Article content:

This is some text inside of a div block.

Peter Hauge Jensen

CEO, MEGA.AI

Explore more articles in the MEGA AI Blog

Peter Hauge Jensen

CEO, MEGA.AI

Oct 19, 2026

How to choose a voice AI platform for a regulated European enterprise

Share this article:

Six questions to put to any vendor before a voice agent speaks to your customers in the EU, and what a good answer looks like.

The short answer

Choose a platform that can only say what you have approved, in every language and market you serve; that tells customers they are speaking to an AI; that can show afterwards what was said and why; and that comes with the evidence your AI Act, GDPR and resilience assessments need. Approved wording is a control, not compliance in itself: it still needs accurate data, tested routing, a working route to a person and ongoing monitoring. In collections, lending, insurance, utilities and telecoms, these properties matter more than how natural the voice sounds.

Why the choice is different in the EU

Using a voice agent does not remove the firm's accountability under the consumer, data protection and sector rules that apply to its activities. The provider of the system has its own legal and contractual duties as well.

The EU adds a horizontal AI law. Under the AI Act, Article 50(1) requires providers to design systems that interact with people so that those people are told they are dealing with an AI, unless that is obvious from the context. The duty has applied since 2 August 2026, and the Commission published guidelines on Article 50 on 20 July 2026. Since February 2025, Article 5(1)(b) has prohibited AI that exploits a person's vulnerability due to age, disability or a specific social or economic situation, where it materially distorts their behaviour in a way that causes, or is reasonably likely to cause, significant harm. AI intended to evaluate creditworthiness or set credit scores, or to assess risk and set prices in life and health insurance, is high-risk under Annex III. Those requirements apply from 2 December 2027 under Regulation (EU) 2026/1744.

Sector rules add further checks. National rules implementing the revised Consumer Credit Directive apply from 20 November 2026 to new credit agreements; agreements already in place on that date stay under the old directive until they end, apart from some rules for open-end credit (Article 47). For covered agreements, creditors must have processes to detect financial difficulty early, refer customers who struggle to debt advisory services and, where appropriate, exercise reasonable forbearance before enforcement (Articles 35 and 36). Financial entities within the scope of DORA must manage ICT third-party risk, and NIS2 supply-chain duties depend on the entity and national law. Debt collection is also regulated nationally, for example through registration under the Rechtsdienstleistungsgesetz in Germany and the Wet kwaliteit incassodienstverlening in the Netherlands.

That changes the buying question. It is not 'which agent sounds most human?' but 'which agent can we defend, call by call and country by country, to our board, our auditors and our regulators?'

The six questions

1. Can the agent say anything you have not approved, in every language you use?

A generative agent composes its replies during the call; guardrails reduce the risk of a wrong sentence but cannot remove it. A deterministic agent uses AI to understand the caller, then selects the next step from approved wording and journey rules, with live data inserted only into permitted fields. That gives your compliance team a defined set of responses to approve in each language. It does not remove the need to test: speech recognition, intent classification and source data can still be wrong. Many products mix the two approaches, so ask what the agent can actually generate and which actions it can take.

National rules differ, for example on contact times, collection charges and what may be said to whom, so the journey logic must be configurable per market rather than translated from one master script.

A good answer: the vendor demonstrates the same journey in two of your languages, with approval and test records for each, then shows an unexpected question, a recognition failure and a failed transfer being handled safely.

2. Does it tell customers they are speaking to an AI, and where does it sit under the AI Act?

Article 50(1) places the design duty on the provider of the AI system, and Article 50(5) requires the information to be clear, accessible and given at the latest at the first interaction. Ask who the provider is in your arrangement, including any reseller, how the notice is delivered in each language and how the deployed configuration preserves it.

Then ask for a written AI Act assessment of the intended use. The relevant Annex III categories include evaluating a person's creditworthiness or credit score and risk assessment or pricing in life and health insurance. A system intended to evaluate creditworthiness is in scope even if a person takes the final decision, and approved wording does not create an exemption. Use in collections does not by itself make a system high-risk; its intended purpose does. A system that infers emotions from biometric features of the voice, rather than from what the customer says, needs a separate assessment as emotion recognition, with its own notice duty under Article 50(3).

Where the agent speaks with synthetic speech, also ask how the providers involved meet Article 50(2) on machine-readable marking and detection of AI-generated audio, including the transition to 2 December 2026 for systems already on the market. An audible AI introduction does not answer that separate question.

A good answer: a documented assessment that identifies the provider and deployer, the intended purpose, the applicable duties, the disclosure controls and any exception relied on, with the limits enforced in the deployed journey.

3. Can you explain a single call afterwards, and defend it under GDPR?

A transcript shows what was said. It does not show why. For a complaint, an audit or a request from a data subject you need the input and classification behind each step, the rule that selected it, the approved version of the wording that was spoken and a record of who approved changes to the journey. That evidence needs proportionate access and retention controls of its own.

Under GDPR you need a lawful basis, clear privacy information, proportionate retention and appropriate security. Health and other special category data needs an additional condition under Article 9. Carry out a data protection impact assessment where Article 35 requires one. A decision based solely on automated processing with legal or similarly significant effects is only allowed under one of Article 22's exceptions, with safeguards including the right to obtain human intervention. Rules on informing customers about call recording differ between member states. Check processor terms and every place data is processed or accessed from, with a valid Chapter V basis for any transfer outside the EEA.

A good answer: the vendor uses an anonymised or authorised example to explain one call and provides the processing agreement, a list of sub-processors with their locations, the retention controls and documentation for your impact assessment.

4. How are customers in financial difficulty and vulnerable customers handled?

This is where the regulatory risk concentrates. For agreements covered by national CCD2 rules, creditors need processes for early detection and referral to debt advice and, where appropriate, reasonable forbearance before enforcement. The Credit Servicers Directive requires servicers of non-performing loans within its scope to communicate fairly and not to harass, coerce or unduly influence borrowers, and the Unfair Commercial Practices Directive addresses aggressive practices when traders collect consumer debts. These duties apply alongside the AI Act's prohibition on harmful exploitation of vulnerability.

The journey should recognise relevant disclosures, respond with approved wording and apply the options your obligations and policy require. No system catches every signal, so test missed signals and alternatives for customers who cannot use voice automation, and make sure customers have a workable route to a person or to debt advice.

A good answer: the vendor shows the financial-difficulty journey itself, including the trigger, the approved wording, the referral to debt advice, the handover rule and what happens when a signal is missed.

5. Does it fit your systems and your resilience obligations?

An agent that cannot read current balances, due dates or policy data gives inaccurate answers, and one that cannot write outcomes back creates manual rework. Identity and authority checks must come before account-specific information is shared, including for authorised representatives. Test least-privilege access, stale data, system outages and failed transfers.

For a financial entity within DORA's scope, an ongoing voice AI service will generally be an ICT third-party service. Article 30(2) sets the baseline contract terms, and Article 30(3) adds requirements for services that support critical or important functions, including audit rights, tested continuity arrangements and exit strategies. The arrangement must also be recorded in the register of information under Article 28. For entities covered by national NIS2 law, assess supply-chain security under Article 21. For card payments, ask which PCI DSS Attestation of Compliance covers each entity in the payment flow; a payment partner's attestation does not automatically cover the vendor's telephony, recordings or transcripts (PCI SSC).

A good answer: a contract mapped to the DORA requirements that apply to your function, tested recovery and exit evidence, a current integration list and a documented payment data flow.

6. What independent evidence and proof exist?

Logos on a website are not evidence. Ask for the certificates and reports themselves and check the legal entity, the service scope, the issuing body, the dates and any exclusions. For an AI voice platform the useful set usually includes ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy, ISO/IEC 42001 for the management of AI systems, an independent penetration test and, where the vendor has one, a SOC 2 Type II report, which covers stated controls over a stated period. None of these is a certificate of GDPR, AI Act or DORA compliance.

Then ask for proof from your sector and, ideally, your country: a customer you can call, and results with a defined denominator, baseline and period.

A good answer: documents shared under NDA within days, and a reference customer in a comparable market.

Generative or deterministic: which fits where

Opening hours, directions or general help: generative. Flexible answers suit bounded, lower-risk questions; accuracy, AI disclosure and escalation still matter.
Collections, arrears and forbearance: deterministic. Controlled wording supports forbearance and debt-advice duties, with evidence for review.
Insurance cover, claims and renewals: deterministic. Incorrect cover information can harm customers and create liability.
Utilities and telecoms billing, arrears and vulnerable customers: deterministic. Vulnerable customers and evidence for the regulator.
End-of-contract notices in telecoms: deterministic, as a supplement. Before automatic prolongation, the notice and best-tariff advice must be given on a durable medium (EECC Article 105(3)); a call can remind, not replace it.
Outbound calls with marketing content: check consent first. Direct marketing by automated calling systems needs prior consent under national rules implementing ePrivacy Article 13.

Many firms will combine both approaches. This is our recommendation at MEGA.AI, not a legal requirement to use a particular architecture. For the telecoms points, see the European Electronic Communications Code and the ePrivacy Directive.

Questions to put to any vendor

Show me an unexpected question, a recognition failure and a failed transfer, each handled without an unapproved answer, in two of our languages.
Who is the AI Act provider in our arrangement, how is the AI notice delivered, and can our configuration remove it?
What is your written AI Act assessment of the intended use, and how do you address Article 50(2) for synthetic speech?
Show me the audit record of one call, step by step, using an anonymised or authorised example.
Where is call data stored, processed and accessed from, and which sub-processors are involved?
Show me the financial-difficulty journey, including the referral to debt advice and the handover rule.
Which DORA terms apply to our function, how are recovery and exit tested, and which of our systems do you read from and write to today?
Which certificates and reports can we see, with scope and dates, and which customer in our market can we speak to?

Frequently asked questions

Does the EU AI Act allow AI voice agents on collections calls?

Yes. The AI Act does not ban them. It requires that people are told they are interacting with an AI (Article 50(1), applying since 2 August 2026), prohibits AI that exploits a person's economic situation in a way that causes or is reasonably likely to cause significant harm (Article 5(1)(b)), and applies high-risk requirements from 2 December 2027 to systems intended to evaluate creditworthiness or set credit scores. GDPR, consumer law and national collection rules apply as well.

Do customers have to be told they are speaking to an AI?

For an AI system that interacts with people, yes, unless it is obvious from the context. Article 50(1) places the design duty on the provider, and Article 50(5) requires the information to be clear and given at the latest at the first interaction.

Is a voice agent on arrears calls a high-risk AI system?

Not merely because it handles arrears. Classification depends on the system's intended purpose under Article 6 and Annex III. A system intended to evaluate creditworthiness is in scope even if a person takes the final decision, and approved wording does not create an exemption. Ask for a documented assessment of the exact journey, including any scoring, profiling or decision-support functions.

How long does it take to put a first journey live?

With MEGA.AI, typically 4 to 6 weeks from contract, starting with one journey such as pre-delinquency, identity verification or payments, depending on languages, integration and your approval process.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance, through MEGA.AI ApS in Denmark, MEGA.AI Limited in the United Kingdom and MEGA.AI Inc. in the United States. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. The collections journeys MEGA.AI delivers do not evaluate creditworthiness or set credit scores. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001 and audited under SOC 2 Type II; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to test one of your own journeys, including its approval controls, handover behaviour and audit evidence, before you commit. For UK rules, see How to choose a voice AI platform for a regulated UK enterprise.