completed greeting," and the rule prohibits abandoning "more than three percent of all telemarketing calls that are answered live by a person, as measured over a 30-day period for a single calling campaign." Note what the definition turns on: connection to a live representative. An agent that is still deciding whether it heard a person is spending that window, and whether a synthetic voice satisfies a rule written around a live representative is a question for your counsel, not for a blog. Treat the two second budget as real and design the opening turn to fit inside it.

Caller reputation. Authentication and reputation are separate systems, and confusing them is common. The same part of the rules requires originating providers to implement the STIR/SHAKEN framework, obtain a certificate, and authenticate caller identification for the SIP calls they originate, and it puts attestation level decisions on the originating provider even when signing is outsourced. What that gets you is a verified claim about who is calling. It does not decide whether the handset displays a spam warning, which is set by carrier and third party analytics reacting to call velocity, number rotation, and complaint rates. A well attested campaign can still be labelled.

Concurrency. An error rate that is invisible at five simultaneous calls is a queue of failures at five hundred. Media servers, speech recognition endpoints, and model APIs all degrade under load in ways that show up as added latency first and dropped audio second.

Silent regressions. Changing a prompt, a model version, or a voice changes behaviour on calls nobody thought to check. This is the failure mode with no alert attached to it, which is why it usually gets discovered by a customer.

Is AI outbound calling legal?

In the United States, yes, with conditions that are stricter than most teams assume. This section describes the rules as written and is not legal advice.

The decisive move came in February 2024. In a declaratory ruling in CG Docket No. 23-362 released on 8 February 2024, the Federal Communications Commission stated that "we confirm that the TCPA's restrictions on the use of 'artificial or prerecorded voice' encompass current AI technologies that resemble human voices and/or generate call content using a prerecorded voice."

The practical consequence is that a synthetic voice inherits the whole artificial voice regime rather than sitting outside it. Three obligations follow directly from 47 CFR 64.1200:

• Consent. Calls that include or introduce an advertisement or constitute telemarketing, made with an artificial or prerecorded voice, require prior express written consent. Informational and transactional calls sit under different conditions, so the classification of your campaign is a compliance decision, not a marketing one.
• Identification. The rules require that at the beginning of the message you "state clearly the identity of the business, individual, or other entity that is responsible for initiating the call," and that during or after the message you state a callback number that is not the number of the dialer.
• Abandonment. The three percent cap and the two second definition above apply per campaign over a rolling 30 day window, which makes it a metric you have to instrument rather than a box to tick.

Add the National Do Not Call Registry, state level restrictions that are in several cases tighter than the federal floor, and calling window rules. None of this is exotic, but all of it has to be enforced in the agent's behaviour, not in a policy document.

What to measure on AI outbound calls

Most outbound dashboards report volume and connect rate, which tells you the dialer worked. The metrics that predict whether the programme survives are further down.

We deliberately publish no benchmark figure for connect rate or cost per outcome. Every published number we could find for either traces back to a vendor marketing page with no method disclosed, so treat both as metrics to instrument on your own traffic rather than targets to copy.

Cekura publishes measured figures for the layer these metrics sit on. Per Cekura's voice agent benchmarks, read on 4 September 2026, seven platform configurations were run across 82 scenarios with 3 retained repeats each, giving 246 calls per configuration. On that run, ElevenLabs posted the fastest mean response time at 1.27 seconds and led voice naturalness at 4.47 out of 5, Retell led interruption handling at 5.00 out of 5, Vapi led task completion at 97.56%, and the strongest reliability score under a stricter pass on all three repeats was 75.61%.

Four caveats travel with those figures every time they are quoted. Each platform chose what to test. Cekura supplied the system prompt, tool definitions, test-case summaries and test data, but providers chose their own models, speech components and settings. The spread therefore reflects configuration choices as well as platform capability, not a controlled swap of one component at a time.

Response time is measured by Cekura at the main-agent layer, not from provider-native component timing. Denominators also differ by metric. Infrastructure reliability includes all 246 retained calls per configuration, which is why one sits at 82.93% and another at 100%, with Vapi's 41 calls that did not connect reflected there. Task completion uses a different denominator, the full-score success rate among calls that produced outcome evidence. And a leaderboard is a snapshot of specific configurations on a specific date, not a permanent ranking.

The number worth staring at is the reliability one. The best task completion score on that run was 97.56%, while the best score under the stricter test, requiring success on all three repeats of the same scenario, was 75.61%. Those are two different configurations, and the gap between the two framings is the point. Outbound campaigns are repeats by construction. You are running the same conversation thousands of times, so the distribution matters more than the best case.

How to test AI outbound calling agents before you dial

Outbound is unforgiving in a way inbound is not. An inbound agent meets a caller who wants something. An outbound agent interrupts someone, which means the first ten seconds carry all the risk and there is no second attempt.

Cekura simulates outbound calls over real telephony before the campaign exists. The platform places calls to your agent, plays scripted and generated personas at it, and scores each conversation against the criteria you define. Five things are worth covering deliberately:

• Answer classification scenarios. Test against voicemail greetings of different lengths, an IVR menu, hold music, a carrier intercept message, and a call screener that asks why you are calling. Each one should produce the right branch, not a plausible looking transcript.
• Awkward humans. Personas that hesitate, talk over the agent, ask an off script question, hand the phone to someone else, or ask to be removed from the list.
• Compliance assertions. Cekura checks whether the identification and callback disclosures were actually spoken, on every simulated call, which turns a policy into per call evidence.
• Load at campaign concurrency. Run the concurrency you plan to dial at, not the concurrency you develop at. Cekura measures how latency and completion degrade as simultaneous calls climb.
• Regression on every change. A prompt edit, a model version bump, or a new voice reruns the same scenario set, so behaviour changes surface in a diff rather than in production.

Cekura then monitors live calls against the same criteria, which is what closes the loop: the failure modes production finds become scenarios in the suite, and the agent is retested against them. Our deeper walkthroughs cover outbound voice AI QA and telephony testing over real phone networks.

Rolling out a campaign in four steps

1. Fix the data and the consent record first. Scrub against the Do Not Call Registry, confirm what consent exists for each number and what it covers, and remove numbers you cannot evidence. This step has no upside and prevents the only failure that ends the programme.

2. Design the opening turn against the clock. Write the first ten seconds to identify the caller, state a reason, and reach a branch point inside the abandonment window. Everything else in the script is easier than this.

3. Test before the list exists. Run the scenario suite, the awkward personas, and the load profile. Fix what fails, then rerun. Cekura reports pass and fail per scenario so the argument about readiness has evidence behind it.

4. Ramp and watch the right numbers. Start at a fraction of the volume across several caller IDs, review transcripts daily for the first week, and track answer classification accuracy, abandonment rate, and p95 turn latency rather than dials per hour. Scale when those hold.

Frequently asked questions

Is AI outbound calling legal in the United States?

Yes, subject to the TCPA. The FCC confirmed in a February 2024 declaratory ruling that restrictions on artificial or prerecorded voice calls cover AI technologies that resemble human voices, so a synthetic voice needs prior express written consent for telemarketing, must identify the responsible business at the start of the message, and must give a callback number. State rules can be stricter. Confirm your campaign with counsel.

What is the difference between AI outbound calling and a predictive dialer?

A predictive dialer connects a human representative to whoever answers, and its intelligence is in pacing. An AI outbound calling agent holds the conversation itself, handles a reply it did not anticipate, and writes a structured outcome. The dialer scales a human's dialing time; the agent scales the conversation.

How fast does an AI outbound calling agent need to respond?

Fast enough that the gap does not read as hesitation, and fast enough to reach a branch point inside the two second abandonment definition on a live answer. Per Cekura's benchmarks read on 4 September 2026, the fastest mean response time across seven configurations was 1.27 seconds, measured at the main-agent layer on a snapshot of configurations each provider chose. Track p50 and p95 on your own call path, since the tail is what callers hang up on.

Can an AI outbound calling agent leave a voicemail?

Yes, if detection waits for the end of the greeting rather than returning a verdict as soon as it identifies a machine. Twilio documents both modes for exactly this reason. Test it against greetings of different lengths, including very short ones, which are the greetings most likely to be misread as a human answer.

How many AI outbound calls should I test before launching?

Enough to cover every branch several times, not a fixed number. Cekura's own benchmark design is a reasonable shape to copy: a scenario set in the dozens, run with repeats, scored on whether every repeat passed rather than whether the best one did. Repeats are what expose the intermittent failures that a single successful test call hides.

Test the first ten seconds before you scale the list

An outbound programme is rarely limited by whether the agent can hold a conversation. It is limited by what happens in the first three seconds, by whether the opening turn fits inside the abandonment window, and by whether the behaviour you tested is the behaviour you shipped.

Those three things are all measurable before a single real number is dialled. Cekura simulates outbound calls over real telephony, scores answer classification and disclosure adherence on every call, load-tests at the concurrency you plan to run, then monitors production against the same criteria so a failure found on a live call becomes a scenario in the suite.

Book a demo to see how Cekura tests, monitors and self-improves voice agents, so your first real prospect is not your first real test.