It is seven in the evening. A customer rings your business and nobody is free. An AI voice answers, says it is an automated assistant, and books them in for Thursday.
Are AI receptionists legal in the UK? Yes, to answer calls: no UK law we read stops an AI from answering the calls your customers make. What the law asks turns on what else it does: takes caller details, records calls, keeps transcripts, hears health details or rings people. Ringing people with marketing is the least settled part. The informal advice of the Information Commission (the ICO) points to the stricter reading: get consent first.
Checked against the legislation and the ICO's and Ofcom's published guidance on 3 October 2026. WebAsk is a web and AI agency, not a law firm. This summarises published law and guidance; it is not legal advice.
TL;DR
An AI may answer the calls your customers make; the legal questions are about the caller's details, recordings, transcripts, health details and what it tells callers. Whether a conversational AI voice is "live speech" under PECR is unsettled, so treat an AI voice making marketing calls as an automated call. That needs prior consent that specifically covers automated calls. The ICO's informal advice put even a short AI-made greeting under that rule.
Is an AI receptionist legal in the UK?
Yes, to answer calls: that is the clean case. Each extra job brings its own rule.
| What the AI does | The rule (read 3 October 2026) | How settled | What it means for the build |
|---|---|---|---|
| Answers calls your customers make | PECR regs 19 and 21, the marketing-call rules. Both apply only to "direct marketing purposes" | Settled by the wording where nothing is marketed. Unsettled: promotional content on an inbound call, on a system that can also dial a list of numbers automatically | Inbound by default, with no promotional content in its answers |
| Records the call | Investigatory Powers Act 2016 s.46 and the 2018 Regulations: "all reasonable efforts to inform". UK GDPR Art. 13. ICO: "You must tell these people that you are recording the call and why" (under review) | Law, plus guidance under review | The recording disclosed in the opening line; the rest of the privacy information by link or email |
| Keeps transcripts and summaries | UK GDPR Arts 5(1)(e) and 13(2)(a). ICO: where an AI tool is used, "privacy notices should be updated" (informal advice, under review) | Law, plus informal advice | A retention period set before go-live; the privacy notice says transcripts exist |
| Hears health details (clinics) | UK GDPR Art. 9. ICO: "both a lawful basis under Article 6 and a condition for processing special category data under Article 9" (under review) | Law, plus guidance under review | The Article 9 condition chosen before go-live; it asks only what the booking needs |
| Runs on a voice platform | UK GDPR Art. 28 contract. ICO: the provider "would be the controller for any information they receive to help train their AI model" (informal advice, under review) | Law, plus informal advice | A written processor contract; the training terms checked |
| Hands over to a person | No statute we read requires it | No rule found | A real route to a person (our build standard) |
| Says what it is | No statute we read requires it. CMA: "if the fact they are dealing with AI rather than a person might affect people’s decisions then you should tell them" | Guidance | It says so in its first sentence (our build standard) |
| Rings back someone who asked | ICO (under review): a live marketing call is "solicited" if someone "specifically asks you to call them with marketing information"; a call "purely for administrative purposes" is not direct marketing | Settled for a person ringing back. Unsettled: an AI voice ringing back with marketing | A person rings back, or the AI rings back only about the booking |
| Makes marketing calls to consumers | PECR reg 19: prior consent that "must specifically cover automated calls" (ICO, under review); your name, an address or freephone number, and a number shown | Unsettled whether a conversational AI is "live speech". The cautious reading treats it as automated | Only against a consent record you can evidence, scoped separately |
| Makes marketing calls to businesses | PECR reg 19 covers any "subscriber", companies included | The same open question | The same consent rule |
| Makes any call out | Ofcom statement of policy, 20 December 2016 (archived copy): "Calling parties should not make silent or abandoned calls" | Policy, nothing AI-specific | No silent or abandoned calls |
Answering calls: what PECR covers, and what it does not
When a customer rings to book and the assistant books them, nothing is marketed at them. PECR, the Privacy and Electronic Communications Regulations 2003, has two general rules for marketing calls. Regulation 21 covers "making calls" for "direct marketing purposes". Regulation 19 covers "recorded matter for direct marketing purposes" sent by an automated calling system.
PECR can still apply to what you do next, such as ringing that customer back with marketing.
One edge is open. Regulation 19 defines an automated calling system by what it is "capable of". A voice platform that can also dial a list of numbers automatically may meet that definition even while answering. No ICO page we read covers promotional content on an inbound call answered by such a system. So keep promotional content out of its answers.
Recording calls: what the law asks
UK GDPR asks you to tell callers. The ICO says: "You must tell these people that you are recording the call and why. A recorded message is good practice." The rest of the privacy information can follow by email or a link (ICO guidance on monitoring workers, under review). No page we read says recording needs the caller's consent.
Business recording also sits under the Investigatory Powers Act 2016, s.46 and the 2018 Regulations. One condition is that the system controller (whoever has a right to control the phone system) "has made all reasonable efforts to inform every person who may use the telecommunication system" that calls may be intercepted. Whether recording your own calls is "interception" at all (section 4) we leave open; the UK GDPR duty above applies either way.
Transcripts, summaries and the voice platform
A recording, transcript or summary about a caller you can identify is personal data (UK GDPR Article 4). Callers must get privacy information "at the time when personal data are obtained", including how long you keep it or, if that is not possible, how that is decided (Article 13). Article 5 says data that identifies people must be kept "for no longer than is necessary". Our UK website legal requirements guide covers privacy notices.
If the voice platform processes calls for you, it is a processor. Article 28 then requires a contract. Answering a call-transcription provider, the ICO said its "client is likely to still be the controller". But the provider "would be the controller for any information they receive to help train their AI model" (informal advice). So read the platform's training terms.
Health details on clinic calls
Calls to a clinic may hold health data. The ICO says this can include "appointment details, reminders and invoices which tell you something about the health of the individual" (under review). Health data is special category data under Article 9. So you "must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9" (ICO, under review).
If consent is your basis, health information needs "explicit consent", says the ICO's transcripts answer (informal advice). But "Consent is not the only lawful basis that may be available". Forms that ask for health details are covered in our clinic website checklist. Our build standard: the assistant declines treatment questions, hands them to a person, and asks only what the booking needs.
Must an AI say it is not a person?
No UK statute we read requires an AI voice to say it is automated. On marketing calls, PECR asks who is calling, not what (regulation 24).
The Competition and Markets Authority (CMA) goes further in its consumer-law guidance on AI agents (9 March 2026). It says: "if the fact they are dealing with AI rather than a person might affect people’s decisions then you should tell them".
Our build standard: the assistant says it is automated in its first sentence. That is our choice, not a rule we found in law.
Live or automated: how the ICO treats a synthetic voice
This matters if your AI makes marketing calls: an automated one needs prior consent (regulation 19).
What the ICO says a live call is
The ICO says: "PECR do not use the terminology of ‘live’ calls." Its own definition: "A live call is therefore a telephone call where a live person is speaking to the person they are calling" (live-calls guidance, under review). PECR's own wording turns partly on whether a system can send "sounds which are not live speech". An AI voice is not a person. Whether its speech is "live speech" is the open question.
The ICO's answer on an AI-generated greeting
An organisation asked the ICO's innovation advice service whether "an artificial intelligence produced greeting in a call handler’s voice" could be used in a marketing call without falling under regulation 19. The greeting would be a three-to-five-second AI-made recording, played until a human took over.
The ICO said the system "would fall under this definition" of an automated calling system. It went on: "This means that no part of a direct marketing call can include recorded material without consent from the individual receiving the call." Without "specific consent", it "would not comply with Regulation 19".
These answers are "informal advice", and "It is not legally binding." The answers page is under review, last updated 16 December 2025. A conversational agent produces its speech during the call. No ICO page we read deals with that.
What the robo-call fines were about
On 25 September 2025 the ICO announced fines of £300,000 and £250,000 on two energy companies for "automated marketing calls" (ICO news). Their avatar software played "scripted lines recorded by voice actors". The ICO found breaches of regulation 19. Those were human voices, not AI.
A notice dated 28 May 2026 fined a home-improvement company £240,000 (ICO news, 8 July 2026). Its evidence included a test recording that "featured an AI generated voice". The breaches found were of regulations 21 and 24: calls to numbers on the Telephone Preference Service (TPS), and calls that failed to identify the caller. The notice does not say how the ICO classed that voice.
The cautious reading
Nothing official settles whether a conversational AI voice makes a live call or an automated one. Until that is settled, treat an AI voice making marketing calls as an automated call.
Making calls with an AI voice
Marketing calls to consumers
Under regulation 19, the subscriber must have "previously notified the caller that for the time being he consents" to these calls. The ICO adds: "General consent for marketing, or even consent for live calls, is not enough – it must specifically cover automated calls" (Guide to PECR, under review). Each call must give your name and an address or freephone number (regulation 24). You must also let your number display, or show one on which you can be contacted. The rule covers whoever instigates the calls too. A platform dialling for you does not take you outside it.
For breaches from 5 February 2026, a higher maximum penalty applies. For an undertaking it is "£17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher" (Data Protection Act 2018, s.157(5), applied by PECR Schedule 1).
Calls to businesses
Regulation 19 protects any "subscriber", so companies are covered too. Sales calls by a person to businesses have their own TPS and Corporate TPS checks, in our PECR guide to B2B outreach.
Ringing back a caller who asked
A live marketing call is solicited if someone "specifically asks you to call them with marketing information". Then "most of the PECR rules don’t apply" (ICO, under review). A call "purely for administrative purposes", such as moving a booking, is not direct marketing (ICO). No ICO page we read covers an AI voice ringing back with marketing. The cautious reading: a person rings back, or the AI rings back only about the booking.
What Ofcom expects when calls are made
Ofcom has no rules written for AI calls in the documents we read. The Communications Act 2003, s.128 defines misuse. It includes using a network where the effect or likely effect "is to cause another person unnecessarily to suffer annoyance, inconvenience or anxiety". For persistent misuse, Ofcom can impose a penalty "not exceeding £2,000,000" (s.130).
Ofcom's statement of policy on persistent misuse dates from 20 December 2016 and applies from 1 March 2017. It says: "Calling parties should not make silent or abandoned calls." The message on an abandoned call "should" say on whose behalf the call was made, give a basic-rate number to decline further calls, and carry no marketing.
Ofcom is "likely to regard misuse at unsociable hours as more harmful and liable to action", but does "not prescribe those hours". Nor does it set a permitted rate of abandoned calls: Ofcom "may take action in any case where a calling organisation makes them".
Caller ID
Ofcom's General Condition C6 binds phone providers, not you; on marketing calls, your own caller ID duty is in PECR. Ofcom's CLI guidance applies from 29 January 2025. It expects providers to block calls from abroad that show a UK number, "except in a limited number of legitimate use cases".
Does Ofcom say anything about AI?
The Ofcom AI material we read is about scams: "AI can enhance the sophistication of scam calls and messages" (strategic approach to AI, 26 March 2024).
Ofcom's website refused our automated requests on 3 October 2026. So we read Internet Archive copies, captured between December 2023 and September 2026. A later version may exist.
How WebAsk builds a voice agent
This is our standard, not a record of results:
- Inbound by default.
- It says it is an automated assistant in its first sentence.
- A real route to a person.
- Any recording disclosed in the opening line.
- Outbound calls only against a consent record you can evidence, scoped separately.
What is still open
- The crux. No ICO guidance, notice or decision we read says whether a conversational AI voice is "live speech".
- The ICO's guidance. It is marked as under review after the Data (Use and Access) Act 2025. A "PECR advice for small organisations update" is due in "Autumn 2026".
Where to start
- Decide its job and its first sentence. Inbound only, with no promotional content. Its opening line names your business, says it is automated, says whether the call is recorded, and offers a person. How a call flows through one, step by step, is in what is an AI receptionist?
- Decide what it keeps, then do the sums. Recording on or off, how long transcripts are kept, a contract with the platform and, for a clinic, your Article 9 condition. Then see how to work out whether a voice agent pays for itself.
- Talk it through. Our AI integration service can add "an inbound voice agent built to your own systems and answer sets". Get in touch.