Skip to main content
Audact
See the offer

Compliance

Which EU rules reach an AI phone call, and which article says so.

Eleven references · every claim carries its article

Last reviewed: 6 October 2026

A voice agent operating in the EU is touched by several regimes at once, and they ask different questions. One decides whether you may make contact. One decides what has to be said once you have. Others decide what may be said, what has to be recorded and for how long. This page maps them, and each reference below answers one question with the article number attached, so you can check it rather than take it from us.

What applies to a call

Tell the person they are dealing with an AI, and mark synthetic output machine-readably.
Regulation (EU) 2024/1689, Art. 50. In force since 2 August 2026
Have a lawful basis, inform at collection, and honour access, objection and erasure.
Regulation (EU) 2016/679, the GDPR
Obtain prior consent before an automated system places a marketing call or sends a message, and be able to demonstrate it.
Directive 2002/58/EC, Art. 13 · Telecommunicatiewet, art. 11.7
Manage, test and evidence ICT risk where the conversation supports a regulated financial function.
Regulation (EU) 2022/2554, DORA. Applicable since 17 January 2025
Keep communications fair, clear and not misleading in regulated sectors, and keep the records that show it.
Regulation (EU) 2023/1114, Art. 66 · Regulation (EU) 2017/745, Art. 7
Ensure the people operating the system have sufficient AI literacy. The earliest duty of them all.
Regulation (EU) 2024/1689, Art. 4. Applicable since 2 February 2025

What Audact does across them

One evidence substrate with the controls set per regime: the same receipt structure, different policy on top, rather than a separate integration per rule.
Working today
Checks run inside the conversation and before the dial, so a rule is enforced at the moment it applies instead of reviewed afterwards.
In controlled testing · Germany: national policy layer active. Netherlands: in development. Belgium and Austria: planned.
Policy differs per jurisdiction, because the national layer on top of the European rule differs.
Germany: active · Netherlands in progress
One export shaped for a supervisory request, covering several regimes in a single package.
In development

Side by side

Six regimes, and the question each one answers.

The overlaps are less confusing once the questions are separated. Nothing in this table substitutes for anything else in it. A campaign can be flawless under one and exposed under the next.

  • Regime
    EU AI Act, Art. 50
    The question it answers
    Does the person know they are dealing with an AI?
    Status
    In force since 2 August 2026
  • Regime
    GDPR
    The question it answers
    On what basis is the personal data processed, and can it be erased?
    Status
    In force since 25 May 2018
  • Regime
    ePrivacy, Art. 13
    The question it answers
    May this message be sent at all?
    Status
    In force · transposed per Member State
  • Regime
    NL Telecomwet, art. 11.7
    The question it answers
    May an automated system place this call to a Dutch subscriber?
    Status
    In force since 1 July 2026
  • Regime
    DORA
    The question it answers
    Is this conversation evidenced as part of your ICT estate?
    Status
    Applicable since 17 January 2025
  • Regime
    Digital Services Act
    The question it answers
    Does the platform this runs on carry duties, and which ones stay yours?
    Status
    Fully applicable since 17 February 2024

One substrate

Not one rule that satisfies everyone — one record that several rules can read.

What is true is narrower and more useful. The regimes ask for overlapping facts about the same interaction: what was said, when, on what basis, by whom, and whether it was allowed.

So the interaction produces one record, and the policy that reads it differs per regime and per country. That is why the Dutch consent question and the German wording question resolve differently on the same platform, and why adding a regime is a policy change rather than a second integration.

Note

Information, not legal advice.

These pages set out the rules as we read them, with the article numbers so you can check us. They are not legal advice, and your own position depends on facts a website cannot know. Take advice from qualified counsel before you rely on them.

Questions

Which rule should I read first?
Article 50 of the AI Act if you are already running an agent, because it has applied since 2 August 2026 and it reaches every deployment. Article 4 if you have people operating agents on your behalf, because it has applied since February 2025.
Does complying with one of these cover the others?
No, and that is the most expensive assumption on this page. They ask different questions and are enforced by different authorities. A call can be perfectly disclosed and still unlawful because no consent was recorded.
We are outside the EU. Does any of this reach us?
It can. The AI Act reaches providers and deployers in a third country where the output of the system is used in the Union, and the national marketing rules follow the person being contacted rather than the company contacting them.

Start from the one that applies to every deployment

Article 50 has applied since 2 August 2026, it reaches every AI system that speaks to a person, and it is a transparency duty rather than a ban. That page sets out eleven points, each with the source it rests on.

Read the Article 50 reference

Related