Is it legal for an AI to answer your business calls? GDPR and the AI Act, in plain words
11 May 2026
More and more businesses in Spain use an AI voice assistant to answer the calls their team can't take. And the first question any prudent owner asks is the right one: is this legal? The short answer is yes, as long as it's done under a few concrete conditions that are not hard to meet.
In this article we go through which rules apply (GDPR, the EU AI Act and the Spanish rules on call recording), what compliant use looks like in practice and what to check when choosing a provider. One brief clarification: this is general information, not legal advice; for your specific case, talk to a professional.
The short answer and the rules that apply
Nothing anywhere prohibits a machine from answering a business phone: we've been talking to answering machines and automated switchboards for decades. What the law regulates is how the caller's data is handled and what that person must know about who they are talking to.
Three frameworks matter here. The first is the GDPR (the European data protection regulation): the caller's name and phone number are personal data, so you need a legitimate basis to process them, you must inform people about it, and you must not collect more than necessary. The second is the EU Artificial Intelligence Act, which imposes a very specific transparency duty: people must know they are talking to a machine and not to a human. And the third is the Spanish rules on call recording, which allow recording business conversations when the caller is informed and there is a legitimate purpose.
None of the three prohibits a voice assistant. All three say the same thing in different words: be transparent, collect the minimum and handle the data with care.
What compliant use looks like in practice
A compliant deployment starts with the introduction: the assistant says it is an assistant. No pretending to be a human receptionist, no playing coy; the caller must know from the start, and in practice most people don't mind as long as their problem gets solved.
The second piece is data minimization, which is the technical term for common sense: to book an appointment you need a name, a phone number and the service the person wants. Nothing else. A well-configured assistant doesn't ask for data it doesn't need, and you should be able to control exactly what it asks.
And the third is that the machine must never be a wall. Callers must be able to ask for the team and leave a message at any moment, and that message must actually reach the business. The AI is there to handle what nobody could handle, not to block human contact.
Recording, data storage and the special case of health
Recording business calls is legal in Spain when the caller is informed (the usual announcement at the start) and there is a legitimate purpose, such as service quality or managing appointments. What is not optional is what happens afterwards: data and recordings should be processed and stored in the European Union, and not kept forever. Limited retention, with deletion after a reasonable period, is what both GDPR and common sense expect.
Health-adjacent businesses deserve a separate mention: dental clinics, physiotherapy, aesthetic medicine. Health data gets reinforced protection under GDPR, so the practical rule is clear: the assistant should book the visit, not collect medical histories. Asking which service the person wants and for when is fine; asking them to describe symptoms, diagnoses or treatments over the phone to a machine is not. Clinical details stay for the consultation room.
A checklist for choosing a provider without surprises
The good news is you don't have to become a lawyer: it's enough to pick a provider that has done its homework and ask the right questions before signing. This short list covers the essentials:
- ✓Data in the EU: processing and storage (recordings included) must stay on European territory.
- ✓Transparency with callers: the assistant identifies itself as an assistant and recording is announced under the Spanish rules.
- ✓Data processing agreement (DPA): the document that governs what the provider does with your clients' data. If they don't offer one, bad sign.
- ✓Control over what is asked: you decide which data the assistant collects, and only what's needed for the booking.
- ✓Deletion on request: being able to erase a person's data when they ask, without a fight.
An AI answering your phone is legal in Spain and in the EU when it's done right: the assistant identifies itself as a machine, collects only what's needed for the booking, data stays in Europe with limited retention, and there is always a path to a person. Tools like 0miss work this way out of the box; even so, run the checklist with any provider before signing. And remember: this is general information, not legal advice.
0miss for your sector