Direct answer: The FCC has confirmed that AI-generated voices fall within the TCPA restriction on artificial or prerecorded voice calls. Collection teams must assess consent, purpose, number type, revocation, identification and other requirements before deploying AI calls.
This guide translates TCPA compliance for debt collection into controls that operations, compliance, legal, IT and vendor teams can review together.
Quick-reference framework
| Control | What to implement | Evidence to retain |
|---|---|---|
| 1 | Classify each calling use case and applicable rule | Configuration, test result, event log and named owner |
| 2 | Capture and retain consent evidence where required | Configuration, test result, event log and named owner |
| 3 | Honor revocation and do-not-call signals across systems | Configuration, test result, event log and named owner |
| 4 | Use approved identification and disclosure language | Configuration, test result, event log and named owner |
| 5 | Control vendors, numbers, recordings and campaign changes | Configuration, test result, event log and named owner |
How to operationalise it
1. Classify each calling use case and applicable rule
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
2. Capture and retain consent evidence where required
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
3. Honor revocation and do-not-call signals across systems
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
4. Use approved identification and disclosure language
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
5. Control vendors, numbers, recordings and campaign changes
Translate the requirement into a deterministic trigger, system action, owner and exception route. Test it with representative accounts and adversarial scenarios. Evidence should show what the system knew, which policy version applied, what action occurred and whether a human intervened.
What the audit trail should contain
- Account, debt, channel, time zone and jurisdiction context used
- Consent, preference, frequency, dispute and suppression status
- Approved script or policy version active at the time
- Interaction transcript or recording, system events and write-backs
- Escalation, override, reviewer and final resolution
Measurements that belong on the same dashboard
- consent coverage
- revocation latency
- blocked ineligible calls
- wrong-number events
- complaints
- wrong-party contacts, disputes and complaints
- unreconciled records and repeat failures
Failure modes to test before launch
- Stale balance or newly paid account
- Shared telephone number or failed identity verification
- Dispute, hardship, attorney representation or cease request
- Unavailable CRM, payment service or write-back endpoint
- Conflicting instructions across voice, SMS and human teams
How DROS should be evaluated
For this use case, assess DROS as a controlled engagement layer rather than a free-form conversation tool. Require current context, explicit permissions, policy-bound actions, immediate suppression, human escalation and exportable evidence. Confirm every material legal interpretation with qualified counsel.
Frequently asked questions
Can software guarantee compliance?
No. Software can enforce approved controls and produce evidence, but the organisation remains responsible for legal analysis, configuration, vendor oversight and monitoring.
Should an AI agent decide ambiguous cases?
No. Ambiguity should trigger a safe response and human review, especially where rights, restrictions, hardship or disclosure are involved.
How often should controls be reviewed?
Review before launch, after material legal or workflow changes, after incidents, and on a documented recurring schedule based on risk.
Conclusion
The FCC has confirmed that AI-generated voices fall within the TCPA restriction on artificial or prerecorded voice calls. Collection teams must assess consent, purpose, number type, revocation, identification and other requirements before deploying AI calls. The durable approach connects policy, live context, enforceable controls, trained people and evidence.
This material is general operational information, not legal advice. Laws and requirements vary by jurisdiction and facts.
