This tracker covers the rules that apply when a voice agent places or answers a call in the US, the EU or Israel. For each one it gives the current state, the dates that matter, and what the rule changes for a calling operation. We update it when one of them moves. Last checked: 13 September 2026.
What changed
United States: FCC and TCPA
Since February 2024, an AI voice has counted as an artificial voice. In Declaratory Ruling FCC 24-17, the FCC confirmed that the TCPA's restrictions on "artificial or prerecorded voice" calls cover AI technologies that generate human voices. An outbound AI call needs the called party's prior express consent unless an emergency purpose or an exemption applies. The message has to identify the entity responsible for the call, and if the call includes an advertisement or is telemarketing, it must also offer an opt-out.
A specific AI disclosure rule is still only a proposal. FCC 24-84, published in the Federal Register on 10 September 2024, would define an "AI-generated call" and require callers to disclose AI use when they obtain consent and again at the start of the call. We searched the Federal Register on 13 September 2026 and found no final rule adopting it.
The "revoke all" rule is delayed to 31 January 2027. It would make a revocation given in response to one type of message cover every future robocall and robotext from that caller, on any topic. The FCC has waived it until that date while it considers changing it (Order DA 26-12). The waiver covers only that provision, and every other revocation rule still applies.
One proceeding is open now. An FCC proposal published on 9 September 2026 would count call centers, dialing platforms and cloud voice services that use US numbers as voice service providers under its robocall rules. Comments are due 9 October 2026.
European Union: AI Act, Article 50
Article 50 has applied since 2 August 2026. Article 50(1) requires providers of AI systems that interact directly with people to design them so that people are told they are dealing with an AI, unless that is obvious. Article 50(5) requires the information to be clear and given at the latest at the first interaction. The Commission adopted guidelines on Article 50 on 20 July 2026, and Cooley's summary lists voice assistants and AI agents among the systems in scope.
The Act reaches AI whose outputs are used in the EU, wherever the provider is based. Fines go up to €15 million or 3% of worldwide annual turnover, whichever is higher. The only grace period covers the duty to mark AI-generated content in a machine-readable way, for generative systems already on the market, which have until 2 December 2026. The duty to tell people they are talking to an AI has no grace period.
Israel: Privacy Protection Law, Amendment 13
Amendment 13 has been in force since 14 August 2025. It overhauled the Privacy Protection Law, gave the Privacy Protection Authority stronger enforcement tools and brought the law closer to EU standards. The Authority has said the amendment addresses "the challenges of the artificial intelligence era".
Courts can now award exemplary damages of up to NIS 10,000 for violations on grounds the law lists. Some databases holding especially sensitive information about more than 100,000 people do not have to register, but their controllers still have to notify the Authority and name a data protection officer where the law requires one.
Who it affects
Any operation that runs calls through a voice agent: delivery and dispatch notices, appointment reminders, payment calls, inbound customer service. The rules place duties on different parties. Under the TCPA the consent question falls on whoever initiates the call, so an enterprise using a vendor still owns its consent records. Under the AI Act, Article 50(1) puts the disclosure duty on the provider of the system, so a buyer should confirm the vendor discloses by default and that the disclosure cannot be switched off. In Israel, the recordings and transcripts a voice agent produces are held in databases the Authority supervises, and a high-volume inbound line holds data about a lot of people.
What to do now
- For every US number an AI agent dials, keep a consent record that meets the prerecorded-voice standard, and use written consent for telemarketing.
- Open every AI call with the name of the business responsible for it. Offer the opt-out on any call that includes an advertisement or is telemarketing.
- Put an AI disclosure in the agent's first turn in every market. The EU already requires it and the pending FCC proposal would, so one script covers both.
- Record opt-outs so that a single "stop" can be applied across every channel and topic before 31 January 2027.
- Check that every provider in your US call path is listed in the Robocall Mitigation Database, and decide by 9 October whether to comment.
- For EU calls, make the disclosure in the call itself at the first interaction. A line in a privacy notice does not do that.
- For Israeli calls, map where recordings and transcripts are stored, who can access them, and whether any database crosses a notification threshold.