AI receptionist rules in 2026: AI disclosure, call recording, texting consent and HIPAA, in plain English
Answering calls customers place to you is the low-risk part. Calls and texts your AI starts are where the rules bite. A plain-English tour of the rules as of late 2026.
This is a plain-English guide to the rules that apply when an AI answers your phone, records calls or sends texts. It reflects the rules as we understand them in late October 2026. It is not legal advice. Several of these rules are still changing, and a Texas lawyer should review your setup before you launch.
Most of the risk sits where owners don’t expect it. An AI answering calls your customers place to you is the lower-risk part. Calls and texts the AI starts on its own are where the rules bite.
The short version
- Open every call and chat by saying it’s an AI and that the conversation is recorded.
- Get consent, and keep a record of it, before any automated call or text goes out.
- Honor “stop” in any form, on every channel.
- If you handle patient information, every company in the chain needs a business associate agreement, including the agency that sets it up.
- Don’t let the AI promise anything you wouldn’t put in writing.
Saying it’s an AI
There is no single federal rule that requires an inbound AI receptionist to announce itself. In 2024 the FCC proposed rules requiring AI disclosure at the start of calls. The proposed definition covers outbound calls only, and we could not confirm that a final rule had been adopted as of October 2026 (Kelley Drye).
Some states already require it in certain situations. Maine bars AI chatbots, by text or voice, from leading a reasonable consumer to think they’re talking to a human unless the AI is clearly disclosed. Utah requires disclosure when a consumer asks (Utah SB 226). California bans undisclosed bots that try to sell to California residents online (Cal. Bus. & Prof. Code 17940).
You can’t know which state a caller is in. Disclosing to everyone is the simple answer, and it costs nothing. Every system we build opens with a line like “I’m an AI assistant for [your business]. This call is recorded and transcribed, and you can ask for a person at any time.”
Recording and transcribing calls
Texas lets a call be recorded when one party consents (Texas Penal Code ch. 16). That does not cover a caller in a state where everyone on the call must consent, such as California (Cal. Penal Code 632). An AI transcribes every call, so a recording notice at the start of each one is the practical way to get everyone’s consent. Confirm the details for your business with counsel.
There is a second issue, and it concerns the AI vendor. In California, lawsuits against AI phone vendors have moved forward on the theory that the vendor could use call data for its own purposes. A federal court let a case over Google’s contact-center AI proceed in February 2025 (Goodwin). A similar case against ConverseNow, an AI ordering line for restaurants, settled in June 2026 (MLex).
For a buyer, the lesson is short. Ask whether the vendor can train on your call recordings, and choose terms where it can’t.
Outbound calls and texts
In February 2024 the FCC ruled that AI-generated voices count as an “artificial or prerecorded voice” under the Telephone Consumer Protection Act (FCC 24-17). Outbound AI calls need the person’s prior express consent. Marketing calls need prior express written consent.
An AI answering a call the customer placed is largely outside those rules. A callback, an appointment reminder, a review request by text or a “we miss you” campaign is outbound. Each of those needs consent on file.
People can withdraw consent by “any reasonable method,” a rule in force since April 11, 2025. A broader “revoke-all” rule, where one opt-out covers every future automated message from you, has been delayed to January 31, 2027 (Burr & Forman). It makes sense to build for it now. If someone says “stop calling me” on the phone, they should stop getting your texts too.
Texas texting rules (SB 140)
Since September 1, 2025, Texas has treated text messages as telephone solicitation. Violations can be sued over under the state’s consumer protection law, with treble damages (Morgan Lewis). After an industry challenge, the Texas Attorney General and the Secretary of State said businesses texting people who gave prior consent don’t need to register (Sidley).
So never text anyone who hasn’t asked to hear from you, and keep a record of when and how they agreed. That record is your defense.
Timing matters too. Federal rules limit solicitation calls to 8 a.m. to 9 p.m. in the recipient’s time zone (47 CFR 64.1200). Texas sets narrower hours of 9 a.m. to 9 p.m. Monday to Saturday and noon to 9 p.m. on Sunday (Tex. Bus. & Com. Code ch. 301). Check both with counsel before any campaign goes out.
Healthcare: HIPAA and the Texas AI notice
If the AI hears, stores or passes along patient information, it is handling protected health information. Every company in that chain is a business associate and needs a business associate agreement, or BAA (HHS). That includes the phone carrier, the speech-to-text service, the AI model, the voice service, the storage, and the agency that builds and monitors the system.
Vendors differ on this. Anthropic offers a BAA for a HIPAA-configured Claude API (Anthropic). Some AI receptionist products offer one only on their top custom tier, such as Upfirst. Ask for the full BAA chain in writing before you sign anything. When we work with a clinic, we sign a BAA ourselves and use only services that sign one too.
Texas adds its own step. Under the Texas Responsible AI Governance Act, in force since January 1, 2026, health care providers must give patients a clear written notice that AI is used in their health care service or treatment, no later than the date of service (Norton Rose Fulbright). For clinics and home care agencies, that usually means a line in the intake paperwork.
Law firms and accounting firms
Lawyers who use AI keep their duties of competence, confidentiality and supervision (ABA Formal Opinion 512, Texas Opinion 705). An intake line should say it’s an AI and not a lawyer, collect only the basics, and route the caller to a person.
Tax preparers fall under the FTC Safeguards Rule, which calls for a written security program and oversight of vendors (FTC). Keep tax return details out of any AI tool that isn’t covered by your security terms.
What the AI is allowed to promise
You are responsible for what your AI says. A Canadian tribunal held Air Canada liable for incorrect fare information its chatbot gave a customer (Moffatt v. Air Canada). Keep the AI to approved answers, and send prices, coverage, medical and legal questions to a person.
The same standard applies to how AI gets sold to you. In March 2026 the FTC settled with Air AI over claims that its AI agent could replace human sales reps. The settlement included an $18 million judgment, mostly suspended (CFO Dive). If a vendor says its AI will replace your staff or bring in a set amount of revenue, ask for the evidence.
Questions to ask any AI receptionist vendor
- What does the AI say in the first 10 seconds of a call?
- Can you or your vendors train on my call recordings?
- How is consent recorded for every text and outbound call?
- If a customer says stop on one channel, does every channel stop?
- Who signs a BAA, and which services in the chain are covered?
- What is the AI blocked from saying?
Next step
Read how we handle disclosure, data and accuracy on our how we use AI page. Or start the chat, tell us what you want to build, and we’ll point out which of these rules apply to it.