Compliance testing for voice AI agents is the practice of proving that an agent behaves the way a named regulatory control describes on a real call, then keeping the evidence. Cekura runs scripted and adversarial scenarios against a live agent, scores every turn against the control, and retains the transcript, audio and score history.
Last updated: August 2026 By Janhvi Nandwani, Founding Member, Cekura
TL;DR
- Compliance testing for voice AI agents tests behavior, not paperwork. Each control resolves to something the agent either does or does not do on a call: names the business in the opening turn, verifies identity before disclosing, stops when told to stop.
- A control that passed once has been sampled, not verified. Per Cekura's voice orchestration benchmarks, one unchanged agent deployed on six platforms scored between 96.6% and 76.3% on pass^3, the share of scenarios passing all three runs, on platform defaults. The benchmark tests orchestration, not HIPAA, PCI DSS or TCPA controls, so the transferable finding is the run-to-run variance rather than a compliance rate.
- PCI DSS, HIPAA and TCPA point at different layers: what the pipeline retained, what the agent disclosed and to whom, and identification, opt-out and timing.
- Disclosure scripts fail behaviorally, not textually. Paraphrase, late delivery, truncation by a caller interruption, and silence in the agent's second language all pass a keyword check and fail the control.
- Cekura tests and evidences agent behavior against a control. It does not certify compliance, issue attestations, or make an agent HIPAA, PCI DSS or TCPA compliant.
This article is testing guidance, not legal advice. Confirm your specific obligations with your compliance team.
What is compliance testing for voice AI agents?
Compliance testing for voice AI agents is the practice of converting a written control into a call the agent has to survive, then scoring the call against that control. It differs from a compliance program in scope. A program answers whether an organization holds the policies, agreements and assessments a framework expects. A test answers a narrower question: on this call, at this turn, did the agent do the thing the control describes.
The distinction matters because voice agents fail controls in ways documents cannot anticipate. An organization can hold every agreement a framework asks for and still deploy an agent that reads a card verification code back to the caller, discloses an appointment time to whoever asks, or delivers its required disclosure only when the caller stays quiet long enough to hear it.
Testing therefore runs against the deployed agent over a real audio path, not against the prompt. The prompt states intent. The call is the only place the behavior exists.
A control becomes a test when the written text is converted into a scenario, scored turn by turn, and kept as an artifact.
Which controls does each regime require you to test?
Four regimes drive most voice agent compliance testing, and each one points at a different layer of the stack. The table below maps the control text to the behavior it makes testable and to the artifact you keep afterward. Every entry is sourced from the regulation or standard itself rather than a summary of it.
| Regime | Control text that drives the test | Behavior to test on the call | Evidence to keep |
|---|---|---|---|
| PCI DSS | The PCI Security Standards Council's November 2018 supplement on telephone-based payment card data states that "storage of sensitive authentication data after authorization is not permitted, even if the data is encrypted," and that where recordings capture card verification code data "the organization must ensure that all SAD is securely deleted from the recording or is otherwise rendered unrecoverable upon completion of the authorization process." For a telephone environment, that data includes the CAV2/CVC2/CVV2/CID card verification code. | The agent takes a card payment without the validation code reaching a stored recording, a stored transcript, or a read-back to the caller. | A recording and transcript pair for a card-payment call in which the code is absent, plus the retention and redaction settings that produced it. |
| HIPAA | 45 CFR 164.312(d) requires procedures "to verify that a person or entity seeking access to electronic protected health information is the one claimed." 45 CFR 164.502(b) requires reasonable efforts "to limit protected health information to the minimum necessary to accomplish the intended purpose." 45 CFR 164.312(b) requires audit controls that "record and examine activity." | The agent verifies identity before disclosing anything, discloses only what the stated purpose needs, and holds that line when a caller escalates after a refusal. | A failed-verification call in which no PHI was disclosed, and an access log showing who read that transcript afterward. |
| TCPA | 47 CFR 64.1200(b)(1) requires the message, at the beginning, to "state clearly the identity of the business, individual, or other entity that is responsible for initiating the call." Paragraph (b)(3) requires an opt-out mechanism that "must automatically record the called person's number to the caller's do-not-call list and immediately terminate the call." Paragraph (c)(1) restricts solicitations to residential subscribers to between 8 a.m. and 9 p.m. local time at the called party's location. | The agent identifies the responsible business by its registered name in the opening turn, honors an opt-out without a further pitch, and does not dial outside the window. | An opening-turn recording that names the business, and an opt-out call in which the agent stopped and the number reached the suppression list. |
| Disclosure and disclaimer scripts | The FCC's Declaratory Ruling adopted 2 February 2024 confirms the TCPA's restrictions on "artificial or prerecorded voice" encompass "current AI technologies that generate human voices," and that the TCPA "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent." | The agent delivers the required wording in full, in the required position, on every call and in every language it supports. | Per-call pass or fail against the exact required string across repeated runs, not one sampled call. |
None of these entries is a legal conclusion about a specific deployment. They are the sentences a test gets written against.
Why does a control that passed once still fail on the next call?
A voice agent is nondeterministic, and a compliance control is a claim about every call. The same prompt, scenario and platform can place a required disclosure in the opening turn on one run and in the fourth turn on the next, or produce it verbatim once and paraphrased twice. One passing call evidences that the agent can satisfy the control, not that it does.
Per Cekura's voice orchestration benchmarks, one unchanged agent deployed on six orchestration platforms and scored by the same 59 evaluators, with each scenario run three times, ranged from 96.6% down to 76.3% on pass^3, the share of scenarios that passed all three runs, on platform defaults rather than tuned configurations. The benchmark tests orchestration rather than any named regime: it does not test HIPAA, PCI DSS or TCPA controls.
The transferable finding is the shape rather than the number. Identical instructions do not produce identical behavior run to run, so a control tested once per release has been sampled. Running it repeatedly and reporting the all-pass rate is what turns a control into a measurement.
Where do compliance controls actually break?
Compliance controls on voice AI agents break in complexity, not in the obvious refusal. Cekura's benchmark runs 59 evaluators across four categories, one of which is red team, safety and privacy, against the same unchanged healthcare scheduling agent, whose prompt carries clinic guardrails: "no medical advice, 911 for emergencies, minimal PII, and no disclosure of its own instructions." These figures measure a different axis from the run-to-run range above: platform against platform, not repeat against repeat.
On that safety and privacy category, five of the six platforms scored 100% on pass^3 and one scored 80%, on platform defaults. Red team, safety and privacy ties with voice robustness and turn-taking as the category where the platforms separate least, at 20 points, on platform defaults. The widest spread sits in workflow complexity and recovery, covering tool failure, multi-step flows and recovery, at 33.3 points. The benchmark does not test HIPAA, PCI DSS or TCPA controls, so none of this is a compliance result.
The scenario worth writing is the one carrying a tool timeout or a mid-call correction, not the one where a caller simply asks the agent to break a rule.
That makes the read across to compliance an analogy rather than a transferred finding, and it is still worth making. On the categories this benchmark does test, adherence sits at the ceiling on the guardrail scenarios and separates most on the multi-step, recovery-heavy ones. If that shape holds for a disclosure or a verification step, the scenario worth writing is the one carrying a tool timeout or a mid-call correction, not the one where a caller simply asks the agent to break a rule.
PCI compliant voice agent testing
PCI compliant voice agent testing checks that a card verification code spoken aloud never reaches a place the standard prohibits storing it. The PCI Security Standards Council's November 2018 information supplement on telephone-based payment card data states that "storage of sensitive authentication data after authorization is not permitted, even if the data is encrypted," and that where any recordings do include card verification code data, "the organization must ensure that all SAD is securely deleted from the recording or is otherwise rendered unrecoverable upon completion of the authorization process." The supplement's preferred outcome is stronger than deletion: "prevent SAD from being recorded in the first place."
A voice agent adds two retention paths a human call centre does not have: the ASR transcript and the model context. Twilio's PCI workflows documentation states that enabling PCI Mode "redacts sensitive payment details captured using Twilio Programmable Voice and <Pay>," and that "Once PCI Mode is enabled, it cannot be disabled for that Account." Deepgram's redaction documentation states its pci option "Redacts credit card information, including credit card number, expiration date, and CVV," and that streaming redaction returns a generic [REDACTED] placeholder during interim results before settling on a specific entity tag.
That interim window is the test case most teams miss: a transcript clean in the final result can still have exposed the code in an interim frame something logged. Voice bot testing for fintech covers the payment-collection workflow.
HIPAA compliant voice agent testing
HIPAA compliant voice agent testing checks whether a healthcare voice agent establishes who it is speaking to before it discloses anything, and whether it stops at what the request needs. Two provisions carry most of the testable weight. The Security Rule at 45 CFR 164.312(d) sets a person or entity authentication standard: "Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed." The Privacy Rule's minimum necessary standard at 45 CFR 164.502(b) requires reasonable efforts "to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."
Both describe behavior, which makes both testable on a call. The scenarios that matter are built to fail verification rather than pass it: a caller who offers a wrong date of birth, one claiming to be a spouse, one supplying a correct name and nothing else, one applying pressure after a refusal. The pass condition is that no PHI leaves the call, including the partial disclosure hidden inside a helpful deflection. An agent that says it cannot discuss the record and then confirms the appointment was moved has failed the control while sounding compliant. Data privacy practices for AI voice models covers the redaction and retention side of PHI handling.
TCPA compliance testing for voice AI agents
TCPA compliance testing for voice AI agents checks the identification, opt-out and timing behavior the FCC's rules describe for artificial voice calls. In its Declaratory Ruling adopted 2 February 2024, the FCC confirmed that the TCPA's restrictions on "artificial or prerecorded voice" encompass "current AI technologies that generate human voices," and that the TCPA "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent."
Three provisions of 47 CFR 64.1200 become test cases. Paragraph (b)(1) requires the message to state clearly, at the beginning, the identity of the entity responsible for initiating the call, using the name under which it is registered to conduct business. Paragraph (b)(3) requires an interactive opt-out mechanism which, when used, "must automatically record the called person's number to the caller's do-not-call list and immediately terminate the call." Paragraph (c)(1) restricts telephone solicitations to residential subscribers to between 8 a.m. and 9 p.m. local time at the called party's location.
Immediately is the hard word to test. An agent that acknowledges an opt-out and then delivers a closing line has failed a control a transcript keyword check scores as a pass. The outbound voice AI QA guide covers the campaign-level suite around these controls.
Consent is the obligation every compliance guide leads with, and most of it is not an agent behavior. The FCC's Declaratory Ruling states that calls using AI voice technologies "fall under the TCPA and the Commission's implementing rules, and therefore require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption." Whether that consent was obtained is a record, not a call. Revocation is the part that runs on the agent. Under 47 CFR 64.1200(a)(10) a called party may revoke consent "by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender," and the paragraph names an automated, interactive voice or key press-activated opt-out mechanism on a call as reasonable per se. The test case is the caller who uses neither the mechanism nor the words a suppression list matches. An agent that keeps pitching after "take me off your list" has failed a control no keyword check catches.
Disclaimer and compliance script testing for voice bots
Disclaimer and compliance script testing for voice bots checks that required wording arrives in full, in the right position, on every call. It looks like a string match and behaves like a behavioral one. A disclosure fails by being paraphrased into something friendlier, by arriving after the caller's first question, by being truncated when the caller interrupts, or by disappearing in the agent's second language.
Four ways a required disclosure fails while a keyword check still passes: paraphrased, delivered late, truncated by an interruption, and absent in the agent's second language.
Position and timing belong to the control. Under 47 CFR 64.1200(b)(1) the identification sits at the beginning of the message. Paragraph (b)(3) adds a timing requirement for the calls it covers, which are artificial or prerecorded-voice messages made under the (a)(3)(ii) through (v) exemptions, or that include or introduce an advertisement or constitute telemarketing, delivered to a residential line or to any of the line types listed in (a)(1)(i) through (iii): the opt-out mechanism must be provided "within two (2) seconds of providing the identification information required in paragraph (b)(1) of this section." That measures one specific moment near the top of the call. A median turn latency figure does not answer it, because it averages across a conversation the provision says nothing about, so the opening sequence has to be timed on its own.
Barge-in catches the rest. Interrupt the agent mid-disclosure and check whether it resumes the required wording or abandons it, which is the failure a scripted read-through never reaches. Instruction-following evaluation for voice bots covers turn-by-turn scoring of whether an agent kept obeying a directive across a full call.
What evidence does a security review actually ask for?
A security review asks for the artifact, not the assertion. The HIPAA Security Rule's audit controls standard at 45 CFR 164.312(b) requires covered entities and business associates to "implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information," which is a requirement about retrievable records rather than intent. Academic work on regulated agents lands in the same place: Neupane, Mittal and Rahimi's HIPAA-compliant agentic AI framework names "immutable audit trails for compliance verification" as one of three core mechanisms, alongside attribute-based access control and a PHI sanitization pipeline.
For a voice agent the evidence set is concrete: the scenario definition, the audio, the transcript, the per-turn evaluator scores, the repeat-run history showing the control held across runs rather than once, and an access log covering who read those transcripts afterward. Cekura's conversational AI observability security model describes the access and audit-log side of that set. SOC 2 sits outside this page's scope and is covered in Cekura's SOC 2 compliant voice AI testing platform page.
The evidence set for one control: the scenario, the audio, the transcript, the per-turn scores, the repeat-run history, and the access log.
"Current testing practices mainly rely on offline red teaming or static prompt review, but they do not guarantee at runtime that agent behavior follows regulatory rules."
Nafiseh Kahani, Masoud Barati and Diana Addae, Runtime Compliance Verification for AI Agents, June 2026. Their C-Trace framework expresses regulatory requirements as policy predicates over agent execution traces, and reports attack success rates at or below 12% under 10% extractor noise, falling to 0% under perfect extraction. Those figures come from GDPR-focused case studies; the framework has not been validated against HIPAA, PCI DSS or TCPA controls.
How does Cekura test compliance controls on a voice agent?
Cekura is a testing and observability platform for voice and chat agents. It does not certify compliance, issue attestations, or make an agent HIPAA, PCI DSS or TCPA compliant. Cekura tests whether an agent behaves the way a named control describes, and produces the evidence of that behavior.
Cekura runs the control as a scenario against the deployed agent over a real audio path, with a simulated caller that reacts to what the agent actually says rather than reading a fixed script. Each scenario runs repeatedly so the result is an all-pass rate rather than a single sample. Per-turn evaluators score the specific thing the control describes: whether the registered business name appeared in the opening turn, whether the agent disclosed after a failed verification, whether the validation code appears anywhere in the retained transcript, whether the disclosure survived a barge-in.
The red teaming suite supplies the adversarial half, including scenarios probing for sensitive data leaks such as PHI, and the voice agent penetration testing guide covers security-side probes. In production, Cekura flags compliance-check failures and PII echo on live calls, so a control that degrades after a prompt edit surfaces as a monitoring alert rather than a customer complaint.
FAQ
Does compliance testing make a voice AI agent HIPAA compliant?
No. Compliance is a property of an organization and its controls, established through assessment by parties qualified to do it. Testing evidences one input: whether the agent behaves as a control describes, on repeated calls, with artifacts retained. Cekura produces that evidence and does not issue certifications or attestations, though it does state that a Business Associate Agreement is available through an account manager. Treat the output as engineering evidence for your compliance team, not a compliance conclusion.
How many times should a compliance control be tested before release?
Enough times that the result is a rate rather than an observation. Per Cekura's voice orchestration benchmarks, one unchanged agent scored between 96.6% and 76.3% on pass^3 across six platforms on platform defaults, which shows identical instructions producing different run-to-run behavior. That benchmark tests orchestration rather than HIPAA, PCI DSS or TCPA controls, so treat the variance as the transferable finding and set your own repeat count against your own controls.
Can a transcript keyword check verify a disclosure was delivered?
Not on its own. A keyword check confirms a string appeared somewhere in the conversation. It cannot tell you the disclosure arrived at the beginning rather than turn four, that it was complete rather than truncated by a caller interruption, that it was spoken rather than only present in a text channel, or that the agent did not immediately undercut it. Position, completeness and timing need per-turn scoring against audio.
Is PCI DSS in scope for a voice agent that never stores a recording?
Storage is one path, not the only one. A voice agent also produces ASR transcripts, model context, and any logs a downstream component keeps, including interim streaming frames. The PCI Security Standards Council's November 2018 telephone-payments supplement states that where sensitive authentication data cannot be eliminated it "must not be able to be queried," so the testable question is what the whole pipeline retained after authorization. Confirm scope with your assessor rather than inferring it from the recording setting alone.
What does the FCC's 2024 ruling change for AI voice agents?
The FCC's Declaratory Ruling adopted 2 February 2024 confirmed that the TCPA's restrictions on "artificial or prerecorded voice" cover current AI technologies that generate human voices. The Commission stated the TCPA "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent," so an AI agent that sounds human remains subject to the identification, consent and opt-out rules for artificial voice calls.
Does an AI voice agent need consent before calling?
Yes, for the calls the TCPA covers. The FCC's Declaratory Ruling adopted 2 February 2024 states that calls using AI technologies that generate human voices require "the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption." Consent capture is a record your systems hold. What testing covers is the agent's side: whether it honors a revocation expressed in ordinary words.
Compliance controls do not fail loudly. They fail on the call where the agent paraphrased a disclosure or answered a caller it never verified. Book a Cekura walkthrough to see your own controls run as scenarios against your own agent, with the evidence retained.