Is it legal to use AI to answer calls? GDPR and the EU AI Act explained
What a business using an AI receptionist in Spain must comply with: AI disclosure, recording and transcription, data processing agreements and sensitive data.
By the DevRoam team ·
This article is for information only and is not legal advice. Check your specific case with a professional.
Using artificial intelligence to answer the phone is legal in Spain and across the EU, provided you comply with two frameworks: the GDPR (data protection) and Regulation (EU) 2024/1689, the AI Act.
1. Transparency: say it's an AI
The AI Act requires people to know they are interacting with an AI system (Article 50). In practice, the assistant introduces itself at the start, for example: "Hi, I'm Roa, the virtual assistant at Clínica Sonrisa".
2. Information about data processing
If you record or transcribe calls, say so briefly at the start and offer more information (for example, on your website). Sample notice: "This call may be recorded to handle your request. More information on our website".
3. Who is responsible
- Your business is the data controller for callers' data.
- The AI receptionist provider is the data processor and must sign a contract with you in line with Article 28 GDPR.
4. Sensitive data
Clinics and vets may come across health data (a special category). Collect only what's needed for the appointment and configure the assistant not to go into symptoms in depth.
5. Retention and security
Decide how long you keep recordings and transcripts, and require your provider to offer encryption, access control and data location with proper safeguards.
6. Automated decisions
A receptionist that books appointments following your rules doesn't usually make decisions with significant legal effects. If you used it to make decisions about people (for example, approving or rejecting credit), the requirements would be far stricter.
Checklist
- The assistant identifies itself as an AI at the start.
- Recording notice and a link to more information.
- Signed data processing agreement.
- Defined retention period.
- Rules to avoid collecting unnecessary data.
You can see how we approach this at DevRoam in our privacy policy.