How to choose an AI voice agent vendor: compliance questions to ask before you sign

If you're trying to choose an AI voice agent vendor, voice quality and price only tell you part of the story. The harder question is whether the vendor's platform will keep your business on the right side of Australian telemarketing, privacy and recording rules. When something goes wrong, the regulator looks at you, not your software provider. This checklist covers what to ask about calling hours, Do Not Call washing, identification and recording announcements, contract terms, call data and hand-off to your team.

Treat it as a starting point for vendor conversations rather than legal advice. For anything specific to your industry or your calling lists, check with the ACMA or a lawyer.

Why compliance belongs at the top of your vendor checklist

Plenty of business owners assume a calling provider carries the compliance risk. In Australia that doesn't hold up. The ACMA says businesses that outsource telemarketing or buy marketing lists cannot outsource their obligations under the spam and telemarketing laws, and ultimately the business is responsible.

So when you compare vendors, you're really comparing how well each one helps you meet obligations that stay with you. A good vendor makes the compliant path the default. A weak one leaves it to you to remember.

Calling-hours enforcement

Australian telemarketing rules limit when calls can be made. A vendor should be able to show you exactly how its platform keeps to those limits, without leaving it to someone's memory. Rules about permitted hours and days can change, and they may apply differently depending on the type of call, so confirm the current requirements with the ACMA rather than relying on a vendor's summary.

Questions to ask:

• Does the platform block calls outside permitted hours, or does it only warn you?
• Are calling windows worked out from the recipient's time zone or from your office's?
• How does it handle numbers where the location isn't clear, such as mobiles?
• Are public holidays built in, and who keeps that calendar up to date?
• Can a user override the restrictions, and is every override logged?
• What happens to a queued call or a scheduled callback that falls outside the window?

The time zone question matters most. A business in Sydney calling a lead in Perth can easily break calling-hour rules if the system uses the caller's clock.

Do Not Call Register washing

The Do Not Call Register doesn't block calls; it lets businesses check their calling lists and remove registered numbers before calling. That makes washing a process you have to run, and you need to know who runs it and how often.

A few facts are worth knowing before you talk to vendors:

• Home numbers, personal mobiles and fax numbers can be registered, but a business phone number cannot.
• A phone used for both business and personal calls can be registered if personal use is more than 50% of total use, so a sole trader's mobile may well be on the register.
• Once a number has been registered for 30 days, telemarketers can only call it with the person's consent or if the caller is exempt.
• Registration is free, only needs to be done once, and stays in place indefinitely unless the owner or their representative removes it.
• Calling a registered number isn't a breach if you washed your list against the register in the last 30 days and the number wasn't on it at that time.

That last point is why the timing of washes and the records kept about them matter so much.

Questions to ask:

• Does the platform wash lists against the register itself, or do you have to upload lists you've already washed?
• How does it make sure no list is called once its last wash is more than 30 days old?
• Is there a timestamped record of each wash that you can export if you ever need to show it?
• How does it record consent for people who are on the register but have agreed to be contacted?
• Does it keep your own internal do-not-call list, so anyone who asks not to be called again is suppressed straight away?
• How does it treat numbers labelled as "business", given that some may be mixed-use mobiles?

Some organisations, such as government organisations, registered charities and registered political parties, may still call registered numbers. Most commercial businesses aren't in that group, so don't assume an exemption applies without advice.

Identification and AI disclosure

People should know who is calling, and that they're talking to an AI. The OAIC's AI guidance says that when an organisation collects personal information through a public-facing AI system, it should make sure people know they're interacting with an AI rather than a human. It also recommends updating privacy policies and notifications to clearly identify public-facing AI tools.

If your business is covered by the Privacy Act, you must take reasonable steps at or before collection, or as soon as practicable afterwards, to tell people your identity, your contact details and why you're collecting their information. Most small businesses with turnover of $3 million or less aren't covered, but some are regardless of turnover, including health service providers and businesses trading in personal information.

Questions to ask:

• Does the agent say early in every call that it's an AI, and can that line be removed? (Ideally it can't.)
• Does it name your business and say why it's calling?
• What does it say if someone asks "Am I talking to a real person?"
• Can it give a callback number or other contact details when asked?

Recording announcements

Recording laws vary across Australia. Victoria Legal Aid says that under state and Commonwealth law a party to a private conversation can generally record it, provided no interception device is used. NSW is stricter: section 7 of the Surveillance Devices Act 2007 prohibits recording a private conversation you're a party to unless all principal parties consent, or limited exceptions apply. In South Australia, the Surveillance Devices Act 2016 generally requires the consent of all principal parties, express or implied. In Queensland, Legal Aid Queensland says recording a conversation you're part of isn't illegal, but communicating or publishing it without permission generally is.

If you call people in more than one state, the practical answer is usually a clear recording announcement on every call. Ask the vendor:

• Is a recording announcement played at the start of each call by default?
• If someone objects, can the agent stop recording or end the call politely?
• Who can listen to recordings, and is that access logged?
• Can transcripts and recordings be shared outside your organisation, and under what controls?

The contract clause on Do Not Call compliance

This one is easy to miss. A business that arranges for a third party to make telemarketing calls on its behalf must include express provisions in that contract requiring compliance with the Do Not Call Register Act.

Read the vendor's terms before you sign. Look for:

• An express clause requiring compliance with the Do Not Call Register Act and related telemarketing rules
• Clear responsibilities for who washes lists, who keeps consent records and who handles opt-outs
• A commitment to give you wash and call records when you ask
• Notification obligations if the vendor finds a compliance problem

If the standard terms don't include this, ask for it to be added. A vendor that pushes back here is telling you something useful.

Where call data goes

Calls produce recordings, transcripts, summaries and lead details. Ask where all of it ends up. Privacy enforcement has also become stronger: legislation passed in November 2024 introduced a statutory tort for serious invasions of privacy and gave the OAIC new tiers of civil penalties and infringement notices.

From 10 December 2026, covered organisations using personal information in automated decisions that could affect people's rights or interests must explain this in their privacy policies. If your AI agent qualifies or scores leads, check with a lawyer whether that applies to you.

Questions to ask:

• In which countries are recordings, transcripts and lead data stored and processed?
• Which third-party AI or telephony providers handle the audio?
• Is your call data used to train models, and can you opt out?
• How long is data kept, and can you delete it on request?
• Can you export everything if you leave the vendor?

Opt-outs matter here too. Where APP 7 applies, which the OAIC says generally includes direct marketing calls to numbers not on the register, you must give people a simple way to opt out and stop using their information for direct marketing within a reasonable period. Check that opt-outs captured on a call reach your CRM and every future campaign.

If the agent also sends follow-up texts or emails, remember that you need consent from each recipient even when someone else sends on your behalf, and it's up to you to prove it.

How hand-off works

An AI agent is only useful if the conversation lands well with your team. Ask:

• When a lead wants to speak to a person, can the call be transferred live, or does the agent book a callback?
• What does your team see: a full transcript, a summary, the booked appointment?
• Does the booking go directly into your calendar and CRM?
• What happens when the agent is unsure, for example with a complaint, a vulnerable caller or a question outside its brief?
• Can you review and adjust the agent's script and limits yourself?

Ask for a live demo of a hand-off, not just a slide about it.

Bringing it together

Run every shortlisted vendor through the same questions and ask for written answers. The vendors worth trusting will answer specifically and show you the controls working.

At Dialessa we built our AI voice agent around these questions: it calls new enquiries within a minute, books the appointment and follows up past leads whose consent is still current. Whoever you choose, keep the responsibility where the law puts it, with your business, and pick the vendor that makes meeting it easiest.