How to choose a voice AI platform for a regulated UK enterprise

Six questions to put to any vendor before a voice agent speaks to your customers, and what a good answer looks like.

The short answer

Choose a platform that can only say what your organisation has approved, can show afterwards what was said and why, handles vulnerable customers by design, and works inside the systems you already run. Approved wording is a control, not compliance in itself: it still needs accurate data, tested routing, a working route to a person and ongoing monitoring. In collections, lending, insurance and utilities, these properties matter more than how natural the voice sounds or how quickly a demo can be built.

Why the choice is different in a regulated firm

A voice agent does not move accountability to the vendor. In consumer credit, a firm must ensure that its employees and agents comply with CONC and take reasonable steps to ensure that others acting on its behalf do too (CONC 1.2.2R). The vendor keeps its own legal and contractual duties as well.

Regulators judge outcomes and evidence, not technology. The FCA applies its existing framework to AI (AI and the FCA: our approach). Where the Consumer Duty applies, firms must act to deliver good outcomes for retail customers and monitor whether they do. CONC 7.3 requires forbearance and due consideration for customers in arrears, and FG21/1 guides firms on the fair treatment of vulnerable customers. Sector rules differ: energy suppliers keep a Priority Services Register in Great Britain, and Ofwat's guidance covers water companies in England and Wales.

That changes the buying question. It is not 'which agent sounds most human?' but 'which agent can we defend, call by call, to our board, our auditors and our regulator?'

The six questions

1. Can the agent say anything your compliance team has not approved?

A generative agent composes its replies during the call; guardrails reduce the risk of a wrong sentence but cannot remove it. A deterministic agent uses AI to understand the caller, then selects the next step from approved wording and journey rules, with live data inserted only into permitted fields. That gives your compliance team a defined set of responses to approve. It does not remove the need to test: speech recognition, intent classification and source data can still be wrong. Many products mix the two approaches, so ask what the agent can actually generate and which actions it can take.

A good answer: the vendor demonstrates an unexpected question, a misheard answer and a failed transfer to a person, and each is handled with an approved response and a safe route for the customer.

2. Can you explain a single call afterwards?

A transcript shows what was said. It does not show why. For a complaint, an audit or a regulator request you need the input and classification behind each step, the rule that selected it and the approved version of the wording that was spoken, plus a record of who approved changes to the journey and when. That evidence needs proportionate access and retention controls of its own.

A good answer: the vendor uses an anonymised or authorised example to walk you through one call, from identity verification to outcome, with the rule and wording version behind each step.

3. How are vulnerable customers handled?

Customers may mention illness, bereavement, job loss or confusion in the middle of a call. The journey should recognise those disclosures, respond with approved wording and route the customer to the right support: a specialist, a pause in collections activity or, in energy and water, the Priority Services Register. No system catches every signal, so test missed signals, requests for a person and alternatives for customers who cannot use voice automation. Health information is special category data under UK GDPR and needs its own condition for processing.

A good answer: the vendor shows the support journey itself, how a customer reaches a person, and what happens when a signal is missed.

4. Does it work inside your systems, and how is the data protected?

An agent that cannot read current balances, due dates or policy data gives inaccurate answers, and one that cannot write outcomes back creates manual rework. Identity and authority checks must come before account-specific information is shared, including for authorised representatives.

Under UK GDPR you need a lawful basis, clear privacy information, retention limits, processor terms and safeguards for restricted transfers, and a data protection impact assessment where the processing is likely to result in a high risk. Since 5 February 2026 the amended rules on automated decision-making (Data (Use and Access) Act 2025, section 80) allow significant decisions based solely on automated processing only with safeguards: information about the decision, the right to make representations and contest it, and human intervention. Stricter limits apply to special category data.

For card payments, map the full data flow and ask which PCI DSS Attestation of Compliance covers each entity in it. An Attestation of Compliance follows either an assessment or an eligible self-assessment (PCI SSC), and a payment partner's attestation does not automatically cover the vendor's telephony, recordings or transcripts.

A good answer: a current integration list, least-privilege access, tested outage and recovery arrangements, and a documented payment data flow with responsibilities and assessment scope.

5. What happens on outbound calls?

Separate genuine servicing and collections calls from direct marketing. AI calls that carry marketing content are likely to be treated as automated calls, which need specific prior consent under PECR regulation 19, and consent to calls from a person is not enough (ICO telephone marketing guidance). A natural-sounding voice does not turn an AI call into a live call, and adding promotional content to a collections or service call can make it a marketing call. Check caller identification, suppression lists and Ofcom's persistent misuse rules on silent and abandoned calls. We recommend telling customers that they are speaking to an AI and how the call is recorded.

A good answer: the vendor shows how each journey is classified as service or marketing, how consent and suppression are checked before dialling, and how abandoned-call rates are kept within Ofcom's rules.

6. What independent evidence and proof exist?

Logos on a website are not evidence. Ask for the certificates and reports themselves and check the legal entity, the service scope, the issuing body, the dates and any exclusions. For an AI voice platform the useful set usually includes ISO/IEC 27001 for information security, ISO/IEC 42001 for the management of AI systems, ISO/IEC 27701 for privacy, an independent penetration test and, where the vendor has one, a SOC 2 Type II report, which covers stated controls over a stated period. None of these certifies that every call is compliant.

Then ask for proof from your sector: a customer reference and results with a defined denominator, baseline and period. For collections, useful measures include identity verification success, handovers to a person, complaints and payment outcomes.

A good answer: documents shared under NDA within days, and a customer in your sector you can call.

Generative or deterministic: which fits where

• Opening hours, directions or general help: generative. Flexible answers suit bounded, lower-risk questions; accuracy and escalation still matter.
• Collections, arrears and payment arrangements: deterministic. Every sentence can be a conduct risk and needs evidence; outcomes still need testing.
• Insurance cover, claims and lapse prevention: deterministic. Incorrect cover information can harm customers and create liability.
• Utilities billing, arrears and vulnerable customers: deterministic. Vulnerability handling and evidence for the regulator.
• Identity verification before account access: deterministic. Rules must be controlled and auditable, with routes for representatives and bereavement.

Many firms will combine both: a generative agent for open service questions and a deterministic agent wherever the call touches money, cover or vulnerability. This is our recommendation at MEGA.AI, not a legal requirement to use a particular architecture.

Questions to put to any vendor

• Show me an unexpected question, a misheard answer and a failed transfer, each handled without an unapproved answer.
• Show me the audit record of one call, step by step, using an anonymised or authorised example.
• Show me the vulnerable-customer journey and the handover rule.
• Which of our systems do you read from and write to today, and what happens when they or the transfer route are unavailable?
• How is card data handled, and which Attestation of Compliance covers each entity in the flow?
• Show us the privacy, retention, automated-decision and outbound-contact controls for the journey we intend to buy.
• Which certificates and reports can we see, with scope and dates?
• Which customer in our sector can we speak to, and what changed from their baseline?

Frequently asked questions

What is the most important criterion when choosing voice AI for a regulated firm?

Control over what the agent can say and do. Then check that accurate data, tested routing, a route to a person and ongoing monitoring turn that control into good outcomes. Approved wording is a necessary control, but it does not by itself establish compliance.

Is a deterministic voice agent less natural to talk to?

Customers answer in their own words, and the AI understands natural speech. What is fixed is the reply: it comes from approved wording, with live data such as balances and dates inserted into permitted fields. Test recognition with your own customers, accents and call conditions.

Are generative voice agents allowed in regulated UK firms?

There is no general UK ban on generative voice agents. Any agent must meet the conduct, data protection, consumer and marketing rules that apply to the call, and the FCA expects firms to manage the risks and evidence good outcomes, which is harder when the replies are written by a model during the call.

How long does it take to put a first journey live?

With MEGA.AI, typically 4 to 6 weeks from contract, starting with one journey such as pre-delinquency, identity verification or payments, depending on integration and your approval process.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001, is audited under SOC 2 Type II and holds Cyber Essentials Plus; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to test one of your own journeys, including its approval controls, handover behaviour and audit evidence, before you commit.

Sources

• FCA, AI and the FCA: our approach
• FCA, AI Update (2024)
• FCA Handbook, CONC 1.2 (responsibility for employees and agents)
• FCA Handbook, CONC 7.3 (customers in arrears or default)
• FCA Handbook, PRIN 2A (Consumer Duty)
• FCA FG21/1, Guidance for firms on the fair treatment of vulnerable customers
• Ofgem, Join your supplier's Priority Services Register
• Ofwat, Priority Services Register guidance
• Data (Use and Access) Act 2025, section 80 (automated decision-making)
• ICO, Telephone marketing under PECR
• Ofcom, Persistent misuse policy statement
• PCI Security Standards Council, FAQ 1576