The EU AI Act and your phone: what a plumbing business must tell callers
Daan van den Bergh
Since 2 August 2026, an AI that answers a business phone in the EU has to be built so that callers are told they are talking to an AI, at the latest when the conversation starts. That rule is Article 50 of the EU AI Act, and it is addressed to the AI's provider, which for an off-the-shelf receptionist is your supplier rather than you. On your side, the Act adds a light duty to help your staff understand the tool, and the GDPR's rules for recording a call still apply.
I build one of these agents, SwiftGuard, so read this as a supplier explaining a rule that binds it.
What does the EU AI Act say about AI answering the phone?
Article 50(1) of the AI Act says providers "shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system". Article 50(5) adds the when and the how: "in a clear and distinguishable manner at the latest at the time of the first interaction", in a form that meets the applicable accessibility requirements.
A phone agent is squarely in scope. The Commission's guidelines on Article 50, published on 20 July 2026, list "AI-enabled voice assistants, chatbots/conversational agents" in settings such as customer support among the systems the duty covers.
The one way out for an ordinary business line is an interaction where it is obvious you are dealing with a machine, judged by a person who is "reasonably well-informed, observant and circumspect". The Commission's own FAQ on Article 50 says that exception "should be interpreted in a restrictive manner", and the guidelines name vocal tone, a robot voice against a genuine human-sounding one, among the things that weigh on it. I would not count on a natural-sounding agent on a plumber's number being obvious to the person ringing it, and I would plan on the announcement.
Did the Digital Omnibus delay the disclosure rule?
Only for a different part of Article 50. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026. It moved the Act's high-risk rules to 2 December 2027 and 2 August 2028. Inside Article 50 it gave extra time to one duty: providers of systems that generate synthetic audio, image, video or text, and were on the market before 2 August 2026, have until 2 December 2026 to comply with Article 50(2), the duty to mark that content in a machine-readable format.
The Commission's FAQ puts it plainly. Article 50 applies from 2 August 2026, and the grace period is "only as regards the marking and detection obligation". The duty to tell a caller they are talking to an AI kept its date.
Is the AI disclosure your job or your supplier's?
Your supplier's, if you bought the agent off the shelf. The Act calls a company that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name the provider (Article 3(3)), and a business "using an AI system under its authority" the deployer (Article 3(4)). Article 50(1) is addressed to providers. The guidelines spell the case out: a company that offers an AI agent under its own name to professional users, who integrate it into their existing processes "without the need for modifications or additional components", is the provider responsible for Article 50(1).
That changes if you build your own, or have one built for you and run it under your own name: Article 3(3) then makes you the provider. The guidelines treat a company that develops an interactive system in-house and puts it into service for its own use, under its own name, as a provider. The same goes for a company that takes an existing generative AI system, modifies it (with new training data, for example) and puts it into service under its own name: it becomes a provider of the new system.
Article 50 does give deployers duties of their own, in paragraphs 3 and 4: telling people when an emotion recognition or biometric categorisation system is used on them, and disclosing deepfakes and AI-generated text published to inform the public on matters of public interest. As I read them, both cover a different kind of system from an agent booking a boiler service. SwiftGuard's AI transparency disclosure says its agent does not work out how a caller is feeling from the sound of their voice, and does not categorise anyone from it.
The Act reaches deployers established or located in the EU, and those outside it where the AI's output is used in the EU (Article 2(1)). On my reading, that leaves a UK plumber answering UK callers outside the Act.
What does a proper AI disclosure on a call sound like?
A spoken sentence at the start that says "AI". For telephone lines the guidelines are specific: "explicit spoken statements at the beginning of the interaction (e.g. 'This is an AI-powered assistant')", combined where appropriate with periodic reminders in longer interactions, in particular after interruptions. Tones may help. On their own, the guidelines say, distinct audio cues "are not considered sufficient by themselves", and the same goes for a disclosure contained only in terms and conditions, URLs or documentation, and for "generic references to 'assistant'".
The guidelines add two points that matter on a booking line. An AI agent that makes bookings has to be built to disclose both its artificial nature and the person on whose behalf it is acting. And the system has to disclose what it is whenever it is asked about its nature.
Put those against what your caller actually hears:
| What to listen for | What the Commission's guidelines say | What SwiftGuard does |
|---|---|---|
| Said out loud, at the start | An explicit spoken statement at the beginning of the interaction | A fixed opening line on every call: "Hi, you've reached the AI assistant for [your business]" |
| The word "AI" | A generic reference to "assistant" is insufficient on its own | The line says "AI assistant" |
| Who it is acting for | An AI agent discloses the person on whose behalf it acts | The line names your business |
| An honest answer when asked | Disclose whenever asked about its nature | Instructed to say it is the AI assistant whenever asked, and never to pretend to be a person |
| Built in by the supplier | Providers embed transparency into the system's design and operation | Its disclosure page says the line cannot be switched off, by SwiftGuard or by the business |
The honest limit is the interruption case. The guidelines suggest reminders after interruptions, and SwiftGuard plays its opening line once. Its disclosure page says a caller who speaks over it, a noisy line, or a fault that drops the connection at the start of the call can mean the caller hears part of the line or none of it. They can ask at any point whether they are talking to a person, and when the call switches language, the agent is instructed to repeat that it is an AI assistant and that the call is recorded.
Whether callers hang up once they hear "AI" is a separate question, with its own evidence.
What does the AI Act ask of you, the business?
Article 4, on AI literacy, applies to you directly. Since the Omnibus rewrote it, providers and deployers "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The same article says this does not require them to "guarantee any specific level of AI literacy of any individual".
For a small firm I read that as making sure whoever handles the agent's call records knows what it does and where it goes wrong. SwiftGuard's terms ask the same in plainer words: review the records, details and appointments the agent produces, and do not rely on them without checking.
Article 50(6) adds that paragraphs 1 to 4 are "without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems". For a recorded phone line, the GDPR is the first of those to read.
What does the GDPR ask when an AI records your calls?
You are the controller of your callers' data, the party that determines why and how it is processed (Article 4(7)), and an AI supplier processing it on your behalf is your processor (Article 4(8)). Of your duties as controller, two bear directly on the recording, and national law can add a third.
- A contract with the supplier. Article 28(3) of the GDPR requires processing by a processor to be governed by a contract that binds it to you. That is the data processing agreement; SwiftGuard publishes its own.
- Telling callers. Article 13 requires you to give people information "at the time when personal data are obtained": who you are and how to reach you, the purposes and legal basis, the recipients, how long you keep the data and the caller's rights, among other points. The Article 29 Working Party's transparency guidelines allow a layered approach when first contact is by telephone: the most important information during the call (the purposes, your identity, the existence of the caller's rights and anything that would surprise them), and the rest by other means, such as a link to your privacy statement.
- Consent, where your country requires it. SwiftGuard's terms say its recording announcement is a notification rather than a request for consent, and that where a country's law requires the caller's actual consent (they give Germany and Austria as examples), the business is responsible for obtaining it. In Germany, section 201 of the Criminal Code makes it an offence to record another person's non-public spoken words "unbefugt", without authorisation.
SwiftGuard's opening line covers part of the first layer: it says it is the AI assistant for your business, that the call is recorded and written down, and why, "so your job gets booked correctly". It does not mention the caller's rights, which the Working Party recommends the first layer should generally convey. Your privacy statement carries the rest, and it should say that an AI receptionist records and transcribes calls on your behalf.
The AI Act puts the announcement on the agent's provider, which for an off-the-shelf receptionist is your supplier. The recording is still yours to account for: among other things, the processing agreement, a privacy statement callers can find, and consent where your country's law asks for it.
What happens if an AI receptionist does not disclose?
According to the Commission's FAQ, Article 50 is enforced mainly by national market surveillance authorities. Under Article 99 of the Act, breaching an Article 50 duty can cost up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher; for small and medium-sized enterprises, including start-ups, Article 99(6) caps each fine at whichever of the two is lower. Article 50(1) puts the design duty on the provider, so a system built without the announcement is the supplier's to answer for. If you built the agent yourself, that provider is you. The callers it misleads are still yours, ringing your number and hearing your business's name. That is reason enough to test it yourself.
Five checks for your own line
- Ring your own number from another phone and listen to the opening line. You should hear the word "AI" and your business name before anything is asked of you.
- Ask your supplier whether the announcement can be switched off. If there is a setting to hide it, the disclosure depends on you.
- Ask "am I talking to a person?" halfway through a test call and listen to the answer.
- Sign the data processing agreement and keep a copy.
- Update your privacy statement so it says calls are recorded and transcribed by an AI on your behalf. If you take calls in Germany or Austria, get advice on consent there.
SwiftGuard's answers to the first three are in its AI transparency disclosure, and the wider checklist for choosing a receptionist is in how to choose an AI receptionist. For where the greeting comes in a SwiftGuard call, see how it works.