AI voice agents can increase outbound capacity, but an automated calling program has material compliance obligations. In 2024, the FCC clarified that AI-generated voices are artificial or prerecorded voices under the TCPA. Requirements depend on the call, recipient, consent, technology, and jurisdiction.

This is an operational checklist, not legal advice. Have qualified counsel review the production program, consent language, disclosures, recording policy, and applicable state rules before launching.

Why compliance suddenly matters more in 2026

The FCC's 2024 declaratory ruling means teams should not treat synthetic voices as outside the existing telemarketing framework. Federal and state rules can change and may apply differently to a particular campaign, so counsel should determine the requirements before launch.

Any SMB running outbound AI calls should maintain documented processes for consent, do-not-call requests, opt-outs, calling windows, caller identification, disclosures, and human review.

The 6 rules that matter most

1. Confirm the consent requirements for your program

The FCC treats AI-generated voices as artificial or prerecorded under the TCPA. Ask counsel to determine the consent standard that applies to each program and keep records that support the conclusion.

Common mistake: assuming that a lead who filled out a form for a whitepaper has the consent needed for marketing calls. The applicable standard depends on the program, so counsel should review the actual capture language and records rather than relying on a broad label such as “opt-in.”

2. Maintain documented DNC suppression before every campaign

The National Do Not Call Registry is not the only consideration. Internal do-not-call records — people who have asked you not to call them — need a documented process, and counsel should identify any applicable state or industry-specific requirements.

Maintain a documented suppression process and verify its update cadence with counsel. The FTC's safe-harbor guidance, for example, describes records and processes for preventing calls to numbers on both the entity-specific list and the National Registry.

3. Honor opt-outs and retain records

The FTC requires sellers and telemarketers to maintain entity-specific do-not-call processes. Capture requests reliably, apply them across the relevant program, and retain records of the process.

Equally important: keep an auditable record of when the opt-out happened and when it was processed. In litigation, the burden is on you to prove the timeline.

4. Configure calling windows for the recipient and jurisdiction

Federal and state rules can restrict the times a consumer may receive a telemarketing call. Use the recipient's location and have counsel validate the window your program applies.

Configure the program using recipient location data that your counsel approves, and test the edge cases before launch. Do not rely on an area code alone as a definitive location signal.

5. Identify the caller and business in the opening seconds

Disclosure requirements vary by call type and jurisdiction. Your counsel-approved production script should identify the caller and business as required, explain the automated technology where required, and provide an accessible opt-out path.

6. Use clear disclosures where required

Disclosure requirements can differ by jurisdiction and call type. Counsel should approve the opening script, including how the caller identifies the business and the use of automated technology.

The compliance mistakes we see most often

Purchased lead lists with no consent trail. The vendor promises "opt-in" but can't produce the actual capture record. That's not consent — that's a lawsuit waiting to happen.
Reusing a "sales" consent for "marketing" campaigns. A prospect who consented to a demo follow-up did not consent to a monthly promo blast.
Assuming a phone-number record never changes. Use a current, counsel-approved process for validating the data and consent record that supports each campaign.
No revocation UX in the AI script. If the recipient says "stop calling me" and your agent doesn't detect that intent, you'll keep dialing — and each subsequent call compounds liability.

A 30-minute pre-launch checklist

Confirm the consent capture language on your form(s) mentions automated marketing calls.
Export a fresh copy of your internal DNC list and load it into the campaign.
Run the target list through National DNC scrubbing.
Set calling windows according to a counsel-approved rule for the recipient and campaign.
Verify your AI script opens with caller identification and AI disclosure.
Test the opt-out phrase library — "stop", "remove me", "don't call again", "unsubscribe".
Have counsel approve the recording notice, retention approach, and any consent required for recording.
Assign a compliance owner and a documented QA review cadence.

Operational controls to require from a dialer

Before choosing a provider, document which system owns consent records and suppression, how opt-outs are applied across campaigns, how the calling window is calculated, where recordings and transcripts are stored, and how a team can retrieve the evidence required by its policy. Test those controls with counsel-approved scenarios before any production dialing.

No tool eliminates the need for a sensible policy or legal review. The controls should make that policy executable and auditable rather than relying on ad hoc operator behavior.

Review the AI voice agent workflow to see the configurable consent, routing, and human-handoff controls that should support—not replace—your compliance process.

Want this on your own workflow? Talk to the Legion team.

AI Cold Calling & TCPA Compliance: What SMBs Need to Know in 2026