AI Receptionist and GDPR: What You Must Do in 2026

An AI on your phone line handles more personal data than most owners realise. The caller’s number. Their voice. Then a complete transcript, including names, reasons for calling, often an address or a date of birth. And all of it sits with a vendor that buys speech recognition and language models from other companies, frequently in the US.

None of that is forbidden. But there are duties businesses often miss at launch, plus a new one from the EU AI Act since August 2026.

Who is responsible for what

Under the GDPR and UK GDPR, your business is the controller. The vendor of the AI receptionist is a processor, handling your callers’ data on your behalf and on your instructions. Article 28 GDPR requires a written contract for that relationship.

Vendors rarely work alone. Speech-to-text, the model, the voice and telephony often come from different companies. Those sub-processors must be disclosed to you, and you must be able to object. Ask for the list before signing. It shows you at a glance which countries your calls pass through.

• Subject, duration and purpose of processing; categories of data
• List of sub-processors with location of processing
• No use of audio or transcripts to train any models
• Retention periods for recordings, transcripts and messages, then deletion
• Security measures such as encryption and access controls
• Help with access and erasure requests from callers
• Breach notification without undue delay
• Legal basis for any transfer outside the EU or UK

The new duty: say that it’s an AI

Since 2 August 2026, Article 50 of the AI Act, Regulation (EU) 2024/1689, applies. Paragraph 1 requires AI systems that interact directly with people to be designed so those people are informed they’re dealing with AI, unless that’s obvious to a reasonably well-informed, observant person. On the phone with a natural-sounding voice, it usually isn’t.

Paragraph 5 covers timing and form: clearly, and at the latest at the first interaction. One line in your privacy policy won’t do. The disclosure belongs in the greeting.

Formally the duty sits with the provider who builds the system. Practically, you’re the one who writes the greeting. Check whether the disclosure is built in or whether you have to add it yourself.

1. 1 Aug 2024The regulation enters into force.
2. 2 Feb 2025Prohibited AI practices are banned.
3. 2 Aug 2025Obligations for providers of general-purpose AI models apply.
4. 2 Aug 2026Transparency duties under Article 50 apply, including the AI disclosure on calls.

Source: Regulation (EU) 2024/1689, Article 113

A greeting you can adapt

The greeting has three jobs: the Article 50 disclosure, a short version of the privacy information required by Article 13 GDPR, and a note on recording if you record. The full notice can live on your website as long as the greeting points to it.

“Hello, you’ve reached the digital assistant for Example Decorating. I’m an AI system. We only use what you tell me to deal with your request; details are at example-decorating.co.uk/privacy. This call is not recorded. How can I help?”

That’s about 15 seconds. Keep it there. Longer, and callers hang up before they say why they called. If your line also serves callers in other languages, record the disclosure in each of them, or have the assistant switch language before it explains anything else. A disclosure the caller can’t understand isn’t clear in the sense of Article 50.

Recording calls: where the rules split

Many platforms store audio of every call by default. Handy for quality checks, legally more delicate than it looks, and the rules depend on where your callers are.

Criterion	Baseline rule	What that means for an AI line
US federal law	One-party consent (18 U.S.C. § 2511(2)(d))	The business can be the consenting party, but state law may be stricter
California	All parties must consent to recording confidential calls (Penal Code § 632)	Announce recording and let callers opt out
UK	Recording allowed for business purposes, UK GDPR transparency applies	Tell callers in the greeting and keep retention short
Germany	Recording the non-public spoken word without authorisation is a criminal offence (§ 201 StGB)	Turn off audio storage or get explicit consent

Whether live transcription without a stored audio file counts as “recording” isn’t settled everywhere. Stored audio certainly does. The cautious route: switch off audio retention at the vendor, keep only the transcript and the message, and say so in the greeting. If you need recordings for quality checks, ask for explicit consent up front and offer a path without recording.

Transcripts are personal data too. Set a retention period, 30 days for instance, and delete automatically afterwards. The message itself moves into your own system anyway.

Transfers: when the AI runs in the US

Many models and voices come from US companies. Transfers of personal data there need a legal basis under Articles 44 onwards. Since 10 July 2023 the EU-US Data Privacy Framework has had an adequacy decision from the European Commission; US companies certified under it count as adequate recipients. The EU General Court dismissed a challenge to that decision in September 2025, and an appeal has been pending before the Court of Justice since October 2025 (case C-703/25 P). The UK extended the arrangement through its “UK-US data bridge” from 12 October 2023.

So check that every US sub-processor appears on the official Data Privacy Framework list. If one doesn’t, you need standard contractual clauses or the UK equivalent. To sidestep the question entirely, pick a vendor that runs models and data fully inside Europe. That usually costs a bit more per minute, as described in AI receptionist pricing.

When a caller asks what you hold

Sooner or later someone will ask what you’ve stored about them. Under Article 15 they’re entitled to an answer, normally within one month. With an AI receptionist that covers not just the message in your system but transcripts and any recordings at the vendor.

Plan for it. Check whether the vendor’s portal lets you search calls by phone number and export them. If not, the processing agreement must oblige the vendor to help. Erasure requests under Article 17 work the same way. Short retention periods pay off here: what disappears automatically after 30 days doesn’t need to be hunted down.

Health data and confidential professions

Medical practices and law firms carry extra duties. Health data falls under Article 9 GDPR, and professional confidentiality rules sit on top. For US practices, HIPAA adds the need for a business associate agreement. The specifics are in AI medical receptionists and legal answering services.

Your checklist, in order

Contract first, technology second:

1. Request and review the processing agreement and sub-processor list.
2. Find out where audio and text are processed, and record the transfer basis for every recipient outside the EU or UK.
3. Switch off audio retention or build in a consent step.
4. Set retention periods for transcripts.
5. Write the greeting with AI disclosure and short privacy notice.
6. Add a telephone section to your website’s privacy policy.
7. Add the processing to your record of processing activities.

A custom build gives you more control over hosting and models than an off-the-shelf product; studios like OnlineBuilders build such assistants around your own systems. Whatever you choose, put two questions to the vendor in writing before you sign: which sub-processors handle the calls, and is audio stored. Those two answers tell you more about data protection than any badge on their website.

Questions people ask

Does the EU AI Act apply to UK businesses?

Not as UK law. It can still apply if your AI system is used by people in the EU, for example if EU customers call your line. Many UK firms add the AI disclosure anyway, since it costs one sentence and avoids confusion.

Can the vendor train its models on my calls?

Only if you allow it. As a processor it may use personal data solely on your instructions. Put an explicit clause in the contract that audio and transcripts will not be used to train the vendor's or anyone else's models.

What are the fines for missing the AI disclosure?

The AI Act sets fines for breaches of the transparency rules at up to €15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized companies the lower of the two amounts is the cap.

Do I need a data protection impact assessment?

Not automatically. Article 35 GDPR requires one where processing is likely to result in high risk, for instance large-scale processing of health data or new technology affecting many people. A medical practice using voice AI should take that question seriously.