A 10-step checklist that runs governance alongside the build: choosing the call type, setting the baseline, disclosure, handover, identity and payments, testing, controlled release and the evidence you keep each month.
To launch an AI voice agent in a regulated contact centre, choose one call type from your own call data and measure how it performs today. Agree disclosure, handover, identity and payment controls with your risk team before the build, not after it. Connect the agent to the systems that hold the answer and test it against recorded calls. Release it to a small share of live calls with people listening, and measure resolution against your baseline. Then keep the evidence current every month.
The voice is rarely what holds a launch up. Writing about a deployment for a large UK high-street bank, PolyAI said it "was built in about six weeks. Governance took six months." (PolyAI blog, July 2026). The UK Ministry of Justice's GOV.UK record for its prison enquiry voice assistant shows the same pattern. Its impact assessment was in January 2024. The data protection impact assessment and delivery assurance followed in January 2025.
The 10 steps below run the governance alongside the build, so the two finish together. They apply whichever platform you use. Regulation is summarised for planning, not as legal advice: check the detail with your own compliance and legal teams.
1. Pick the call type from your data
Start from reasons for contact, not from the technology. Pull at least 3 months of data: volumes by reason, handle time, transfers, repeat calls and where the after-call work goes.
Good first candidates are frequent, follow clear rules and need little judgement: payment dates, appointment changes, order or claim status, outage updates. Leave complaints, bereavement and advice calls with people for now.
Some calls shouldn't get an agent at all. If customers ring because a letter confuses them or a web journey fails, fix the cause. ContactBabel found 25% of US callers had already tried to solve the issue online and failed (2026).
Choose one call type and write down why. Add more once the first one works.
2. Set the baseline before you build
Measure the chosen call type as it runs today, over at least 4 weeks. Cover volume, speed of answer, abandonment, handle time, after-call work, transfers, repeat contact within 7 days, complaints and cost per call.
For context, ContactBabel's 2026 guides put the average UK inbound call at £6.17 and the average UK speed of answer at 111 seconds, against US$7.20 and 74 seconds in the US. Your own numbers are the ones that count.
Agree the baseline with operations and finance. Write down the go or no-go criteria now, before anyone has seen a demo.
3. Write disclosure and consent wording for each region
At the start of the call, the agent should say that it is an AI system, that the call may be recorded, and how to reach a person. Then check the wording against the rules where your callers are.
- EU callers: Article 50(1) of the EU AI Act has applied since 2 August 2026. People must be told they are interacting with an AI system, at the latest at the first interaction. It reaches firms outside the EU when the AI's output is used in the EU.
- UK: lawful recording needs "all reasonable efforts" to tell callers the call may be recorded (SI 2018/356). Outbound campaigns also fall under Ofcom's persistent misuse policy.
- US: Maine (since 24 September 2025) bars AI chatbots, voice included, that may mislead consumers into thinking they are dealing with a human, unless they are clearly notified. Utah requires disclosure when asked. California's AB 3030 requires a spoken disclaimer at the start and end of AI patient communications about clinical information. Recording needs all-party consent in 13 states (Kilpatrick, July 2024). Outbound AI calls need prior express consent under the TCPA (FCC 24-17).
- Canada: automated outbound telemarketing calls need express consent and must open by identifying the caller (CRTC rules).
Have compliance sign off the exact words, and keep the signed version.
4. Write the handover rules, including vulnerability
Decide when the agent must pass the call to a person, and write it down. For example:
- the caller asks for a person, at any point
- signs of vulnerability, distress or a safeguarding concern
- complaints and disputes
- low confidence, or the same question failing twice
- regulated requests, such as advice
In UK financial services, the FCA has said it does not plan AI-specific rules. It relies on the Consumer Duty and the Senior Managers and Certification Regime. Its vulnerable customer guidance (FG21/1) expects firms to spot signs of vulnerability and respond flexibly.
Callers expect the option. Gartner found 87% of customers say it is "essential for companies to provide an option to reach a human agent when using genAI" (August 2026).
Pass the context with the call: who the caller is, whether they passed security and why they rang, so nobody repeats themselves. Name an owner for every route, and test each one out of hours.
5. Decide how identity and payments work
Decide what the agent may do before and after identity checks. Many first call types need no account access. NS&I's agent, for example, handles general queries that aren't account-specific, according to its GOV.UK record.
If the agent verifies identity, use the same checks as your people, and pass the result with any handover.
Keep card numbers out of the AI. Under PCI DSS v4.0.1, an agent that hears or transcribes card numbers brings its audio, transcripts and logs into scope. Use keypad masking, a secure payment route or a payment link instead.
Mask personal data in transcripts and agree retention periods with your data protection officer. In US healthcare, a voice AI vendor that handles patient information is a business associate under HIPAA and needs a business associate agreement (BAA). Check where audio and transcripts are hosted, and if you need a specific region, get it in writing.
6. Connect the systems and the work behind the call
A voice agent that can't reach your systems can only take messages. List what it must read, such as account status, policy, order or appointment, and what it must write back: notes, cases, bookings.
Then follow the call past the hang-up. Letters, case updates, refunds and referrals are where much of the cost sits. Automate that work, or route it to a named team with a deadline. Keep one audit trail across the call and the work it triggers.
Integration is the slow part. In Deloitte Digital's 2026 survey, technology integration was the top contact centre challenge (72%), ahead of legacy systems (58%). Start access requests in week 1. If write-back isn't approved yet, start read-only.
7. Test against recorded calls
Build a reference set from your own recordings or transcripts: the common calls, the awkward ones, strong accents, background noise, interruptions, callers who change their minds, and vulnerable callers.
Score every test call on the right answer, the right action, the right handover, disclosure given and no card data captured.
The MoJ's GOV.UK record names the risks worth testing for: misclassified intent, difficulty with some accents, dialects or speech impairments, incomplete or out-of-date information, and failure to detect safeguarding statements.
Check answers against your approved policy documents, claim by claim. Re-run the full set before every change goes live.
8. Release in a controlled way
Go live on a small share of calls for the chosen call type, in staffed hours, with supervisors listening and able to step in.
In the first weeks, review every handover and every failed call daily. Fix, retest against the reference set, then release.
Widen the share in steps, against the go or no-go criteria from step 2. NS&I's record says: "Following a phased rollout, 100% of inbound customer calls are now answered by PolyAI" (GOV.UK, October 2025).
Tell your front-line team what is changing, and give them a quick way to flag problems.
9. Measure resolution, not containment alone
Containment counts calls that end without reaching a person. It also counts callers who gave up. Track it, but don't run the service on it.
Lead with resolution: the caller's need met end to end, including the work after the call. Beside it, track repeat contact within 7 days, handover rate and reasons, abandonment inside the agent, satisfaction on agent-handled calls, complaints, accuracy against policy and cost per resolved call.
Set expectations from published figures, not headline claims. In broad regulated service lines, the figures published by PolyAI and on GOV.UK put containment in the 20s to 40s. Quicken reports 21%, NS&I about 22% (the independent GOV.UK figure), Simplyhealth 25%, UniCredit Zagrebačka banka 27%, Howard Brown Health 30% and Allstate 42%, all PolyAI-reported apart from NS&I. Narrower, structured call types run higher: in a PolyAI case study, PG&E reports 67%, which PolyAI says is 6% higher than its legacy IVR. Labels vary between case studies, so check how each figure was defined.
The number grows with tuning. Quicken's containment went "from 5% at launch to 21% a year later" (PolyAI case study, 2025).
10. Put change control and monthly evidence in place
Make no silent changes. Version every change to prompts, knowledge, flows and handover rules. Test it against the reference set, have a named person approve it, and keep the record.
Keep a replayable record of calls within your retention rules, plus handover logs, test results and accuracy checks.
Review every month with operations, compliance and IT against the baseline: what changed, what failed, what callers said and what comes next.
If the agent shapes decisions about credit, cover or care, more rules apply. Under UK GDPR, as amended by the Data (Use and Access) Act 2025, significant automated decisions need safeguards, including human intervention (in force since 5 February 2026). Colorado's SB 26-189 requires notice and, on request, human review from 1 January 2027. In Canada, OSFI Guideline E-23 expects federally regulated financial institutions to inventory and risk-rate their AI models from 1 May 2027.
What good looks like at go-live
- One call type, chosen from your call data, with the reason written down.
- A baseline agreed with operations and finance, and written go or no-go criteria.
- Disclosure, recording and consent wording signed off for every region you serve.
- Handover rules with a named owner for each route, tested in and out of hours.
- Identity checks that match your human process, and no card numbers in audio, transcripts or logs.
- System access agreed, and the after-call work automated or owned.
- A reference set of recorded calls passed, including accents and vulnerable callers.
- A controlled release plan with live monitoring and a way to switch the agent off.
- A scorecard that leads with resolution and repeat contact.
- Versioned change control with named approvers, and a monthly review in the diary.
ETT designs and delivers voice agents for regulated contact centres, starting from the call data. If you want to work through these steps on one of your call types, start with a 30-minute call through our conversational AI and voice automation service.
Sources
- PolyAI, "Voice AI compliance in financial services", 28 July 2026 (UK bank build and governance; Allstate)
- GOV.UK Algorithmic Transparency Records: NS&I (30 October 2025) and Ministry of Justice (9 September 2026)
- PolyAI case studies: Quicken (July 2025), Simplyhealth (September 2023), UniCredit Zagrebačka banka (May 2026), Howard Brown Health (April 2025), PG&E (May 2026)
- ContactBabel, UK and US Contact Centre Decision-Makers' Guides 2026; Deloitte Digital, 2026 Global Contact Center Survey; Gartner, 4 August 2026; Kilpatrick, July 2024
- EU AI Act Articles 2 and 50; SI 2018/356; Ofcom persistent misuse policy; FCA FG21/1 and Mills Review (July 2026); UK GDPR as amended by the Data (Use and Access) Act 2025; PCI DSS v4.0.1; FCC 24-17; Maine PL 2025 c.294; Utah SB 226; California AB 3030; Colorado SB 26-189; HHS HIPAA guidance; CRTC rules; OSFI Guideline E-23