You added an AI receptionist to your stack. You're provisioning phone numbers, routing calls over the PSTN, and billing your clients for minutes.
Congratulations. You may have just become a regulated voice provider — and you might not have filed a single form.
This is the part of the AI voice gold rush nobody puts in the deck. The technology is easy to resell. The regulatory footprint underneath it is not. And the FCC has spent the last two years tightening the screws on exactly the kind of call traffic you're now carrying.
Here's how to tell whether you've crossed a line, and what you actually have to do about it.
This is general guidance, not legal advice. Confirm your specific exposure with telecom counsel.
The trigger: it's not the AI, it's the dial tone
The thing that creates obligations isn't the artificial intelligence. It's the telephone service.
The moment your offering involves real phone numbers, calls that touch the public switched telephone network, and minutes you bill for, you start to look like what the FCC calls an interconnected VoIP provider or a reseller of telecommunications. That's a status, not a marketing label, and it comes with duties.
Three questions decide most of it:
- Do you provision or assign phone numbers to clients?
- Do calls originate or terminate on the PSTN (i.e., they reach real phones, not just app-to-app)?
- Do you bill end users for the service, even as a line item bundled into a managed-services plan?
If you answered yes to those, you're not "just reselling software." You're in telecom's regulatory orbit. The relevant question becomes how much of the compliance load sits on your underlying carrier or platform versus on you.
The three obligations that catch MSPs
1. USAC contributions and FCC Form 499
Telecommunications carriers and interconnected VoIP providers that aren't de minimis must contribute to the federal Universal Service Fund and file with USAC. There are two forms you'll hear about:
- Form 499-A — the annual worksheet reporting the revenue you earned from telecom service.
- Form 499-Q — the quarterly worksheet that sets your contribution obligation for the upcoming quarter.
The escape hatch is the de minimis threshold. For calendar year 2026, a filer is de minimis if its annual contribution to the fund would be less than the threshold tied to $37,175 in interstate and international end-user telecom revenue. Below that, your direct contribution obligation is limited — but "de minimis" is a calculation, not a vibe, and it doesn't automatically erase every filing duty.
There's a critical distinction the rules draw, and it's the one that protects most MSPs:
A reseller that purchases telecom service from an underlying provider for resale is treated differently from a provider contributing directly. A pure marketing agent — someone who only markets another provider's service and doesn't itself provide telecommunications — isn't required to file the worksheet at all; the revenue is treated as the underlying provider's.
Where you land depends on how your contracts and billing are structured. If your platform's underlying carrier contributes on the traffic and you're positioned as a marketing/sales channel, your direct exposure shrinks dramatically. If you're buying minutes wholesale and reselling them under your own brand with your own billing, you're closer to "reseller" — and you need to know who is contributing on that revenue so it isn't double-counted or missed entirely.
2. STIR/SHAKEN and the Robocall Mitigation Database
STIR/SHAKEN is the caller-ID authentication framework that cryptographically signs calls so the network can tell a real caller from a spoofed one. You don't need to memorize the cryptography. You need to know two things.
First, the Robocall Mitigation Database (RMD). Since 2024, the FCC requires all providers in the call path — regardless of whether they have a direct STIR/SHAKEN implementation obligation — to file an RMD certification and maintain a robocall mitigation plan describing the specific steps they take to keep illegal robocall traffic off their network.
This is not a paperwork formality you can skip. The FCC's Enforcement Bureau ordered more than 1,200 voice service providers removed from the RMD for deficient filings — which effectively disconnects them from the U.S. phone network. Get this wrong and your clients' calls stop completing.
Second, third-party authentication. As of September 18, 2025, providers obligated to implement STIR/SHAKEN who use a third party to sign their calls must obtain their own SPC token and certificate and ensure calls are signed with their certificate. Translation: if you're in the obligated tier, you can't fully outsource your call-signing identity.
3. The AI-voice consent layer
Even if you nail the telecom plumbing, the content of AI calls has its own rulebook. In February 2024 the FCC declared that AI-generated voices are "artificial" under the TCPA — which means AI voice calls inherit all the artificial/prerecorded-voice restrictions: prior express consent, caller identification, and opt-out handling.
That's a deep enough topic that we gave it its own post. If you're deploying outbound AI dialing or anything that proactively calls consumers, read TCPA, Consent, and Disclosure: What Your AI Receptionist Must Say (and When) before you launch.
The pre-resale compliance checklist
Run this before you sign a single client onto AI voice.
Status assessment
- Map your offering against the three trigger questions (numbers, PSTN, billed minutes).
- Determine whether you're positioned as a marketing agent, a reseller, or a direct provider — in writing, in your contracts.
- Confirm whether your underlying platform/carrier contributes to USAC on the traffic, and get that in the agreement.
USAC / Form 499
- Calculate whether your interstate/international end-user telecom revenue clears the de minimis threshold.
- If it does, register with USAC and confirm your 499-A (annual) and 499-Q (quarterly) filing cadence.
- Document who is responsible for contributions so revenue isn't double-counted or dropped.
STIR/SHAKEN / RMD
- Verify your underlying provider's STIR/SHAKEN signing and RMD filing are current.
- Determine whether you have an independent RMD obligation; if so, file a certification and a real mitigation plan.
- If you're in the obligated tier and use third-party signing, confirm the SPC token/certificate arrangement.
AI / TCPA
- Confirm consent posture for any outbound AI calling.
- Build AI disclosure and opt-out handling into every client deployment template.
- Keep records — consent logs, disclosure scripts, opt-out timestamps.
Contracts
- Get indemnification and "who-files-what" terms with your platform in writing.
- Make sure your client MSAs pass through acceptable-use and consent obligations to the end customer.
How to use this with your clients
Two things to do with this, both of which make you look sharper than the competitor down the street.
One: turn compliance into a selling point. Most MSPs reselling AI voice have no idea this regulatory layer exists. When you walk a prospect through how calls are authenticated, how robocall mitigation is handled, and how consent is logged, you're demonstrating a level of seriousness that wins deals against cheaper, sloppier resellers. Compliance is a trust signal.
Two: pick a platform that absorbs the heavy parts. The smartest move isn't becoming a telecom compliance expert — it's choosing a platform where the underlying carrier relationships, STIR/SHAKEN signing, and RMD posture are handled at the infrastructure level, so the residual obligations on you are small and well-defined. That's leverage. It's also the difference between voice being a margin-rich line and a liability.
If you're building voice into a broader security and managed-services motion, it pairs naturally with the higher-margin work you already sell — we broke that down in Revenue Stacking: How MSPs Combine Voice, Security, and AI for Growth.
FAQ
Does reselling an AI receptionist automatically make me a regulated voice provider? Not automatically. The status depends on whether you provision numbers, carry PSTN traffic, and bill for minutes — and on whether your contracts position you as a marketing agent versus a reseller or direct provider. The AI itself doesn't create the obligation; the telephone service does.
What is the de minimis threshold and why does it matter? It's the revenue level below which your direct USAC contribution obligation is limited. For 2026 it's tied to $37,175 in interstate and international end-user telecom revenue. It's a calculation you have to actually run — being small doesn't automatically exempt you from every filing duty.
What happens if I ignore the Robocall Mitigation Database? Bad outcomes. The FCC has removed over 1,200 providers from the RMD for deficient filings, which effectively disconnects their traffic from the U.S. phone network. If you have an independent RMD obligation and skip it, your clients' calls can stop completing.
Can my platform handle all of this for me? A well-built white-label platform handles the infrastructure-level obligations — carrier relationships, call authentication, RMD posture — so your residual duties are minimal and clearly scoped. You still own consent, disclosure, and your own client contracts. Always confirm exactly which obligations sit where, in writing.
Voxtell is a white-label AI voice platform built for MSPs and telecom resellers. The carrier relationships, call authentication, and platform-side compliance heavy lifting are handled at the infrastructure level, so you deploy a branded AI receptionist under your own name — not ours — and go live in about 48 hours. You sell the outcome; we carry the plumbing.
