Broadly, yes: AI calling can be lawful in the UK, but not as cold calling. The safe course is to treat an AI voice call as an automated call under PECR, which means calling only people whose prior consent specifically covers automated or AI calls from your firm.
On top of consent, the usual rules for marketing calls still apply: identify your firm, show a valid number people can call back, respect objections and the TPS, avoid silent and abandoned calls, and, for financial products, stay within the FCA's rules on financial promotions and advice. Below: where each rule comes from, where the law is unsettled, and a checklist for before the first AI call.
What counts as an automated call under PECR?
The Privacy and Electronic Communications Regulations 2003 treat live and automated marketing calls differently. Live calls are covered mainly by regulation 21: you can make most unsolicited live marketing calls without consent, as long as the number is not on the TPS or CTPS and the person has not objected. Automated calls are covered by regulation 19, which is stricter: you must not send direct marketing made up of recorded matter through an automated calling system unless the person has previously told you they consent to such calls.
Regulation 19(4) defines the system as one which is capable of:
- "(a) automatically initiating a sequence of calls to more than one destination in accordance with instructions stored in that system; and
- (b) transmitting sounds which are not live speech for reception by persons at some or all of the destinations so called."
An AI voice agent working through a list of leads appears to meet the first limb. The question is the second: is a voice generated by software in real time "live speech"? It is not a human speaking, which is the natural reading of the phrase, so the cautious view is that AI voice calls fall within regulation 19.
Regulation 19 was amended in 2016 so that a caller relying on consent must also allow its number to be displayed, or present a number on which it can be contacted. And under regulation 24, every automated marketing call must give your name and either a contact address or a freephone number.
What has the ICO said about AI-generated voices?
The ICO has not published guidance squarely on fully generative, conversational AI agents, but it has answered a narrower question. Through its innovation advice service, an organisation asked about software that uses AI to synthesise a short greeting in a call handler's voice, played while the system detects whether a person or an answering machine has picked up. In its answer, the ICO said the system fell within the regulation 19 definition of an automated calling system, so marketing calls that included the AI-generated recording would not comply unless the organisation had specific consent. It added that wanting to avoid silent calls was understandable, but did not change the rules.
If a few seconds of synthesised greeting brings a marketing call within regulation 19, it is hard to see why a fully synthesised call would not. That is an inference, not a ruling, but a careful firm should work from it.
ICO enforcement against "avatar" calling points the same way (see fines and enforcement).
Consent that covers automated and AI calls
The ICO's telephone marketing guidance is direct about the standard: "General consent for marketing, or even consent for live calls, is not enough – it must specifically cover automated calls." It also says consent must cover both your organisation and the type of communication, such as a call or an automated call, and must be knowingly and freely given, clear and specific.
In practice, that means:
- Name the channel. The wording should cover automated or AI calls, not just "calls" or "marketing".
- Name your firm. Consent given to a lead generator for unnamed "partners" is unlikely to be enough. Check the provenance of every list.
- Make it a positive act, such as ticking an unticked box, not accepting terms and conditions.
- Keep the evidence of when, where and in what words consent was given.
- Make it easy to withdraw, and stop calling straight away when someone does.
UK GDPR applies alongside PECR. AI calling is the kind of new technology that often calls for a data protection impact assessment, and recordings and transcripts need a lawful basis and a justified retention period: see FCA call recording rules.
Solicited and unsolicited calls: why AI calls are unsettled
For live calls, the ICO draws a line between solicited and unsolicited marketing. A solicited call is one the person has specifically asked for, and the ICO's live calls guidance says that where a call is solicited, "most of the PECR rules don't apply (eg you don't need to check the number against the TPS)". Agreeing to, or not objecting to, your calls does not make them solicited.
Financial services law has a similar idea. Under article 8 of the Financial Promotion Order, a real-time communication is solicited if it is made in a call or other interactive dialogue the recipient initiated, or that "takes place in response to an express request from the recipient". A person is not treated as making an express request just because they failed to say they did not want calls, or because they accepted standard terms that said calls would happen. It must also have been clear, when the call was requested, that it would be about the kind of product actually discussed.
So can a firm use AI to call back someone who asked for a call on an enquiry form, without automated-call consent? Nobody can say with confidence. The solicited-call position comes from the ICO's guidance on live calls, and regulation 21 is expressly about unsolicited calls, while regulation 19's prohibition is not framed that way. A pure service message, such as confirming an appointment the person booked, may not be direct marketing at all, but a follow-up that promotes your services usually will be.
The safe course is to rely on neither argument. Ask for consent covering automated or AI calls from your firm on the enquiry form itself and, for regulated products, make sure the person has also expressly asked to be contacted about that kind of product.
TPS, caller ID and identifying yourself
TPS and CTPS
The TPS and CTPS are statutory registers that act as a general objection to live marketing calls. The ICO says you can only call a registered number if the subscriber has specifically told you they want your marketing calls, that a registration takes 28 days to take effect, and that you must not call anyone who has told you they do not want your calls, whether or not they are on a register.
Strictly, the TPS rules are about live calls; for automated calls the stricter test is the specific consent above. In practice, screen against both registers anyway, record why any call to a registered number is permitted, and keep your own do-not-call list.
Caller ID
Never withhold your number on a marketing call. Ofcom's guidance on calling line identification says the CLI "must include a valid, dialable telephone number which uniquely identifies the caller". Use a number that reaches your firm when someone rings back.
Saying who you are
Put your firm's name and a contact address or freephone number, as regulation 24 requires, in the opening.
Silent and abandoned calls
Ofcom can act against "persistent misuse" of a phone network under the Communications Act 2003, and its persistent misuse policy has long treated silent and abandoned calls as a priority. Its expectations have included a brief recorded message identifying the caller, played within two seconds when a call cannot be connected to an agent, and no repeat call to that number within 72 hours without a guaranteed live operator. Ofcom uses a 3% abandoned-call rate as one factor in deciding which cases to prioritise, and has rejected the argument that it is a safe harbour.
We have found no Ofcom statement on AI voice agents. An agent that is slow to speak, or waiting for answering-machine detection to decide, can leave a person listening to silence, so design for that moment. And do not assume an AI agent counts as a "live operator": Ofcom has not said so. Monitor silent and abandoned calls, and pause a campaign if they rise.
FCA rules: financial promotions, the cold-calling ban and the advice boundary
Real-time financial promotions
A sales call about a financial product is a real-time financial promotion. The Financial Promotion Order offers fewer exemptions for unsolicited real-time promotions than for solicited ones, and FCA rules, including MCOB for mortgages and equity release, apply too. So record what each person asked for, and when.
The proposed cold-calling ban
The government announced a plan to ban cold calling for consumer financial services and products in its May 2023 Fraud Strategy, and HM Treasury consulted on it from 2 August to 27 September 2023. It would extend the existing ban on pensions cold calling. As at October 2026 we have not found legislation bringing the wider ban into force, so it remains a proposal. A firm that calls only people who asked to hear from it should be well placed whatever the final rules say.
Information, not advice
Advising on regulated mortgage contracts, including lifetime mortgages, is a regulated activity, and MCOB 8 requires equity release advice to be suitable. An AI agent should stay on the information side: answer factual questions from approved material, gather details and book a call with a qualified adviser, never recommending a product or saying someone qualifies. The FCA has said it does not plan AI-specific rules and relies on its existing framework, including the Consumer Duty and the Senior Managers and Certification Regime, so the firm and its senior managers own what the agent says. Our article on AI voice agents and the Consumer Duty goes further.
Do you have to tell people they're talking to an AI?
We have found no UK law that specifically requires an AI caller to say it is an AI. That is not the end of the matter:
- Regulation 24 already requires automated marketing calls to identify your firm and give contact details.
- A caller who lets someone believe they are talking to a person risks misleading them, and general consumer protection law prohibits misleading practices.
- For FCA-regulated firms, PRIN 2A.5 requires communications that "meet the information needs of retail customers", are "likely to be understood" and "equip retail customers to make decisions that are effective, timely and properly informed". Knowing who, or what, you are talking to is part of that. See the consumer understanding outcome.
- If you call people in the EU, check the EU AI Act's transparency rules separately.
Our view: say at the start that the caller is an AI assistant from your firm, answer honestly if asked, and offer a person whenever someone wants one.
Fines and enforcement
In September 2025 the ICO announced fines totalling £550,000 against two companies for automated marketing calls. Home Improvement Marketing Ltd was fined £300,000 for 2,449,380 automated marketing calls made without consent between 31 May and 31 August 2023, in breach of regulations 19 and 24. Agents abroad used "avatar" software to play recorded lines, leaving people thinking they were speaking to someone in the UK, with no option to opt out. The other company, Green Spark Energy, was fined £250,000.
Those fines were set under the old PECR maximum. The Data (Use and Access) Act 2025 raised it to the UK GDPR level: up to £17.5 million or 4% of global annual turnover, whichever is higher. In June 2026 the ICO said the Act gives it this power under PECR, and that it is developing separate guidance on the higher fines. The ICO can also issue enforcement notices requiring a firm to stop.
A practical checklist for AI outbound calling
| # | Check before you dial | Basis |
|---|---|---|
| 1 | Prior consent on file that specifically covers automated or AI calls and names your firm, with wording, date and source recorded | PECR reg 19; ICO guidance |
| 2 | For financial products, an express request to be contacted about that kind of product | FPO art 8; FCA rules |
| 3 | Number checked against your do-not-call list, the TPS and the CTPS, with the reason recorded if a registered number is called | PECR reg 21; ICO guidance |
| 4 | Lead list provenance checked: who collected consent, when and how | ICO guidance |
| 5 | A valid, dialable number presented that reaches your firm | PECR reg 19; Ofcom CLI guidance |
| 6 | Opening gives your firm's name and a contact address or freephone number, and says the caller is an AI | PECR reg 24; best practice |
| 7 | Silent and abandoned calls monitored, with an information message and no repeat call within 72 hours without a live operator | Ofcom persistent misuse policy |
| 8 | Reasonable calling hours and limits on attempts per person | Our suggestion; Consumer Duty |
| 9 | Opt-outs on a call, by text or by email stop all contact at once | PECR reg 21; UK GDPR |
| 10 | The agent gives information from approved material only, never advice, and hands over to a person on request or at signs of vulnerability | MCOB 8; Consumer Duty |
| 11 | DPIA completed, privacy notice updated, recording notice in the opening | UK GDPR |
| 12 | Calls reviewed after the event, and someone accountable for the campaign | Consumer Duty; SM&CR |
We found no PECR rule that sets calling hours; row 8 is about fairness, particularly to older customers. Calling quickly matters too (see speed to lead in financial advice), but only within these limits.
How the COSA AI Dialler applies these checks
The COSA AI Dialler runs its compliance checks in the database before every dial, and blocks the call, rather than warning, if one fails. They include consent for AI or automated calls that names the firm, an express request for regulated products, suppression lists, the TPS and CTPS position, a Monday to Saturday calling window that excludes bank holidays, cooldowns and attempt caps, and verified caller ID with a number that can be rung back. Silent or abandoned calls put the campaign on hold automatically. By default the agent introduces itself as an AI assistant, and it never claims to be a person or gives advice. Whether a campaign is lawful remains the firm's decision.
This article is general information, not legal or regulatory advice. It reflects PECR, ICO, Ofcom and FCA material as at 24 October 2026. The ICO has no guidance specifically on generative AI voice agents, and its PECR guidance is under review following the Data (Use and Access) Act. Take advice from your compliance team, data protection officer or a solicitor before running AI calling campaigns.
