Is it legal to answer your business calls with AI?

Yes. In Canada and the US a business can answer its own incoming calls with an AI, as long as it handles the two things the law actually regulates: recording the call (tell callers, and get consent where required) and consent for any texts or emails that follow. The strict US rules on AI voices apply to calls a business makes, not calls it receives, and a growing set of state laws want the AI to say it's an AI. Every statute is linked so you can read it yourself.

Why 'is it legal' is really three questions

No statute in Canada or the US says a business must answer its phone with a person. The law regulates what happens around the conversation. First, recording: most AI receptionists record and transcribe, and recording a call is regulated in both countries. Second, the follow-up: the text or email sent after the call is an electronic message with its own consent rules. Third, disclosure: some US states now require a business to say when people are dealing with an AI, and Canadian privacy law expects callers to understand what's collected and why. A fourth question hides inside the FCC's 2024 robocall ruling: does it ban AI voices on the phone? It doesn't; it regulates calls a business places. Canada first, then the US, then what a clean setup looks like.

Canada: recording a call

Two laws matter. The Criminal Code makes it an offence to knowingly intercept a private communication 'by means of any electro-magnetic, acoustic, mechanical or other device' (s.184(1)), punishable by up to five years. But s.184(2)(a) exempts 'a person who has the consent to intercept, express or implied, of the originator of the private communication or of the person intended by the originator thereof to receive it'. Your business is the intended recipient of a call to your number, so recording your own calls is not a criminal interception. That is the one-party rule people quote. It is not the end of the analysis.

PIPEDA governs how you record. A voice recording of a caller is personal information, 'information about an identifiable individual' (s.2). The Privacy Commissioner's guidance on recording customer calls (updated 2018) says PIPEDA applies 'whether the customer or the organization initiates the call'; you may record only for a purpose 'a reasonable person would consider appropriate under the circumstances'; and you 'must inform the customer that they are recording a call, clearly state the purpose of the recording and ask for their consent'. If the caller continues knowing the call is recorded and why, their consent is implied. If they object, offer another way to do the task. Keep recordings only as long as you need them, protect them (Schedule 1, principles 4.5 and 4.7), and give a caller access to the recording if asked.

For an AI receptionist this means the greeting carries the notice and the purpose on every call, before the conversation starts; a caller who keeps talking after hearing both has given implied consent. The Commissioner's narrow exceptions (debt collection, fraud investigation) don't apply to a clinic or a plumber taking bookings. Health clinics in Canada have a provincial layer on top, health-privacy laws that treat the vendor as the clinic's agent, which we cover in our dental cost and privacy guide.

Canada: telemarketing rules, and why inbound calls usually aren't telemarketing

Canada's telemarketing rules rest on s.41 of the Telecommunications Act, which lets the CRTC 'prohibit or regulate the use by any person of the telecommunications facilities of a Canadian carrier for the provision of unsolicited telecommunications'. The CRTC's Unsolicited Telecommunications Rules and the National Do Not Call List are built on that power. The Do Not Call List's FAQ says the Rules apply to 'telemarketing calls made to personal and business numbers', and that calls which aren't selling something (its example is market research) aren't telemarketing calls.

A customer calling your business is not an unsolicited telecommunication from you. So an AI that answers your inbound line is generally not treated as telemarketing, and the Do Not Call List is about calls a business places. The Rules matter the moment the AI places calls: a sales callback nobody asked for, or an outbound campaign. If a vendor offers 'AI outbound', that is where the telemarketing rules apply, so read the CRTC's Rules before you switch it on. Keep inbound and outbound separate in your contract.

Canada: CASL for the texts and emails afterwards

The follow-up text after a call is an electronic message, and CASL's definition expressly includes 'a text, sound, voice or image message'. CASL prohibits sending a commercial electronic message unless the recipient has consented (s.6(1)), and every such message must identify the sender, give contact information and include an unsubscribe mechanism (s.6(2)).

Two things usually take care of consent for ordinary receptionist texts. First, s.6(6) removes the consent requirement, and only that, for messages that solely facilitate, complete or confirm a commercial transaction the recipient already agreed to, or provide a quote they asked for; a booking confirmation or reminder generally fits. Second, implied consent exists where there is an existing business relationship: a purchase within the two years before the message, or an inquiry within the six months before it (s.10(10)). Someone who called to ask about your service has made an inquiry.

Section 6(6) does not lift the content rules: a message that relies on it still has to identify the sender, give contact information and include an unsubscribe mechanism (s.6(2)). A separate regulation takes some messages out of section 6 altogether, among them one 'that is sent in response to a request, inquiry or complaint or is otherwise solicited by the person to whom the message is sent' (Electronic Commerce Protection Regulations, SOR/2013-221, s.3(b)). A confirmation the caller asked for can fit that. For a message the business sends on its own, such as a review request or an offer, rely on consent and the s.6(2) content rules instead. Marketing messages to that person later need the s.6(2) content plus consent, and the implied-consent clock runs out. Keep a record of who consented, when and how. Messages to US recipients pick up the US rules below.

US: recording, federal and state

Federal law is one-party consent. 18 U.S.C. § 2511(2)(d) says it is not unlawful for a person 'to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception', unless the purpose is criminal or tortious. A business recording its own calls is a party.

States can be stricter, and several are. The Digital Media Law Project's guide lists California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington as states requiring the consent of every party to a call. We read the statutes for seven of them on 2026-10-01; the table has what they say.

The practical reading, which the Washington and Montana statutes make explicit, is that an announcement at the start of the call, itself recorded, is how all-party consent is obtained on a phone line. Because a caller can be anywhere, play the notice on every call rather than guess the caller's state. Valistix's greeting says the call is recorded, on every call, and if your state needs an extra or different notice, tell us and we script it.

US: the FCC's 2024 AI-voice ruling, and inbound versus outbound

The Telephone Consumer Protection Act makes it unlawful to 'make any call' using an automatic dialing system 'or an artificial or prerecorded voice' to a cell phone without the prior express consent of the called party, and to 'initiate any telephone call to any residential telephone line using an artificial or prerecorded voice' without consent (47 U.S.C. § 227(b)(1)(A) and (B)).

On February 8, 2024 the FCC released Declaratory Ruling FCC 24-17 confirming that 'the TCPA's restrictions on the use of artificial or prerecorded voice encompass current AI technologies that resemble human voices', that voice cloning falls within the existing prohibition, and that 'callers must obtain prior express consent from the called party before making a call that utilizes artificial or prerecorded voice simulated or generated through AI technology'. The FCC's announcement adds that telemarketers need prior express written consent before robocalling consumers, and that AI-generated voices are held to the same standard.

Read the verbs: 'make' and 'initiate'. The ruling is about calls a business places. When a customer calls you and an AI answers, you did not make the call. Where it bites is outbound: an AI that calls a lead back, confirms by voice, or runs a campaign is making calls with an artificial voice and needs consent first, written consent if the call is marketing. Get the consent language and the records right before you turn AI callbacks on.

US: laws that make the AI say it's an AI

California's bot law (Business and Professions Code §§ 17940 to 17943, operative July 1, 2019) makes it unlawful to use a bot to communicate with a person in California online 'with the intent to mislead the other person about its artificial identity' to drive a sale or a vote, unless the bot clearly discloses that it is a bot. Its definitions are narrow: a 'bot' is an 'automated online account', and the law reaches online platforms with 10,000,000 or more unique monthly US visitors. A phone receptionist is not an online account, and your website is not that platform. It is a web rule, not a phone rule.

Utah's rule does reach phone calls. Under Utah Code 13-75-103 (effective May 7, 2025), a supplier using generative AI 'in connection with a consumer transaction' must disclose that the person 'is interacting with generative artificial intelligence and not a human' if the person clearly asks. Someone in a regulated occupation (one that needs a state licence or certification) must disclose it prominently, 'verbally at the start of a verbal interaction', when the interaction is high-risk: collecting health, financial or biometric data, or giving medical, legal, financial or mental-health advice. An AI that clearly discloses at the outset and throughout that it is an AI assistant is in a safe harbor (13-75-104).

Colorado is mid-change. Its 2024 AI Act (SB24-205) said anyone deploying 'an artificial intelligence system that is intended to interact with consumers' must 'ensure disclosure to each consumer' that they are interacting with an AI system, and SB25B-004 (signed August 28, 2025) moved its start to June 30, 2026. On May 14, 2026, before that date, the governor signed SB26-189, which repeals and re-enacts those provisions as a law on automated decision-making technology in 'consequential decisions' such as employment, housing, lending, insurance and health care. It takes effect January 1, 2027, and as enacted it has no general duty to tell consumers they are dealing with an AI; its notice duty is about decisions made with that technology. A law-firm summary reports that a federal court order of April 27, 2026 paused the state's enforcement of the 2024 law. A separate law, HB26-1263 (signed May 29, 2026), makes the operator of a 'conversational artificial intelligence service' disclose that it is artificial intelligence from January 1, 2027, but its definition leaves out software 'primarily designed to provide commerce-related or transactional assistance', a list that includes customer support and customer service. Read together, these texts leave Colorado's greeting-disclosure rule in flux, and a greeting that says it's an AI is the safe design either way.

Other states have bills in motion. The design answer is the same everywhere: say it's an AI in the greeting, and again whenever someone asks.

US: TCPA consent for the follow-up texts

The FCC's rules at 47 CFR 64.1200 require 'prior express written consent' before sending a call or message that includes an advertisement or constitutes telemarketing to a wireless number using an autodialer or an artificial voice (64.1200(a)(2)). 'Telemarketing' is 'the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services' (64.1200(f)(13)). Written consent is a signed agreement (electronic signatures count) naming the number and authorizing the marketing messages, which states that signing isn't a condition of buying (64.1200(f)(9)).

A confirmation text for the appointment someone just booked is not an advertisement. A text three weeks later offering a spring tune-up special is. Build your texting around that line: transactional messages flow from the call itself; marketing messages wait for written consent and a way to stop. Carriers add their own layer: US business texting goes through A2P 10DLC registration, and Valistix starts texting only once the carriers approve your registration.

What a compliant setup looks like, and what Valistix does

Put the rules together and a clean setup has six parts.

• The greeting discloses the AI and the recording before anything else is said. 'Thanks for calling Northside Plumbing. I'm the AI assistant, and this call is recorded. How can I help?' That line tells the caller it's an AI and that the call is recorded. An announcement at the start of the call is the usual way businesses handle all-party-consent states, and Utah's rule is about disclosing the AI. Tell us where your callers are and we script any extra notice your state, province or profession requires. In Canada, add why you record, for example 'this call is recorded so we can book your job and keep a record of it'; the Privacy Commissioner's guidance expects the purpose to be stated. State the purpose you really record for. (Scripted sample. Names are made up.)
• The AI says it's an AI again whenever a caller asks.
• Outbound AI calls stay off unless you hold the consent records that let you turn them on.
• Texts after a call are the confirmations and reminders the caller asked for. Any text the caller didn't ask for, such as a review request or an offer, names the business, gives contact details and has a way to unsubscribe (CASL's content rules, s.6(2)). Marketing texts need consent as well: written consent in the US, and express or valid implied consent under CASL.
• Recordings have a retention period you chose (90 days by default, up to 12 months), access is limited to the people who need it, and a caller who asks can get access to their recording.
• Clinics sign the health-privacy paperwork (a BAA in the US, agent terms in Canada) before go-live.

Valistix's practice. The receptionist says it is an AI in its greeting and whenever asked, and the greeting says the call is recorded. For Canadian businesses we add why you record to the greeting, and if your state, province or profession needs an extra or different notice, tell us and we script it. We register your business with the carriers as part of setup (A2P 10DLC in the US), so confirmation and follow-up texts reach phones; they name your business and honour STOP. Recordings, transcripts, leads and customer data are yours, with full export within 14 days of asking. For clinics and other health-information clients, Canadian clients sign our health-information agent terms (Schedule A) and US clients sign a Business Associate Agreement before any patient information is handled. We set recording retention and scrubbing for them. The receptionist sticks to bookings and the answers in your script, and gives no legal, clinical or financial advice. Get Answered comes in three sizes, matched to your call volume on a short call, month to month, cancel any time. Call (866) 413-5421, listen to the greeting, then ask it whether it's a robot.