AI Receptionist Law: What You Have to Arrange Yourself.

Yes, you may have your phone answered by an AI. Two things need arranging: the caller has to hear at the start of the call that they are talking to an AI, and you need to know what happens to the recording afterwards.

More and more businesses have their phone answered by an AI receptionist. It picks up, has a conversation with the caller, and then sends you a message with who called and why. Useful, and it immediately raises the question of whether that is simply allowed.

Two European laws cover it. The EU AI Act says you have to disclose that someone is talking to an AI. The GDPR governs what you may do with the recording and the transcript. Both are below, in plain terms.

Your caller has to hear that it is an AI

Since 2 August 2026, anyone talking to an AI has to know it. On the phone that means a spoken line at the opening.

The AI Act puts it this way:

“Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect.”

That last exception is for situations where it is already unmistakable. With a chat window labelled “AI assistant” you can argue that. On the phone you cannot: someone dialling your number expects a person, and hears nothing to suggest otherwise.

In practice that means an audible line in the opening. A line in your privacy statement or your terms does not count, because the caller never goes there. The law does not prescribe how that line sounds, only that the result has to be clear.

Usually it is your vendor’s job, not yours

The law places this duty on whoever builds and supplies the system. As a customer you build nothing, but you do check it is there.

There is one situation where that role shifts. Give the assistant your own name and your own voice, and change its behaviour substantially, and in the eyes of the law you can become the builder yourself. You think you are a customer, and legally you are a provider.

That is not word play. It decides who is liable on the day the disclosure turns out to have been missing. So ask your vendor which role you hold and what they cover for you contractually.

The call gets recorded, and a different law governs that

An AI receptionist records, transcribes and stores. Those are personal data about your caller, and the GDPR governs them rather than the AI Act.

This is the part people skip because it is less visible. The disclosure is one sentence and then you are done. But the recording and the transcript are not a by-product: they are precisely why you took the service. You want to read back who called and why.

That means you are capturing customer conversations, in text, searchable, on a server. The next three sections are about that.

You may keep the recording, but not indefinitely

The GDPR sets no fixed retention period. It says you keep data no longer than your purpose requires, and that you can explain that choice.

The text is short:

“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”

So there is no number in it. That does not mean anything goes; it means you pick the number and have to defend it. “Forever, because storage is cheap” is not a purpose.

Look at what you actually use those calls for. Calling someone back takes a few days. Checking an appointment takes a few weeks. Backing up an argument about a quote might take longer. Pick a period per use, write down why, and make sure your system enforces it.

A caller may ask to see their own call

Someone who called you has the right to see what you recorded about them. That covers the recording and the transcript too.

They may know whether you process data about them, they may see it, and they may hear what you use it for. When that question comes, “that sits in a system our vendor runs” is not an answer. You have a month.

So ask yourself one thing: can I find a call by phone number, and can I pull it out and delete it? If the answer is no, nothing is set wrong, something is missing.

With your vendor you put it in writing

The party processing the calls for you is a processor under the GDPR. That calls for a contract, a data processing agreement.

The GDPR leaves little room:

“the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures”

You stay responsible towards your customer, your vendor carries it out. That contract sets out what happens to the data, where it sits, who can reach it and what happens when you leave.

It is not complicated. It is one document your vendor should already have ready. If they do not, you have learned something.

What to ask before you sign

Five questions for a vendor. They are not about the technology but about who is responsible when something goes wrong.

1. Is the disclosure fixed in the system, or a setting I can switch off by accident? Fixed is better, because then it cannot go wrong.
2. Am I the provider or the customer here, and does that change if I give the assistant my own name and voice?
3. How long do you keep the recordings and transcripts, and can I set that myself?
4. Do you have a data processing agreement, and where does the data physically sit?
5. How do I pull one call out when a caller asks, and how do I delete it?

These five pair well with how to test an AI receptionist on a demo number. The demo tells you whether it can handle the call. These questions tell you whether you have a problem afterwards.

How BeepSweep does it

BeepSweep says in every opening that it is an AI. That is not a setting and it cannot be switched off.

Calls sit on servers in Amsterdam. Sensitive fields, including the transcript, the summary and phone numbers, are stored encrypted in the database with AES-256. We do not train models on users’ calls, and there is no profiling and no advertising.

We keep your messages for twelve months; after that they are deleted automatically. You can delete a message or your whole account yourself at any time, because the GDPR asks you to match retention to your purpose.

If you need a data processing agreement, ask for one on WhatsApp at +31 85 083 5355. That is also the number for questions about where your data sits.

Frequently asked questions

Questions this piece does not answer yet, and that tend to come up once someone seriously considers an AI receptionist for their business.

Do I have to register my AI receptionist anywhere?

No. There is no desk where you register your assistant. The obligation runs towards the people talking to the system, not towards a regulator.

Does this apply to a one-person business?

Yes. There is no lower limit for company size. A sole trader with an AI on the phone falls under it just as much as a corporation.

Do I always have to be able to transfer the caller to a human?

That is not a legal requirement. It is a sensible choice, because for many callers it is the difference between an assistant and a barrier.

Do I also have to say the call is being recorded?

Yes, and that is a separate duty. Disclosing that it is AI comes from the AI Act, disclosing that you record comes from the GDPR. They are independent and you need both.

What if I do not arrange this?

Fines can reach 15 million euro or 3% of worldwide annual turnover. Those are maximums for the largest players. For a small business it tends to start with a complaint from a customer, but the risk is real and it is easy to avoid.

In short

Having an AI answer your phone is allowed. Make sure the caller hears it at the start, and that the disclosure is fixed in place.

Check with your vendor that it really is fixed in the system, rather than a switch that can be turned off by accident.

Then think about the call itself. How long you keep it, who can reach it, what you do when someone asks for it, and what you have on paper with your vendor. That is not a side issue: it is about precisely the thing you took the service for.

Not sure yet what an AI receptionist actually does, or want how it compares to an answering service? For the money side there is a separate piece on what these services cost per month.