What the GDPR requires for call recording
A recorded and transcribed call contains personal data: the caller’s voice, their contact details, the content of their request. The GDPR requires informing callers of this recording and its purpose (for example, handling their request and following up the relationship) before the conversation gets under way.
This information must be given clearly, not buried in terms and conditions the caller will never see. On the phone, the only practical way is a spoken announcement at the very start of the call, before the caller explains their request.
What the AI Act has changed since August 2026
The AI Act, the EU regulation on artificial intelligence, has imposed a transparency obligation since August 2026: anyone interacting with an AI must be clearly informed of it. Applied to the phone, this means a voice agent cannot pass itself off as a human, or leave any doubt about it.
The spirit of the text matches commercial common sense: a caller who discovers mid-conversation that they were talking to a machine feels deceived, and it’s the business that pays the price in lost trust. A frank announcement at the start of the call turns the obligation into an advantage: transparency is what makes AI acceptable.
The good practices that follow
First practice: a single announcement at the start of the call covering both obligations: the caller is speaking to an AI, the call is recorded, and here’s why. Second practice: guarantee at all times the option of speaking to a person or being called back by one; the caller must never be held captive by the machine.
Third practice: data minimisation. The agent collects only what is needed to handle the request: no unnecessary questions, no opportunistic data collection. Fourth practice: a retention period set by the business for recordings, transcripts and summaries, with deletion when it expires. Keeping everything indefinitely “just in case” is not a retention policy.
Making your AI phone answering compliant
In practice, compliance comes down to four checks. Is the announcement at the start of the call systematic and easy to understand? Is a transfer to a person always possible? Is the data collected limited to what is necessary? Is the retention period defined, documented and applied? If your provider can’t answer these four questions clearly, that’s a warning sign.
Alyas builds these requirements in by design: the agent states at the start of each call that it is an AI and that the conversation is recorded, offers a transfer to the number you have configured, and the business stays in control of its data (transcripts and summaries) and of how long it is kept.
Frequently asked questions
Doesn’t the mandatory announcement put callers off?
Experience tends to show the opposite: a short, natural announcement, immediately followed by genuine help, is well accepted. What makes people hang up is waiting and getting no answer, not transparency about who they’re talking to.
Who is responsible for compliance: the business or the AI provider?
The business that has the agent answer on its line remains responsible for processing its callers’ data. The provider must give it the means to comply: a compliant announcement, control over data, configurable retention. Choosing a tool designed for compliance reduces the risk but doesn’t transfer the responsibility.
Should AI phone answering be mentioned in your privacy policy?
Yes, it’s good practice and consistent with the spoken information: describe in your privacy policy how calls are processed (recording, transcription, purpose, retention period). The announcement at the start of the call informs in the moment; the written policy lets the caller find out more.