PolyAI says one UK bank's voice agent was built in about six weeks and governed in six months. Here is where the time goes, and what to put in front of your risk team in week 1.
In July 2026, PolyAI published a line that anyone planning a voice agent in a regulated business should read twice. Writing about a deployment for a large UK high-street bank, it said the agent "was built in about six weeks. Governance took six months."
That is the vendor's account, not an independent one. But an independent public record tells a similar story. The UK Ministry of Justice publishes a GOV.UK transparency record for its PolyAI voice assistant. It is live for five prisons, answering "how to" questions from prisoners' friends and families. It sets out the governance timeline. Impact assessment, January 2024. Business continuity review, June 2024. Data protection impact assessment and delivery assurance, January 2025.
A year of assessments, for an assistant that answers process questions. That isn't a criticism of the ministry, the bank or the vendor. It's what putting software in front of the public looks like in a regulated organisation. The useful question is where the time goes, and whether it has to go there in that order.
The voice is no longer the hard part
For years, the hard part of phone automation was understanding the caller. Menus and keyword IVRs failed because they couldn't, so callers learned to press zero.
That has changed. Voice agents now follow callers in their own words, cope with interruptions and accents, and answer at any hour. NS&I, the government-backed savings provider, says in its GOV.UK record that "100% of inbound customer calls are now answered by PolyAI", and that the agent handles over 100,000 customer interactions a month.
If you sit through a demo now, the voice will probably impress you. It should. It is also the part of the project you need to worry about least.
Where voice projects stall
Voice projects in regulated firms rarely stall on the technology. They stall waiting for access, for sign-off, for a baseline or for someone to own the result. Those are the four places to plan for.
System access. A voice agent that can't reach your systems can only take messages. Read access to a billing or policy system in a regulated firm means a security review, a data flow and a change slot. In Deloitte Digital's 2026 contact centre survey, the top challenges were technology integration (72%), legacy systems (58%) and data security and compliance (53%). Raise the access request late and it can take months to land.
Sign-off. Compliance can't approve what it hasn't seen. If the risk team first meets the agent as a finished demo, every question arrives at once: disclosure wording, vulnerable callers, recording, where the data goes, what happens when the agent is wrong. Each question is fair. Asked together at the end, they take months.
The baseline. If nobody measured the call type before the build, nobody can show the agent is better. The go-live decision turns into a debate about opinions, and debates are slow.
Ownership. Operations, IT, digital and the vendor all have a stake. If everyone owns the agent, nobody approves changes and nobody answers for the result.
Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, citing "escalating costs, unclear business value or inadequate risk controls" (June 2025). Two of those three are the baseline and the sign-off.
Start governance on day one
Cutting governance isn't the answer. In a regulated firm, the controls are what make an agent safe to put in front of customers. Start them on day one and run them alongside the build, so both finish together.
Look at the MoJ's list again. An impact assessment, a continuity review, a DPIA, delivery assurance. None of them needs a finished agent. All of them need decisions: which calls, which data, which routes to a person, who approves a change. Those decisions can be made in week 1.
A good platform helps. PolyAI describes answers grounded in an approved knowledge base, safety filters on every input and output, and an improvement agent that never publishes a change without human approval. Those are the vendor's descriptions. Your risk team will still want to see them working on your calls, against your rules.
What to put in front of your risk team in week 1
This is the pack I'd want on the table in the first week, before the agent is built. It runs to a few pages.
- The call type and why. One call type, its volume and handle time, and what is out of scope.
- The baseline and the go or no-go criteria. Today's numbers for that call type, and the results that would justify going further.
- Disclosure and recording wording. The exact words the agent says at the start of the call, for every region you serve. If you take calls from the EU, Article 50 of the EU AI Act applies. Since 2 August 2026, callers must be told they are talking to an AI system.
- Handover rules. When the agent must pass the call to a person: the caller asks, signs of vulnerability, complaints, low confidence, regulated requests. Who receives each route, and what context travels with the call.
- A data flow. What the agent hears, what it stores, where it is hosted, how long recordings and transcripts are kept, and how card numbers stay out of all of it.
- The test plan. A set of your own recorded calls the agent must pass before any live traffic, including the awkward ones.
- Change control and evidence. Who approves a change, how it is tested, and what records you keep each month.
- Named owners. One business owner for the result, one compliance reviewer, one technical owner.
Most of this already exists for your human agents, as scripts, QA forms and vulnerability policies. The work is writing it down for a new kind of agent and getting it signed while the build is still under way.
Plan for the ratio
Your numbers won't match the bank's. The ratio is still worth planning around. If your plan starts governance when the build finishes, expect the governance to take longer than the build. If it starts in week 1, the two can finish together, and your first live call isn't left waiting on paperwork.
I've set out the full sequence, from choosing the call type to the evidence you keep each month, in a 10-step checklist. At ETT, this week-one pack is where we would start any voice agent project. You can see how we approach that work on our conversational AI and voice automation page.
Sources
- PolyAI blog, "Voice AI compliance in financial services", 28 July 2026
- GOV.UK Algorithmic Transparency Records: Ministry of Justice (9 September 2026) and NS&I (30 October 2025)
- Deloitte Digital, 2026 Global Contact Center Survey
- Gartner, 25 June 2025
- PolyAI product documentation, docs.poly.ai (vendor descriptions)
- EU AI Act Article 50; European Commission