Two texts, and only two
When an AI answers your calls, two European texts apply, and they complement each other without overlapping.
The Artificial Intelligence Regulation, known as the AI Act, Regulation (EU) 2024/1689, is concerned with the AI system itself: what it is allowed to do, and what people need to know when they come into contact with it. It entered into force on 1 August 2024 and applies in stages. Prohibited practices have been banned since 2 February 2025. The transparency obligations, the ones that concern you, apply from 2 August 2026.
The GDPR is concerned with data: the name, the number, the reason for the call, any recording of the voice. It has applied since 2018, to everyone, AI or not. It does not change because the receptionist is a program; it simply applies to one more processing operation.
Neither of these texts prohibits a small business from handing its phone over to an AI. They set conditions, and those conditions are reasonable.
The AI Act: saying that it is an AI
The transparency obligation
Article 50 of the Regulation requires AI systems designed to interact directly with people to be built in such a way that those people are informed that they are interacting with an AI, unless this is obvious to a reasonably attentive person given the circumstances. On the phone, nothing is obvious: today's synthetic voices can pass for human voices. The agent must therefore say so, clearly, at the start of the call.
This obligation falls first on the provider of the system, which must design it accordingly. It also concerns you, as the user: choose an agent that announces itself, and never configure it to pass itself off as a human. One sentence is enough, for example: “Cabinet Martin, good morning, I'm the practice's voice assistant, I can book your appointment or take a message.”
What is prohibited
Article 5 prohibits certain practices, including manipulation through subliminal or deceptive techniques, and exploiting vulnerabilities linked to age or disability to distort behaviour. For a reception agent, the practical rule is simple: the agent informs, suggests and books appointments; it does not pressure, it does not insist, it does not play on fear or urgency to get something. The tone you give it matters.
High-risk or not?
The Regulation reserves its heaviest obligations for “high-risk” systems, listed in its annexes: recruitment, credit decisions, education, management of critical infrastructure, justice and migration, among others. An agent that takes appointments and messages for a tradesperson, a practice or a shop is not on the list. So you have no conformity assessment and no registration in a European database to plan for. Stay alert if you entrust it with something else, for example pre-screening job candidates by phone: then it falls into a different category.
The GDPR: your data, your obligations
Who is who
You, the business whose phone is ringing, are the data controller: you decide why and how calls are processed. The voice agent provider is your data processor: it processes data on your behalf, according to your instructions. This division has two consequences: you must be able to justify each processing operation, and you must have a contract with the provider that binds it, as required by Article 28 of the GDPR. This contract, often called a data processing agreement, must be in place before the first call. Ask for it, read it, keep it.
The legal basis
Answering a call, noting contact details, booking an appointment: these processing operations are based on the performance of the contract with the customer, or on your legitimate interest in running your business. You do not need to ask for the caller's consent in order to answer them. Consent becomes necessary again for uses that go beyond the request: sending marketing offers, for example.
Informing callers
This is the most visible obligation. People must know who is processing their data, why, on what basis, who receives it, how long it is kept and what their rights are. On the phone, the CNIL (the French data protection authority) accepts information given in two stages: a short statement during the call, and the details in an accessible format, such as your website. In practice:
- the agent says at the start of the call that it is an AI and, if this is the case, that the conversation is recorded or transcribed;
- a page on your website describes the processing: purpose, provider, hosting location, retention period, rights and contact;
- your voicemail greeting, on lines that still have one, refers callers to this page.
The retention period
Data is not kept “just in case”. Set a period for each type of data: the call summary, the appointment in the calendar, the audio recording if there is one. The right period is the one that serves the purpose: handling the request, honouring the appointment, dealing with a complaint. The CNIL, the French data protection authority, publishes guidance on retention periods, and your record of processing activities must state the period you have chosen. Your provider must apply it, or allow you to apply it.
Recording conversations
Transcribing a call to produce a summary and keeping the audio are two different things. Audio recording is not required for an agent to work. If you do record, for example to check the quality of the answers at the beginning, the CNIL (the French data protection authority) requires you to inform people, allow them to object, limit the retention period and restrict access to the recordings. If you don't need it, switch it off: it is the easiest setting to defend.
People's rights
A caller can ask what you hold about them, ask for it to be corrected or deleted, or object to certain processing. Plan how you will respond: where the summaries are, who can delete them, and how quickly. One month is the standard deadline for responding.
Security and hosting
You must protect the data, and choose a processor that protects it. Ask where it is hosted, by whom, and how it is encrypted. Hosting in France or in the European Union avoids questions about transfers outside the EU, which otherwise require specific safeguards. If any of your provider's own sub-processors, for example a language model provider, are located outside the EU, the contract must say so and provide a framework for it.
The special case of health data
From the moment an appointment is booked, a medical, dental, physiotherapy or speech therapy practice brings in information relating to health: the reason for the consultation, sometimes the name of a specialist practitioner. This data is “sensitive” within the meaning of the GDPR, and in France, hosting it on behalf of a health professional is restricted to HDS-certified hosts. Before any other criterion, check that your provider uses such a host, and ask for this to be written into the contract.
Three common-sense rules complement the certification:
- the agent takes the appointment and practical information, never gives medical advice;
- it never confirms to a third party that a person is a patient of the practice, or the reason for a consultation;
- the practitioner has the final say on what is recorded and passed on.
The “medical secretary or AI” guide details how a practice can be organised with a voice agent, and the complete guide to AI receptionists puts all this in the context of setting one up.
Professional confidentiality
Lawyers, notaries, accountants, health professionals: professional confidentiality doesn't stop at the phone. The agent must be set up never to confirm the existence of a case, a client or an appointment to anyone other than the person concerned, and to take a message rather than answer when in doubt. This setting is made in the business profile, and it can be tested: call while pretending to be a third party, and check what the agent says.
The checklist, in ten points
- The agent announces itself as an AI at the start of every call.
- It is never set up to pass itself off as a human.
- Your website has an information page about how calls are processed, with the provider's name.
- A data processing agreement complying with Article 28 has been signed with the provider.
- You know where the data is hosted, and by whom.
- Retention periods are set, written down and applied.
- Audio recording is switched off, or properly governed if it is switched on.
- The processing appears in your record of processing activities.
- You know how to respond to a request for access or deletion.
- For health: HDS-certified hosting, no medical advice, no confirmation to a third party.
What Sayelo does
We have designed the agent so that these rules are respected by default: the AI is announced at the start of every call, data is hosted in France by an HDS-certified host, and a data processing agreement is provided to every customer. Numbers and telephony are provided by a partner operator registered with ARCEP (the French telecoms regulator). Settings for confidentiality, retention periods and recording remain in your hands, because it is your processing. The security and GDPR page describes the details, and the technical guide explains where the data goes during a call.
