AI Act Article 50 and voice assistants. What callers must hear

When an AI assistant answers your sales line, the caller must know from the first sentence that they are talking to AI. Article 50 of the EU AI Act has required this since 2 August 2026. If the call is recorded, a short GDPR Article 13 notice follows, with where to find the full text.

When Article 50 of the AI Act applies

The duty to disclose AI under Article 50(1) has applied since 2 August 2026 and covers every call the assistant answers.

The EU's Digital Omnibus package moved some deadlines, but only for high-risk AI systems. Article 50 is unchanged. If someone in your company heard that "the AI Act was postponed", that was about other rules.

A voice assistant on a sales line is not a high-risk system. For that use, Article 50 is the rule that matters.

What the caller must hear first

Article 50 requires the caller to learn they are talking to an AI system at the latest at the first interaction. In practice, that means the first sentence of the greeting.

The only exception is when this is obvious. A natural voice and a first name make it anything but obvious. The better the assistant sounds, the more clearly it has to say what it is.

Article 99(4) sets the fines for breaching Article 50: up to EUR 15 million or 3% of annual turnover. There is a commercial reason too: a buyer who realises halfway through a call that they were talking to AI may stop trusting your sales office before they ever visit it.

That is why our assistant doesn't pretend to be a person. It says what it is and gets straight to the point.

A sample opening line

A greeting of a few seconds covers the AI Act and a short recording notice. An example based on our demo with Zosia, at a fictional development, in Polish as callers hear it:

"Dzień dobry, biuro sprzedaży Jaśminowe Ogrody firmy Budex, mówi Zosia, wirtualna asystentka AI. Rozmowa jest nagrywana w celu obsługi zapytania, a szczegóły o danych osobowych są na stronie inwestycji w zakładce Prywatność. W czym mogę pomóc?"

And the English equivalent:

"Hello, this is the Jaśminowe Ogrody sales office of Budex. I'm Zosia, a virtual AI assistant. This call is recorded so we can handle your enquiry, and details on how we use your personal data are on the development's website under Privacy. How can I help?"

The line covers four things:

• who is answering: an AI assistant, not a member of staff,
• whose office it is: the developer's name, as the data controller,
• that the call is recorded, and why,
• where to find the full information on how personal data is used.

Adapt the wording to your company and development. Your lawyer should sign off the final version.

Call recording and GDPR

If you record calls, Article 13 of the GDPR (in Poland, RODO) requires you to inform the caller at the start. You don't have to read the whole notice over the phone. A short spoken notice plus where to find the full text is enough.

The full notice on your website states who the controller is (the developer), why you process the data, on what legal basis, how long you keep it and what rights the caller has.

The legal basis depends on what happens to the data:

What happens to the data	GDPR basis
The assistant asks about needs and books a viewing	Art. 6(1)(b): steps taken at the person's request before a contract
The recording is kept for quality checks and possible claims	Art. 6(1)(f): legitimate interest
Marketing beyond what the caller asked about	separate consent

A common Polish formula is "by continuing the call, you consent to it being recorded". That is a weak basis. If you record for quality checks, legitimate interest is the sounder basis.

Set a retention period too. For example, 30 to 90 days for recordings, and longer for lead data in the CRM, because your salesperson works with it throughout the sale.

The caller's voice must not be used to identify who they are. That would turn it into biometric data under Article 9 of the GDPR, which comes with different requirements.

A data processing agreement with your provider

The developer is the data controller. The agency that provides the assistant is the processor. The two need a data processing agreement under Article 28 of the GDPR.

The agreement should list the sub-processors that have access to recordings and transcripts, such as the telephony provider. If data goes to the US, it states on what basis: the EU-US Data Privacy Framework or standard contractual clauses. You can also require a setup where the data stays in the EU.

Larger developers ask about this during procurement, so have the answers ready before a pilot.

Incoming calls and marketing

Article 398 of Poland's Electronic Communications Law (Prawo komunikacji elektronicznej, PKE) requires consent for marketing by phone and by automated calling systems. It covers outbound calls. When a buyer calls your sales line and the assistant answers, that is a different situation.

The deciding factor is what happens after the call:

• A text message confirming a booked viewing is fine. It is information the caller asked for.
• Any later marketing call or text message needs prior consent. The assistant can ask for it during the call, and the answer goes to the CRM.

UKE, the Polish telecoms regulator, can fine a breach at up to 3% of revenue.

Checklist

• The first sentence says the caller is talking to an AI assistant.
• Right after it: the developer's name, the recording notice and where the full notice is.
• The full GDPR Article 13 notice is on your website, at the address the assistant gives.
• Each purpose of processing has a legal basis assigned to it.
• Retention periods for recordings and CRM data are set in writing.
• An Article 28 data processing agreement is signed, with a list of sub-processors and rules for transfers outside the EU.
• The voice is not used to identify the caller.
• Marketing consent is collected separately and recorded in the CRM.
• Your lawyer has reviewed the greeting and the notice.

Frequently asked questions

Is it enough for the assistant to give a first name?

No. A name and a natural voice don't tell the caller they are talking to AI. The first sentence needs a clear "AI assistant" or "virtual AI assistant".

Is a voice assistant a high-risk AI system?

No. An assistant that answers questions about units and books viewings is not a high-risk system. The Digital Omnibus delay doesn't apply to it, and Article 50 has applied since 2 August 2026.

Who is responsible for the call data?

The developer, as the data controller. The agency processes the data on the developer's behalf under an Article 28 GDPR data processing agreement.

Is this article enough to comply?

No. This is not legal advice. It describes what we check when we set up an assistant. Your lawyer should review the greeting and the privacy notice for your company.

Where to start

Write down, word for word, what a caller hears in the first 15 seconds of a call to your sales line today, including after hours when nobody picks up. We cover how many of those calls arrive in our article on after-hours calls.

Then give your lawyer that transcript together with the checklist above. To hear a greeting that meets Article 50, listen to the demo with Zosia. If you want to discuss a pilot on one development, book a 30-minute call.

Sources

1. Regulation (EU) 2024/1689 (AI Act), Articles 50 and 99, EUR-Lex
2. Yes, August 2 still matters, Jones Walker, on the Digital Omnibus and AI Act deadlines
3. EU AI Act Omnibus agreement, Gibson Dunn, on the postponed high-risk deadlines
4. Example privacy notice for recorded phone calls (in Polish), gov.pl
5. Article 398 PKE in practice (in Polish), OutreachPilot