What the FCC, Ofcom and TDRA Require From AI Voice Calls

The cost you are not pricing sits in the outbound leg of your AI receptionist. Inbound answering is comparatively quiet ground: the customer dialled you. The moment that same voice starts calling back no-shows, chasing expired memberships, or reminding a property viewer about tomorrow's slot, you have moved into territory governed by robocall law, and almost nobody quotes for that. The compliance work (consent capture, opt-out plumbing, caller ID hygiene, disclosure scripting) is real labour, and if your vendor did not build it, you are the one carrying the exposure.

This piece sets out what AI voice call regulations from the FCC, Ofcom and TDRA actually require, in the order a Gulf-based operator needs them. The short version: consent lives with you, not your vendor; disclosure is cheap and protective; and the UK regime polices your phone number as hard as your script.

The Myth: AI Voices Are Exempt From Robocall Rules

The argument goes like this. Robocall rules were written for prerecorded messages. An AI receptionist is not prerecorded; it generates speech live, responds to what the caller says, and behaves like a conversation. Therefore, the reasoning concludes, it sits outside the old definitions.

It is a comfortable argument and it is wrong in every one of the three jurisdictions covered here. Regulators did not need new statutes to reach synthetic voice. They read the existing ones as already covering it, or they wrote rules that never depended on how the audio was produced in the first place.

The practical consequence for a Dubai clinic running outbound recall calls, or a Manchester gym chasing lapsed members, is that the AI question is a distraction. The questions that matter are the ones that always mattered: did this person agree to be called, can they stop it in one step, and does the number on their screen belong to you.

Reality Check: The FCC's Ruling Closed That Loophole

The United States Federal Communications Commission settled this directly. It confirmed that TCPA restrictions on the use of "artificial or prerecorded voice" in calls extend to AI technologies that generate human voices. There is no grace period embedded in that reading, because the FCC's position is that the statute already covered it.

What that pulls in is the consent standard. Under the TCPA, telemarketers cannot use an artificial voice to call a home phone without prior express written consent, and a prerecorded marketing message delivered to a mobile without that same written consent is illegal. Written consent is a specific artefact. A verbal "sure, call me" during a consultation is not it.

The FCC framed the ruling around genuine harm: bad actors using AI-generated voices to extort family members, imitate celebrities and misinform voters. Enforcement follows that framing. The same ruling gives State Attorneys General new tools to pursue those actors, which means a legitimate business is unlikely to be the first target, but it also means the legal theory is now well-tested by the time anyone gets to you.

If you operate only in the UAE, this still matters for two reasons. Your vendor's platform was probably built to US norms and its defaults reflect them. And any US-resident client on your list (common in Dubai property and premium aesthetics) brings the rule with them.

Reality Check: Ofcom Targets the Call Infrastructure, Not Just the Script

The UK regulator approaches the problem from the network side, which trips up businesses that spent all their attention on wording. Ofcom requires telecoms providers to identify and block calls using invalid, unallocated or non-dialable numbers. If your AI dialler presents a number that is not properly allocated to you, the call may simply never land, and you will read it as a low answer rate rather than a compliance failure.

The second rule bites harder. Providers must not connect calls where Calling Line Identification has been deliberately altered to disguise the caller's identity. Plenty of voice platforms offer local-presence dialling as a feature, rotating through area-code-matched numbers to lift pickup rates. Ask precisely how those numbers are allocated before you switch it on.

For a UK-facing salon group or tutoring centre, the working rule is one stable, verifiable, answerable number per outbound campaign. If a customer calls it back, a human or your AI must answer. A number that rings out is the single fastest way to look like the thing Ofcom is hunting.

Reality Check: The UAE Treats AI Calls as Commercial Communications

The Telecommunications and Digital Government Regulatory Authority governs this space in the UAE, and its framing is consent-first rather than technology-first. Telecom service providers must obtain prior consent from subscribers before sending or making unsolicited commercial communications. Nothing in that turns on whether a human or a model is speaking.

The operational obligation is the registry. Providers are required to maintain a do-not-call registry and honour opt-out requests. Formally that duty sits with the licensed provider, but it flows down to you in contract and in practice: your list is the input, and if your AI calls someone who opted out, the trail leads back to your CRM.

This is where most Gulf deployments actually fail. Not on disclosure, but on suppression. A clinic runs recall calls from an export taken before three people asked to stop hearing from the brand on WhatsApp. Opt-outs recorded in one channel rarely propagate to the dialler unless someone deliberately wired them together.

Healthcare adds a layer. Clinics licensed under the Dubai Health Authority or the Abu Dhabi Department of Health carry patient confidentiality duties that constrain what an AI voice may say to whoever answers the phone. "Confirming your filler appointment on Thursday" spoken to a husband who picked up his wife's handset is a clinical disclosure, not a scheduling one.

Myth: Consent Once Given Covers Every Future AI Call

Consent is treated by most operators as a permanent, one-time acquisition. It is closer to a perishable good with a defined scope.

Three limits apply almost everywhere. Scope: agreeing to appointment reminders is not agreeing to promotional offers. Channel: a tick box for WhatsApp messages does not authorise a voice call. Recency: a consent captured four years ago against a number that has since changed hands protects nobody.

The number-reassignment problem is underrated in the Gulf specifically, where high staff turnover and visa cycles mean mobile numbers change custody often. A gym calling a two-year-old lapsed-member list is not calling its former members. It is calling strangers.

The honest trade-off ledger

Read the last row twice. It is the line item vendors omit and the one that determines whether the rest of the ledger means anything.

What Actually Counts as Compliant Disclosure and Consent

Disclosure is not legally mandated in identical terms across all three regimes, and I will not pretend otherwise. It is, however, the cheapest defensive move available and the one that reliably survives a complaint. Say it early, say it plainly, and move on.

A disclosure that works, tested in the field on aesthetic clinics and property agencies:

• "Good morning, this is Layla, an automated assistant calling on behalf of [Clinic]. I can book, move or cancel your appointment, or put you through to a person. Which would you prefer?"

Three things are doing work there. The word automated appears before any request. The brand is named, so the caller can verify. And a human exit is offered in the first breath, which defuses the complaint that most often escalates.

The consent record you should be able to produce

For any number your AI dials, you should be able to retrieve, in under a minute: the exact wording the person agreed to, the timestamp, the channel of capture, the source (web form, intake sheet, booking flow), whether voice calls were named specifically, and the current opt-out status across every channel you operate. If any field is blank, do not dial that number.

Questions to put to a voice vendor before signing

• Which numbers will present as caller ID, and who are they allocated to?
• Does the platform support local-presence rotation, and can I disable it permanently?
• How is an in-call opt-out captured, and does it write back to my CRM in real time or in a batch?
• Does a WhatsApp or SMS opt-out suppress voice calls automatically, or are those separate lists?
• Where are call recordings and transcripts stored, in which country, and for how long?
• Can I set a maximum call attempt count and a quiet-hours window per emirate or region?
• Who holds the telecom licence for the outbound leg in the UAE, and can I see it?
• If a regulator asks for the consent evidence behind a specific call, which of us produces it?

That last one is the whole article compressed into a sentence. If the vendor's answer is anything other than "you do, and here is the export button", you have found the gap.

What to do this week without buying anything

Pull one hundred numbers at random from whatever list your outbound calls run against. For each, try to produce the consent record described above. Count how many you can complete. That percentage is your real compliance position, and it is usually a shock. Then check one thing on the inbound side: dial your own outbound caller ID from a personal phone and see what happens. Our work on AI receptionist scripts starts from the same audit, and the consent floor for voice notes applies identically here.

Frequently Raised Questions on AI Voice Compliance

Do inbound-only AI receptionists need any of this?

Largely no, and that is why inbound is the sensible starting point. The customer initiated contact, so consent to speak is implicit. You still owe disclosure as a matter of good practice, and if the AI captures data or the call is recorded, notification and storage duties apply. The robocall rules described above are aimed squarely at calls you initiate.

What breaks first in a live deployment?

Suppression sync, almost every time. Someone replies STOP on WhatsApp, the CRM flags it on the messaging record, and the voice dialler reads from a different table that was exported last Tuesday. The person gets called anyway, complains, and the complaint is far more damaging than the original message. Test this on day one with your own number before any customer sees the system.

Who should not run outbound AI voice at all?

Any business whose list was bought, scraped, or inherited in an acquisition without consent documentation transferring alongside it. Also clinics whose call content would disclose a treatment type to whoever answers, unless the script is stripped to a bare name-and-time confirmation. If you cannot name where a number came from, it is not a lead.

Does mentioning AI reduce booking rates?

Some callers do hang up on hearing it. I have not seen a credible published figure for the size of that effect and will not invent one, so measure it yourself: run disclosed and undisclosed cohorts for two weeks on inbound only, where the legal stakes are lowest, and compare completed bookings rather than call duration. In our experience the disclosed cohort converts more slowly and complains far less.

How long does compliant setup take?

The technology is fast. The consent audit is not. Expect the script, number allocation and disclosure wording to take days, and the work of reconciling opt-outs across WhatsApp, email, SMS and voice to take considerably longer, because it usually surfaces database problems that predate the AI project entirely.

If you are weighing an outbound AI voice programme in the UAE and want a straight read on whether your current list and CRM could survive a regulator's question, we are happy to look at it with you.