Is It Legal to Use AI to Answer Business Calls in the UK?
We found nothing in the ICO guidance we read that bans using AI to answer business calls. Data protection law still applies: you need a lawful basis, you must tell callers what you do with their data, and you stay responsible for any supplier you use. This is general information, not legal advice.
What the law actually asks of you
There is no single 'AI call answering law' that we could find on the official pages we read. What applies is the same data protection framework that covers any business that handles personal information. When an AI system answers a call, it hears a name, a phone number and often the reason for the call. That is personal data, so UK GDPR and the Data Protection Act 2018 are relevant.
The Information Commissioner's Office (ICO) says in its guide to lawful basis that you must have a valid lawful basis to handle personal information. It also publishes guidance on AI and data protection and on explaining decisions made with AI. The practical questions below follow from that guidance. If you are unsure how it applies to your business, take advice from a qualified adviser.
Do you have to tell callers it is an AI?
We could not find a page on the ICO site that states, in so many words, that a business must announce 'this is an AI' at the start of a call, so we are not going to claim that it does. What the ICO does say is that individuals have the right to be informed about the collection and use of their personal data, and that this is a key transparency requirement under the GDPR.
In practice, the sensible and honest approach is to say plainly at the start of the call that the caller is speaking to an automated assistant, and to say what happens to the information they give. That is our recommendation as good practice, not a quote from a rule. Check the ICO's guidance on transparency, and take advice if your sector has extra requirements.
Lawful basis and your privacy notice
The ICO's guide to lawful basis says you must have a valid lawful basis to handle personal information, and that no one basis is always better, safer or more important than the others. It also says you must include information about your lawful basis in your privacy information.
Privacy information has to be concise, transparent, intelligible, easily accessible and written in clear and plain language, according to the ICO's guide to the right to be informed. It covers things like why you use the data, how long you keep it and who it is shared with. For a call assistant, that means your privacy notice should mention the call handling system, any recording or transcript, and the suppliers involved. The ICO also suggests combining techniques such as layered notices and just-in-time notices, which suits a short spoken message backed by a fuller notice on your website.
Decide and record your lawful basis before the system takes live calls.
Update your privacy notice to describe the call handling, recording and transcripts.
Give callers a short spoken pointer to where they can read more.
Review the notice whenever you change what the system does with the data.
Recording calls and notices
Many AI call systems record the call or keep a transcript. If you do, that recording is personal data and the points above apply to it. The ICO gives one worked example in its guidance on legitimate interests: a company relying on legitimate interests to use helpline call recordings for staff training, and working through the purpose, necessity and balancing tests.
We tried to find a dedicated ICO page on recording telephone calls and could not retrieve one, and we could not open the legislation.gov.uk pages on business call monitoring. We have therefore not stated specific rules on consent or notices for recording. Check the ICO's guidance and the relevant regulations directly. As a minimum, keep recording to what you need, tell people it is happening, and decide how long you keep it.
Automated decisions: does this apply to a call assistant?
The ICO's guidance on automated decision-making and profiling covers decisions made solely by automated means that have a legal or similarly significant effect on someone. The safeguards it lists include meaningful information about the logic involved and the ability to obtain human intervention and challenge a decision.
A call assistant that takes a message, answers a routine question or books an appointment is not obviously making that kind of decision. It could be, though, if you let it decide something significant about a person without human involvement, such as whether they are accepted or refused a service. Keep those decisions with a person.
The Data (Use and Access) Act 2025 changes some of this area. The ICO says it opens up the full range of lawful bases for significant automated decisions, and that it amends, but does not replace, UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. The ICO's page says all of the Act's data protection provisions are now in force, and its updated guidance on automated decision-making was published as a draft for consultation, which has closed. Check the ICO's current position before relying on any detail.
Suppliers, processors and where data is held
If you use a company to run the call assistant, that company is usually acting as your processor. The ICO says a controller must only use a processor that can provide sufficient guarantees, should check a processor's compliance on an ongoing basis, and is primarily responsible for its own compliance and for ensuring the compliance of its processors.
There must be a written contract. The ICO says it must include that the processor only processes personal data on your documented instructions, uses appropriate security measures, does not use another processor without your written authorisation, and deletes or returns the data at the end of the contract. It must also allow audits and inspections.
Where the data sits matters too. The ICO says people risk losing the protection of UK data protection law if their personal information is sent, or made accessible, outside the UK, and that every restricted transfer must be covered by a transfer mechanism. Ask any supplier where calls, recordings and transcripts are stored, and which other companies handle them.
Keep a route to a real person
We found no ICO page we could cite that says every AI-answered call must offer a human. There is a strong practical case anyway. Callers who are upset, who have an urgent problem or who simply ask for a person should reach one, either live or by a quick return call. Where a decision about someone is involved, the ICO's automated decision-making material points to human intervention as a safeguard. Write your hand-over rules down before launch.
A short checklist before you go live
Name your lawful basis and record why you chose it.
Tell callers it is an automated assistant, and say where to read your privacy notice.
Decide whether calls are recorded or transcribed, why, and for how long.
Sign a written processor contract and ask where data is stored.
Keep significant decisions about people with a person.
Offer a route to a real person at any point in the call.
Check the ICO's current guidance, or take advice, if you are in a regulated sector.
Sources
ICO: Guidance on AI and data protection
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
ICO: The right to be informed
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/
ICO: A guide to lawful basis
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/
ICO: What is the legitimate interests basis? (call recording example)
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/
ICO: Responsibilities and liabilities for controllers using a processor
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/
ICO: What needs to be included in the contract?
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/
ICO: International transfers, a guide
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/
ICO: Rights related to automated decision making including profiling
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/
ICO: The Data Use and Access Act 2025, what does it mean for organisations?
https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/
Erudience services related to this guide
Use cases related to this guide
Industries this guide applies to
Terms used in this guide
More guides to read next
- What Can an AI Receptionist Do, and What Can't It?
- AI Receptionist vs Answering Service: Which Should a UK Business Choose?
- AI Call Answering and Call Recording Rules: A Global Overview
Frequently asked questions
Is it legal to use AI to answer business calls in the UK?
We found no official guidance banning it. Data protection law still applies, so you need a lawful basis, clear privacy information and control over your suppliers. This is general information, not legal advice, so check the ICO's guidance or take advice.
Do I have to tell callers they are talking to an AI?
We could not verify a specific ICO rule on announcing AI. The ICO does say people have the right to be informed about how their data is used, and being open that it is an automated assistant is good practice. Check the ICO's transparency guidance.
Can I record AI-answered calls?
Recordings are personal data, so lawful basis and privacy information apply. The ICO gives an example of using helpline recordings for training under legitimate interests. We could not verify specific recording-notice rules, so check the ICO and the relevant regulations.
Is the company running the AI a data processor?
Usually it acts as your processor, and you remain primarily responsible for compliance. The ICO says you need a written contract and must only use a processor that provides sufficient guarantees. Ask where data is held and who else handles it.
Does the Data (Use and Access) Act 2025 change this?
The ICO says it amends rather than replaces UK GDPR and PECR, and changes the rules on significant automated decisions. Its page says the data protection provisions are now in force. Check the ICO's current guidance for details.