For a UK business, using an AI receptionist to answer calls raises mainly data protection questions: tell callers, have a lawful basis, keep records properly. Using AI to make calls brings in a further set of telecoms and marketing rules, policed by Ofcom and the Information Commissioner's Office (ICO). This guide covers both.
It is general information, not legal advice, and some of the guidance referred to is under review following the Data (Use and Access) Act 2025.
Caller ID: a real, dialable number
Ofcom's General Conditions require providers to ensure, so far as technically feasible, that caller ID data includes a valid, dialable telephone number that uniquely identifies the caller, and to take reasonable steps to block calls with invalid or non-dialable caller ID. Ofcom publishes detailed guidance on calling line identification, most recently updated in July 2026 with a new version that applies from July 2027.
For an AI agent that makes calls, that means presenting a genuine number that belongs to your business and that people can ring back, never a random or spoofed one.
Persistent misuse: silent and abandoned calls
Under the Communications Act 2003, Ofcom can act against persistent misuse of a network, meaning repeated behaviour that causes people unnecessary annoyance, inconvenience or anxiety. Its policy statement, published in December 2016 and in force since March 2017, can lead to penalties of up to £2 million. It treats as misuse:
- Silent calls, where the person answers and hears nothing, if caused by something within the caller's control.
- Abandoned calls, where a call intended for a live agent instead plays a message.
- Calls with withheld, invalid or non-dialable caller ID in marketing.
- Repeated calls, calls at unsociable hours and calls that ring for very short or very long periods.
The policy is technology-neutral and refers to automated calling systems and robo-calls. Ofcom has not published guidance specific to AI voice agents, but nothing suggests they are exempt.
Two common errors. Many websites still say Ofcom permits a 3% abandoned call rate. The 2016 statement removed that: Ofcom says treating the old 3% figure as a safe harbour is incorrect, and that it may act on any abandoned calls. Sites also describe a "2-second rule" for connecting to an agent. The statement actually refers to connecting the person to an information message within two seconds where a call is abandoned; it sets no fixed time for reaching an agent.
An AI agent that speaks as soon as the call is answered avoids silent calls by design. The risks for AI diallers are the same as for any dialler: overdialling, high volumes, poor caller ID and calling people who do not want to hear from you.
PECR: live and automated marketing calls
The Privacy and Electronic Communications Regulations (PECR) govern marketing calls.
- Live marketing calls must not be made to numbers registered with the Telephone Preference Service (TPS), or the Corporate TPS for businesses, or to anyone who has objected, unless they have said they don't object to your calls. You must identify yourself, show a contactable number and give contact details on request.
- Automated marketing calls, made through a system that automatically calls numbers and transmits sounds that are "not live speech", need the person's specific prior consent. The ICO says general marketing consent, or even consent to live calls, is not enough.
Is an AI voice agent "live speech"? There is no published ruling on conversational AI, but the direction is clear. In September 2025 the ICO fined two energy companies a total of £550,000 for unlawful automated marketing calls that used "avatar software", pre-recorded clips played by operators so that people thought they were speaking to a real person, and warned that robo-call technology is making automated calls harder to spot. The safe assumption is that an AI agent making marketing calls is an automated calling system, so get specific consent for AI calls before you make them.
Higher fines from 2026
The Data (Use and Access) Act 2025 brought PECR enforcement into line with the UK GDPR. The ICO now has power to fine up to £17.5 million or 4% of global turnover for PECR breaches, for breaches on or after 5 February 2026. The Act also extended the definition of a call to include attempts to connect, which matters for diallers that ring and drop.
Automated decisions
From 5 February 2026, the UK GDPR's old Article 22 was replaced by Articles 22A to 22D. Significant decisions based solely on automated processing are now allowed more widely, but with safeguards: you must tell people about the decision, let them make representations, offer human intervention and let them contest it. Special category data remains restricted.
Taking a message, booking an appointment or routing a call is unlikely to be a significant decision on its own. Refusing someone a service, a tenancy or credit through the AI alone could be. Keep consequential decisions with a person, which is good practice anyway.
A checklist for UK businesses
| Using AI to… | Check |
|---|---|
| Answer inbound calls | Tell callers it's an AI and whether calls are recorded; privacy notice; lawful basis; retention. |
| Return calls customers asked for | Genuine caller ID; keep to what the customer requested; record the request. |
| Make service calls (reminders, updates) | Genuine caller ID; avoid marketing content; respect objections. |
| Make marketing calls | Specific consent for automated calls; TPS/CTPS screening for any live calls; caller ID; no silent or abandoned calls. |
| Make decisions | Keep significant decisions with a person, or apply the Article 22C safeguards. |
For recording, see recording customer calls in the UAE and the UK.
Sources and further reading
Hear Clodia for yourself.
Try a live conversation in your browser, or tell us about your front desk.