AI on the phone: what European regulation says

Two texts to know

Two European texts govern the use of an AI assistant on the phone. The first, the GDPR, has applied since 2018 to all personal data, whether you process it with AI or a spreadsheet. The second, the AI Act, is more recent: it sets rules specific to artificial intelligence, based on the risk level of each use.

An assistant that books appointments, provides information and qualifies requests is not a “high-risk” system under the AI Act. It falls mainly under the transparency obligations. That is good news: the rules are simple to apply, as long as you know them.

Rule 1: say it is an AI

The AI Act imposes a transparency obligation on systems that interact with people. Since 2 August 2026, a person must be informed that they are dealing with an AI, unless it is obvious from the context.

On the phone, it is never obvious: synthetic voices are now very natural. The assistant must therefore introduce itself as an AI from the start of the call. That is what Sophia does: “Hello, I’m Sophia, the dealership’s AI assistant…”.

Good news: it is not a barrier. Customers are very happy to talk to an AI when it answers quickly and resolves their request. What annoys them is finding out afterwards, or getting voicemail.

Rule 2: the GDPR applies

A call contains personal data: name, number, vehicle, sometimes an address or a registration plate. The GDPR therefore applies, as it does to any tool in your dealership.

• A legal basis. To book an appointment requested by the customer, it is generally the performance of pre-contractual steps or legitimate interest. For outbound sales calls, check consent or legitimate interest depending on your country.
• A data processing agreement (DPA). The AI provider processes data on your behalf. A DPA compliant with Article 28 must govern this processing.
• Identified sub-processors. You must know who processes the data: hosting, voice engine, language model, and in which countries.
• Customer information. Your privacy policy must mention the use of an AI assistant for calls.
• A retention period. Summaries and transcripts must not be kept indefinitely.

Recording and transcription

One point deserves particular attention: call recording. Recording a phone conversation is regulated, and the rules vary from country to country. A written transcript of the conversation is also personal data.

Good practice: keep only what is useful (the summary and the actions taken), for a limited period, and inform the customer. At Kardanos, calls are not recorded: Cockpit keeps a summary and a transcript, with a defined retention period.

Rule 3: the AI does not decide alone

A dealership phone assistant books appointments, provides information and qualifies requests. It does not make decisions that significantly affect the customer, such as refusing finance or ruling on a warranty.

Keep that line: the AI prepares, the human decides. For a discount, a complaint or a dispute, it passes the call to the right person with the summary. That is also what reassures your teams: the AI does not take decisions away from them, it takes away the repetitive tasks.

A compliant call, step by step

In practice, what does a call that follows the rules look like? Take a customer calling to book a service.

1. The greeting. The assistant introduces itself in the first sentence: “Hello, I’m Sophia, the dealership’s virtual assistant.” The customer knows who they are talking to.
2. The request. It only collects what the appointment needs: name, number, vehicle, reason. No unnecessary questions.
3. The booking. It offers slots according to the rules set by the dealership. For a special case, a disputed warranty, a complaint, it hands over to an advisor.
4. After the call. A summary and a transcript arrive in the team’s tool, with access limited to the people concerned and a defined retention period.
5. The customer’s rights. If they ask for access to their data or its deletion, the dealership knows where it is and can respond within the deadlines.

The documents to update

Setting up a phone assistant also means a little paperwork. Nothing heavy, but not to be forgotten:

• The record of processing activities: add call handling by the assistant, with its purpose, the data concerned and the retention period.
• The contract with the provider: the GDPR requires a processing agreement that specifies what the provider may do with the data, where it is hosted and how it is protected.
• Your website’s privacy policy: mention the assistant, what it collects and why.
• Informing your teams: your staff need to know who reads the transcripts and for what purpose.

If you have a data protection officer, at dealership or group level, involve them from the start. They know your existing processing and can tell whether an impact assessment is needed in your case.

Questions to ask your provider

1. Does the AI introduce itself as an AI at the start of every call?
2. Where is the data hosted, and who are the sub-processors?
3. Do you provide a DPA compliant with Article 28 of the GDPR?
4. Are calls recorded? How long are transcripts and summaries kept?
5. What happens when the AI does not know? Does it invent an answer or hand over?
6. Who validates the scenarios before going live?

The fifth question is not a legal one, but it is the most important for your image: an AI that invents a price or a lead time does more damage than a missed call.

Frequently asked questions

Do I need the customer’s consent before talking to them with an AI? The AI Act requires informing, not collecting consent. The AI introduces itself as such; the customer can ask to speak to a human.

Can an AI call my customers for service reminders? Yes, within the existing customer relationship, with the same transparency. Respect opt-out lists and each customer’s contact preferences.

Who is responsible if something goes wrong? You remain the controller of your customer data; the provider is a processor. Hence the importance of the DPA.

In short

An AI phone assistant is fully compatible with European regulation, on three conditions: it introduces itself as an AI, the data is governed by a DPA and identified sub-processors, and a human stays in charge of important decisions.

This article presents the main rules in simplified form. It does not replace legal advice tailored to your situation.