AI voice agent CRM integration: write-back fields, deduplication and consent records

A good AI voice agent CRM integration does three jobs. It writes the result of every call back to the right record. It never creates a duplicate contact. It keeps a consent record that shows how, when and on what terms the person agreed to be called. Get those right and your reps can trust the CRM after the agent has worked a lead. Get them wrong and you end up with messy data, double-dialled prospects and consent you can't prove.

This guide is for sales operations people and CRM admins in Australia who are about to connect a voice agent. It covers the fields to map, the matching rules to set and the consent data to store, plus the questions to ask any vendor before you switch on the sync.

Decide what the CRM should hold before you connect anything

Before you look at field mappings, agree internally on one thing: the CRM is the source of truth, and the voice agent reads from it and writes to it. It should not keep its own separate list of who can be called.

That decision affects everything else:

• The agent should check the CRM for consent status and opt-outs before every call, not only when a lead first syncs.
• Any opt-out captured anywhere (by a rep, by email, by the agent) should land in one field the agent respects.
• Call results should be written to the existing contact, lead or deal record, not to a disconnected log.

Work out which object the agent works against. Some teams work from leads, others from contacts with open deals. Pick one and document it, because it decides where outcomes are written and how matching works.

The fields to write back after every call

Plenty of integrations only log "call made" with a recording link. That isn't enough for a rep picking up the lead, or for anyone checking compliance later. These are the fields worth mapping.

Outcome

Use a picklist, not free text. Keep it short and unambiguous so you can report on it:

• Appointment booked
• Call back requested
• Not interested
• Do not call again
• Wrong number
• No answer or voicemail
• Already a customer

The "do not call again" outcome should do more than record a status. It should automatically update your opt-out field and remove the person from any calling sequence. If a consumer says they don't want telemarketing calls from your organisation, consent ends immediately and can no longer be inferred, so this can't wait for someone to tidy it up manually.

Summary

A short, plain-language summary of the conversation: what the person needs, any objections, budget or timing signals, and anything they asked the rep to know. Write it to a long-text field or a call activity, not over a field a rep has already filled in. Keep the full transcript and recording linked separately, and check who in your organisation should be able to see them.

Next step

A structured next step makes the call useful:

• Next action type (meeting, call back, send information, none)
• Date and time of the next action
• Owner (which rep or team)
• Meeting link or calendar event ID if something was booked

If the agent books an appointment, the calendar event and the CRM record should match. Map the event ID so a reschedule or cancellation updates the same record and doesn't create a second one.

Consent evidence

This is the field set most integrations leave out. At a minimum, record:

• Consent type (express, or inferred from an existing relationship)
• Source (web form name, landing page, inbound phone call, event sign-up)
• Date and time consent was given
• The wording or terms version the person agreed to
• Expiry date, if any
• Opt-out status and the date it changed

The next section explains why each of these matters.

Avoiding duplicate contacts

Duplicates cause problems for a voice agent beyond cluttered reports. If the same person exists twice, an opt-out on one record can be missed on the other, and they get called again. That's a real risk, not a cosmetic one.

Set a matching order

Decide how the integration finds an existing record before it creates a new one. A sensible order:

• Match on mobile number, normalised to a single format (for example, international format with the country code)
• If there's no phone match, match on email address
• If there's still no match, create a new record and flag it for review

Phone normalisation matters more than people expect. The same number entered with spaces, a leading zero or a country code will look like three different contacts unless you standardise it on the way in.

Write updates, don't create records

Configure the agent to update existing records by ID wherever it can. When a new enquiry arrives from a web form, your form-to-CRM step should handle matching first, so the agent receives a record ID rather than raw details. That keeps a single place responsible for deduplication.

Merge rules for consent

When duplicates do get merged, decide in advance which consent data survives. The safe rule: an opt-out on any merged record wins, and the most recent valid express consent is kept along with its source and timestamp. Never let a merge quietly overwrite a "do not call" flag.

Keeping consent records that show how, when and on what terms

This is where sales operations and compliance overlap. The ACMA expects consent records to show how consent was obtained, the terms that applied, and the date and time it was obtained, and those records must be produced if the ACMA requires them. Your CRM is the obvious place to keep that evidence.

What counts as consent

Under the Do Not Call Register Act 2006, consent means express consent, or consent that can reasonably be inferred from the person's conduct and their business and other relationships. The same Act says consent can't be inferred merely because a phone number has been published. So a number scraped from a website or directory doesn't give you consent, however tidy the record looks in your CRM.

Store the terms, not just a tick

The ACMA recommends express consent based on clear terms and conditions, readily accessible where consent is given, that explain what the marketing is for, who will use it, how long it will be used and how consent can be withdrawn. In practice:

• Version your consent wording and store the version ID on each record
• Keep an archive of each version's exact text and the date it went live
• Capture the form or page URL where consent was given
• Record the timestamp from the server, not from the user's device

Also review how consent is collected upstream. The ACMA says businesses should not use pre-checked tick boxes, bundled consent or refer-a-friend arrangements to obtain marketing consent. If your forms do any of these, fix that before you point an agent at the leads.

Track expiry automatically

Under the Act, express consent that isn't given for a specified or indefinite period is taken to be withdrawn 3 months after the day it was given. The ACMA's guidance likewise treats consent that is more than 3 months old as stale unless the consumer agreed to a longer period under terms and conditions.

For a CRM admin, that means:

• Calculate a consent expiry date when consent is captured, based on the terms that applied
• Have the agent check that date before every call, especially when following up older leads
• Remove expired records from calling sequences automatically
• Report on leads approaching expiry so reps can prioritise them

Calls outside permitted times

The telemarketing industry standard sets permitted calling times. Calls outside them are allowed only if the account holder or their nominee gave express consent in advance to that particular call on that day or at that time, and you can show this to the ACMA if required. If your agent books call-backs, store the requested day and time and how the request was made as part of the record. Configure calling windows in the agent too, using the contact's time zone, not your head office's.

Privacy obligations to plan for

Privacy rules depend on your business. Most small businesses with an annual turnover of $3 million or less aren't covered by the Privacy Act 1988, though some are regardless of turnover, including health service providers and businesses trading in personal information. If you are covered, a few points affect your integration:

• You must take reasonable steps to tell people your identity, contact details and the purposes of collection at or before collection, or as soon as practicable afterwards, which affects what the agent says at the start of a call.
• The OAIC's AI guidance says people should be made aware they are interacting with an AI system rather than a human when personal information is collected through a public-facing AI system, and recommends updating privacy policies to clearly identify public-facing AI tools.
• From 10 December 2026, covered organisations using personal information in automated decision-making that could affect people's rights or interests must explain in their privacy policies the kinds of information used and decisions made. If the agent scores or routes leads, check whether this applies to you.
• Where APP 7 applies, you must give people a simple way to opt out of direct marketing and stop using their information for it within a reasonable period if asked.

Penalties carry more weight now too. The amendment bill passed in November 2024 gave the OAIC new tiers of civil penalties and the power to issue infringement notices. If you're unsure how any of this applies to you, check with the ACMA or a lawyer.

Questions to ask before you switch it on

• Does the agent check consent status and opt-outs in the CRM before every call, or only at sync?
• Which identifier does it match on, and how does it normalise phone numbers?
• Can it update records by ID rather than creating new ones?
• Which fields does it write back, and can we map them to our own custom fields?
• Does an opt-out spoken on a call update the CRM immediately?
• Where are recordings and transcripts stored, and who can access them?
• Can we export a full consent history for a contact if the ACMA asks for it?
• What happens if the CRM is unavailable: does the agent stop calling or carry on blind?

Where Dialessa fits

Dialessa is an AI voice agent that calls new enquiries within a minute, books the appointment and follows up past leads whose consent is still current. It's designed to work with the consent, outcome and next-step data described here, so your CRM stays the single record your team relies on.

Whatever tool you choose, start with the data model. Agree on the outcome picklist, set your matching rules and build the consent fields before the first call goes out. Fixing those afterwards is far harder than getting them right at the start.