GDPR and AI on the phone. What you need to get right.

An AI that answers the phone hears names, phone numbers and whatever is on the caller's mind – from the first sentence. That's personal data, so the same rules apply as when a person takes the call and writes it down. On top of that comes a new requirement from the EU AI Act: people must know they're talking to an AI. Here's what you need to get right.

This guide is practical guidance, not legal advice. If you're unsure about a specific case, ask a lawyer or read your data protection authority's guidance.

01Say it's an AI

The EU AI Act (Article 50) requires AI systems that interact with people to make it clear that you're dealing with an AI – unless that's obvious. On the phone it rarely is. The simplest solution is to say it in the very first sentence.

02Say what happens to the call

GDPR Article 13 requires you to inform people about the processing when you collect their data. On the phone, that in practice means a short sentence in the greeting saying the call is being noted down (or recorded), and a full explanation in your privacy policy – purpose, retention period and rights.

03Recording audio is not the same as taking notes

Writing a call down and keeping the audio itself are two different kinds of processing. Audio is more intrusive, and you need to be able to explain why you need it and how long you keep it. If you don't have a clear reason, don't record. Check your data protection authority's guidance on recording phone calls before you switch it on.

04Processors and where the data lives

The provider of the AI phone is your data processor, and you need a data processing agreement. A voice AI almost always uses several sub-processors: one for telephony, one to understand speech, one to speak and one for the language model itself. Ask for the list, and check where they are and which transfer mechanism is used if they're outside the EU.

05Retention and deletion

Transcripts and messages from the phone are inquiries like any other and need a retention limit. That also applies to what sits in your email or texts if messages are forwarded there. Same principles as in the guide to contact forms: a fixed limit and a system that can enforce it.

06Sensitive information

• Don't have the AI ask about health, finances or anything else sensitive unless it's needed to help the customer.
• If the customer brings it up anyway, make sure only the right colleagues can read the transcript.
• Let the AI transfer to a person when the conversation gets personal.

The checklist

• The AI says it's an AI in the first sentence
• The greeting says the call is noted down – or recorded
• The privacy policy mentions the phone
• Audio is only recorded with a clear reason and a fixed retention limit
• A data processing agreement and a list of sub-processors
• A transfer mechanism for sub-processors outside the EU
• A retention limit for transcripts and messages
• Only the right colleagues can read the calls