AI Disclosure Obligation: What Businesses Must Do

The AI Disclosure Obligation: What Businesses Actually Have to Do

You set up an AI phone agent, and somewhere between configuration and the first call the question arrives: do I have to tell callers? And if so — is one sentence enough, or do I need a formal notice, a consent, an entry in the privacy policy?

The short answer: yes, you have to tell them, and in almost every case one sentence at the start of the call does it. The longer answer is still worth reading, because two different things get conflated online — labelling AI systems that talk to people, and labelling AI-generated content like images and text. Those are different rules with different addressees. This article covers only the first: you operate a system that speaks with your customers.

The short version

The transparency obligation in Article 50 of the EU AI Act has applied since 2 August 2026. It is in force, not upcoming.
The caller must be able to tell they are speaking to an AI system. A clear sentence at the start of the call satisfies that.
The duty in Article 50(1) is addressed first to the provider of the system — your job as the deployer is not to switch it off.
An ordinary reception and booking agent is normally not a high-risk system.
You do not need consent for the disclosure itself. Consent becomes the issue when you record or transcribe.
Separately, the GDPR information duties under Articles 13 and 14 still apply.

Note: This is a well-founded orientation, not legal advice for your specific case. When in doubt, involve your data protection officer or a lawyer.

If you need the data protection side first, it is covered in depth in AI phone agents and GDPR. The technical fundamentals are in what is an AI voice agent.

Two duties that keep getting confused

Search for AI labelling requirements and most of what comes back is about Instagram, images and text. That is a different subject.

Interaction with people (Article 50(1)). A system that interacts directly with natural persons must be designed so the person can tell they are dealing with an AI system. That is your case when an agent answers your phone.

Synthetic content and deep fakes (Article 50(2) and (4)). Generated images, video, audio and text have to be detectable as artificially generated. That concerns agencies, newsrooms and creators — not your appointment book.

The confusion is not harmless. Apply the image-labelling rules to your phone line and you build formalities nobody asked for. Conversely, assume a phone agent is “just software” and therefore unregulated, and you miss an obligation that genuinely exists.

What Article 50 actually requires

The core is simple: the person should not be left in the dark about the fact that there is no human on the other end. The notice must be clear and distinguishable, and it must land at the latest at the first interaction. On a phone line that means in the greeting — not at the end of the call and not in the small print of your website.

Three points that tend to get lost:

The duty addresses the provider first. Article 50(1) obliges whoever develops the system and places it on the market to design it so that the information is given. For you as the deployer, the practical consequence is: choose a provider whose disclosure is built in properly — and do not turn it off. Anyone who strips out the disclosure because it “hurts conversion” is working against the purpose of the rule and carrying the risk personally.

There is an obviousness exception — do not rely on it. The information is dispensable where it is already obvious to a reasonably well-informed, observant person. On the phone that is now practically never true: modern voice AI does not read as unambiguously machine-like to many callers. A sentence costs nothing and ends the argument.

Disclosure is not consent. You are informing, not asking permission. The caller does not have to confirm that they want to speak with an AI. Real consent only becomes the issue when you record or transcribe the call.

Some reassurance: not high-risk, no conformity assessment

Part of the advisory market works with the spectre of the high-risk system — conformity assessment, technical documentation, registration. For an ordinary phone agent that answers calls, captures requests and books appointments, that regime generally does not apply. The transparency duty applies, and one sentence satisfies it.

It looks different if a system is meant to recognise emotions or categorise people biometrically, or where it is used in one of the expressly named sensitive areas. Anyone planning that is in the wrong article and needs proper legal support.

Copy-paste openings for the start of the call

These building blocks satisfy the transparency duty and can be adapted to your business. What matters is that the AI nature appears in the first sentence, not after a minute of pleasantries.

Short and neutral

“Good morning, you’re speaking with the digital assistant at Dr Berger’s practice. How can I help?”

With a note about transferring

“Hello, this is the digital phone assistant at Sauer Electrical. I’ll take your request and put you through to a colleague if needed. What’s it about?”

Where the call is recorded or transcribed

“Hello, you’re speaking with the AI assistant at Hotel Seeblick. This call will be recorded so we can handle your request. Is that all right with you?”

Outside opening hours

“Good evening, our office is currently closed. You’re speaking with the digital assistant. I can take your request and book an appointment.”

Two wording notes. First, “digital assistant” and “AI assistant” both work; “automated announcement service” does not — that describes something else. Second, if your agent answers in several languages, the notice has to be comprehensible in every language it speaks. More on that in multilingual AI receptionist.

Recording and transcription: where it gets more serious

Disclosure is the easy part. The real threshold is what happens to the call.

Understanding a request live during the conversation is a different matter from a permanent recording or a stored transcript. As soon as you store, you need a sound legal basis — for call recordings, in practice usually consent — information given before the recording starts, a retention period, and a way for the caller to decline without their request going unhandled.

Practically: if you do not need to record, do not record. For booking and request capture, a structured note is almost always enough — name, request, callback number, appointment. That is data-minimal and spares you the entire consent apparatus.

AI disclosure only answers the question “human or machine”. Independently of it, the information duties under Articles 13 and 14 GDPR apply: who processes, for what purpose, on what basis, for how long, and what rights the person has.

You do not solve that on the phone by reading it out. The usual and defensible route is a short spoken notice pointing to your website’s privacy policy — and a privacy policy that actually mentions the phone agent. That is where many implementations fail: the agent is live and the privacy policy has never heard of it.

Then there are the points that belong to the provider and that you should verify: a data processing agreement, a named processing region, and the list of sub-processors. With Hanc.AI, for instance, the operator is Good Point GmbH, FN 618845t, Vienna — verifiable on firmenbuch.at — and processing runs on Microsoft Azure in the EU (West Europe) with no data transfer out of the EU. Insist on an answer in that form from any provider; the provider comparison has a checklist for it.

A special case: outbound calls

If your agent does not only answer but also places calls, a second layer arrives. Disclosure applies just the same — but so do the rules on telephone marketing. In Germany, advertising calls to consumers without prior express consent are unlawful under § 7 UWG, whether a human or an AI is dialling. Reminders, callbacks and follow-ups within an existing customer relationship are a different matter from cold calling. Covered in detail in AI outbound calls.

Implementation in six steps

Check the greeting. Call your own agent and listen for whether the AI nature appears in the first sentence.
Check every language. If it answers multilingually, call in each language.
Decide about recording. Make it a deliberate choice. If the answer is no, switch it off.
Update the privacy policy. The phone agent belongs in it as a processing activity.
File the data processing agreement and processing region. In writing, findable, with sub-processors.
Add it to your record of processing activities. One entry, no more — but it is nearly always missing.

Legal position as of September 2026. The EU AI Act becomes applicable in stages; check the current state before relying on any single statement here.

Frequently Asked Questions

Do you have to disclose AI on a phone call? Yes, where it interacts directly with people. Article 50 of the EU AI Act requires that the person can tell they are speaking to an AI system — at the latest at the first interaction, clearly and distinguishably. On the phone, one sentence in the greeting satisfies it.

Since when has the disclosure obligation applied? The transparency obligations in Article 50 have applied since 2 August 2026. They are in force, not in preparation.

Are AI phone calls legal? Having an AI assistant answer incoming calls is lawful, provided you disclose it, have a legal basis for the data processing, and have a data processing agreement in place. For outbound marketing calls, additional rules apply — in Germany § 7 UWG, under which nothing is permitted without prior consent, AI or not.

How does the disclosure have to be worded? There is no prescribed wording. What is required is clarity and distinguishability. “You’re speaking with the digital assistant at …” is enough; a formal legal notice is not needed. What matters is the timing: at the start of the call, not later.

Do I need the caller’s consent? Not for the disclosure — that is information, not permission. Consent becomes relevant only if you permanently record or transcribe the conversation.

Does the duty fall on me or on the provider? Article 50(1) is addressed first to the provider, who must design the system accordingly. As the deployer you put it to use and must not disable the disclosure; separately, the GDPR information duties toward your callers are yours.

Is my phone agent a high-risk system? Normally no. An agent for reception, request capture and appointment booking does not usually fall under the high-risk regime. The transparency duty applies, not a conformity assessment. It can be different where emotion recognition or biometric categorisation is involved.

What happens if I get it wrong? The EU AI Act provides for fines, and data protection breaches are sanctioned separately under the GDPR. More relevant in practice than the headline maximums is how easily a missing disclosure is spotted and challenged — it is visible to anyone who calls.

Does the notice have to be given in other languages too? Yes. The duty attaches to the interaction with the person, not to a particular language. If your agent answers in English or Turkish, the notice has to be comprehensible there as well.

Done cleanly rather than made complicated

The disclosure obligation is not a hurdle but a trust advantage: callers generally take it in stride when they are told up front what they are speaking to, and react considerably worse when they work it out for themselves halfway through. If you want to hear what a clean disclosure sounds like, you can create an agent for free without a credit card and call it. How the processing is secured technically is on security.

AI phone agents and GDPR — legal bases, DPAs, EU hosting and retention
What is an AI voice agent? — fundamentals and mechanics
AI outbound calls — what applies additionally when the agent dials out
Multilingual AI receptionist — disclosure across several languages
AI receptionist comparison — a checklist for choosing a provider