Picture the worst version of this. One of your clients points their new AI agent at a list of "warm leads," it dials 4,000 cell phones over a weekend, and not one of those people gave consent to be called by an artificial voice.
At $500 to $1,500 per call, that weekend just generated somewhere between $2 million and $6 million in statutory exposure. With no cap.
Your client signed the contract. But you're the one who sold and deployed the system under your own brand. Guess who's getting the angry phone call — ironically, a human one.
The good news: TCPA compliance for AI voice is very learnable, and most of it comes down to a handful of rules about consent, disclosure, and opt-out. Get these right in your deployment templates and you protect your clients and yourself.
This is general guidance, not legal advice. Confirm specifics with counsel before launching outbound campaigns.
The ruling that changed the game
In February 2024, the FCC issued a Declaratory Ruling: AI-generated voices are "artificial" under the TCPA.
That single sentence pulled every AI voice agent into the same regulatory bucket as old-school robocalls. AI voice calls are now governed like any other "artificial or prerecorded voice" call — legal, but fenced in by consent, identification, disclosure, and opt-out requirements.
The penalties are the part that focuses the mind:
$500 per violation for a negligent call. Up to $1,500 per call for willful or knowing violations. Per call. No cap. The FCC's own enforcement authority can additionally fine robocallers using AI voices up to roughly $23,000 per violation.
Plaintiffs' attorneys love the TCPA precisely because the math scales so fast. One bad campaign isn't a fine — it's a class action.
Inbound vs. outbound: the line that decides everything
Here's the distinction that determines 90% of your compliance posture.
Inbound is the safe lane. When a customer dials your client's business and an AI receptionist answers, the customer initiated contact. The heavy consent machinery of the TCPA — which is built around calls placed to consumers — largely doesn't apply the same way. This is why "AI answers your phones" is the lowest-risk, highest-volume use case, and the one most MSPs should lead with.
Outbound is where the rules bite. The moment the AI places a call to a consumer, you're in artificial-voice territory and you need prior express consent before dialing. For calls that include marketing or advertising content, the bar is higher — prior express written consent. And the consent rules differ between wireless numbers and residential landlines.
Two clarifications on the current state of play in 2026:
- The FCC's controversial "one-to-one consent" rule was vacated by the Eleventh Circuit in January 2025 and subsequently repealed. The prior consent framework remains in effect — but don't read that as "consent got easier." You still need valid prior express (or express written) consent for outbound artificial-voice calls.
- The TCPA's opt-out and revocation rules tightened in 2025. Consumers can revoke consent through "any reasonable means," and opt-out requests must be honored within 10 business days of receipt. The most complex "reasonable methods" provisions were given an extra year, taking effect April 11, 2026.
What the AI must actually say
The TCPA's artificial-voice rules require specific disclosures at the start of the call. Build these into the agent's opening, every time.
At the start of every artificial-voice call, the agent must:
- Identify the business or individual responsible for the call, by name, at the very beginning.
- State a telephone number or address where that entity can be reached during the call.
If the call contains advertising or telemarketing, additionally:
- Provide an automated, interactive opt-out mechanism — and announce it within two seconds of the disclosure — so the person can make a do-not-call request right then.
The emerging AI-identification layer. Beyond the existing identification rule, the FCC has a pending proposal that would require a clear, plain-language disclosure that the call uses AI-generated voice technology, delivered at the opening of the call. Several states are moving the same direction. The practitioner move is simple: disclose that it's AI now, proactively, even where it isn't yet strictly mandated. It's cheap insurance and it builds trust.
Script-level dos and don'ts
DO open outbound calls with something like:
"Hi, this is an AI assistant calling on behalf of [Client Business Name]. You can reach us at [phone number]. I'm calling about [reason]."
That single line hits identification, callback, and AI disclosure in one breath.
DON'T let the agent pretend to be human. "Hi, this is Sarah" with no AI disclosure is exactly the pattern regulators and plaintiffs are hunting for.
DO make opt-out instant and obvious on any promotional call: "If you'd like us to stop calling, just say 'remove me' and I'll take you off the list right now."
DON'T bury the opt-out, require a callback to a different number, or make the person wait through the whole script.
DO honor opt-outs across systems and within 10 business days — and log the timestamp.
DON'T treat inbound and outbound the same. An inbound AI receptionist answering a customer's own call doesn't need the full outbound consent dance — but it should still be honest about being AI.
The state-law overlay
Federal TCPA is the floor, not the ceiling. States are stacking their own AI and bot-disclosure rules on top.
- California has required bot disclosure in commercial and electoral contexts since 2019 (SB 1001), and newer rules restrict AI from implying it's a licensed human professional in regulated settings.
- Utah's AI Policy Act requires businesses to disclose AI involvement in regulated services.
- Colorado repealed and replaced its original AI Act in May 2026 with a narrower Automated Decision-Making Technology Act (ADMT), focused on transparency and disclosure around consequential automated decisions. Its effective date was pushed to January 1, 2027, pending Attorney General rulemaking. It's narrower than the original law — but it signals where disclosure obligations are heading.
The pattern across all of them is the same: tell people when they're talking to AI. Design for that and you're ahead of most of the map.
Pre-launch consent checklist
Run this before any client goes live with outbound AI calling.
- Confirm the use case is inbound (low risk) or outbound (consent required).
- For outbound: verify prior express consent on file for every number; prior express written consent for any marketing content.
- Separate wireless from landline lists and confirm consent posture for each.
- Bake name + callback number disclosure into the agent's opening line.
- Add a plain-language AI disclosure at call start.
- For promotional calls, wire an opt-out within two seconds of disclosure.
- Build opt-out processing that honors requests via any reasonable means within 10 business days, synced across systems.
- Check state-specific disclosure rules for every state you're dialing into.
- Log everything: consent source, disclosure script version, opt-out timestamps.
- Pass acceptable-use and consent obligations through to the end client in your contract.
How to use this with your clients
Make consent and disclosure a configured default, not a conversation. Ship every client a deployment template where the AI disclosure, the identification line, and the opt-out logic are already in the opening script. Your client shouldn't have to know the TCPA exists — you've engineered compliance into the product.
Then sell it. Lead outbound-curious clients toward inbound use cases first, where the risk is lowest and the ROI is immediate — answering every call, booking appointments, killing voicemail. When they're ready for outbound, you walk them through consent like the expert you now are. That's a retention story as much as a compliance one; sloppy compliance is one of the quiet reasons clients churn, which we covered in Why MSP Clients Leave: Voice AI Churn Prevention.
And if you're not sure whether your broader offering has tipped you into regulated-provider territory, start with Are You Accidentally a Voice Provider? The Compliance Checklist for MSPs.
FAQ
Does my AI receptionist have to announce that it's AI? For inbound calls, full federal disclosure machinery is lighter — but you should still be honest that it's AI. For outbound artificial-voice calls, identification rules apply now, an explicit AI-disclosure requirement is pending federally, and several states already require it. Disclose proactively; it's cheap and it builds trust.
What's the difference between consent for inbound and outbound calls? Inbound means the customer called you — the TCPA's call-placement consent rules largely don't apply the same way. Outbound means the AI places the call, which requires prior express consent (and prior express written consent for marketing content) before you dial.
How fast do I have to honor an opt-out? Within 10 business days of receipt, and sooner if you reasonably can. As of the 2025 rules, consumers can revoke consent through any reasonable means — they don't have to use a magic word like "STOP." The more complex methods provisions take effect April 11, 2026.
What are the penalties if we get it wrong? $500 per call for negligent violations, up to $1,500 per call for willful ones, with no cap — plus potential FCC fines around $23,000 per violation for AI robocalls. Because it's per-call with no cap, a single bad outbound campaign can generate seven-figure exposure.
Voxtell is a white-label AI voice platform built for MSPs and telecom resellers. Disclosure scripts, opt-out handling, and consent logging come baked into the deployment templates, so the compliance posture ships with the product — under your brand, not ours. Stand up a branded, TCPA-aware AI receptionist for your clients and go live in about 48 hours.