Is it legal and safe to use AI voice agents for debt collection in the UK?

Whether a UK firm can use an AI voice agent to collect consumer credit debts, which FCA rules apply to the call, and the controls that make it safe.

The short answer

Yes. For a firm with the right FCA permissions collecting a consumer credit debt, no FCA rule prohibits using an AI voice agent, and the FCA applies its existing rules to AI rather than creating AI-specific ones. Whether it is safe depends on control. The firm remains responsible for every call, so CONC 7, the Consumer Duty and the FCA's guidance on vulnerable customers apply to an AI agent just as they apply to a person.

Which debts does this cover?

This article covers debts under consumer credit and consumer hire agreements. For those debts, CONC 7 applies to firms carrying on consumer credit lending, consumer hiring and debt collecting (CONC 7.1.1R). Utility, telecoms and council tax arrears are generally outside CONC and follow other rules, so check the regime for each debt type.

Which rules apply to an AI voice agent on a collections call?

No new law is needed to answer this. When a firm uses an AI voice agent on these calls, its existing obligations continue in full. CONC 1.2.2R requires the firm to ensure its employees and agents comply with CONC, and to take reasonable steps to ensure that other persons acting on its behalf comply. The FCA notes that this rule is particularly important for CONC 7 (CONC 7.1.3G).

• CONC 1.2.2R. The firm's obligations cover the AI journey and the supplier arrangement. This does not settle the supplier's own regulatory position, which depends on what the supplier does.
• The Consumer Duty (PRIN 2A). Where it applies, the firm must deliver good outcomes for retail customers, avoid causing foreseeable harm and monitor outcomes, including for customers who struggle with automated channels.
• Forbearance (CONC 7.3.4R and 7.3.4BR). Customers in or approaching arrears or in default must be treated with forbearance and due consideration, taking their individual circumstances into account. The agent must recognise financial difficulty and route to the firm's forbearance options, not push one fixed outcome.
• Debt advice (CONC 7.3.7AG, guidance). Where appropriate, the customer is told that free and impartial money guidance and debt advice is available from not-for-profit bodies, with the benefits explained and a referral made. Signposting has to be designed into the journey.
• No pressure (CONC 7.3.10R). No pressure to pay in one or very few payments, within an unreasonably short time, or by borrowing or selling property. Wording, repetition and call length must be controlled.
• Pausing recovery (CONC 7.3.11R). Active recovery is suspended for a reasonable period when the firm is told that the customer, a debt counsellor or someone acting for them is developing a repayment plan. The agent must recognise this and route it, and the firm must apply the pause in its own systems. A call transfer on its own is not a hold.
• Who is calling (CONC 7.9.1R). Anyone contacting a customer on the firm's behalf explains who they work for, their role and the purpose of the contact. The opening must do this without revealing the debt to anyone not yet verified (CONC 7.9.7R and 7.9.10R). We also recommend saying that the caller is an AI.
• When and how to call (CONC 7.9.4R). No contact at unreasonable times, and due regard to reasonable requests about when, where and how the customer is contacted.
• Verify before disclosing (CONC 7.9.10R). No details of a debt until the firm has established by suitable means that it is speaking to the customer or someone acting for them.
• Mental capacity (CONC 7.10.1R). Recovery is suspended when the firm is told the customer may lack the mental capacity to make relevant decisions or engage, or when it ought reasonably to be aware of it. Signs of a capacity concern must stop collection and go to a person.
• Disputes (CONC 7.14.1R). Recovery is suspended when the customer disputes the debt on valid or possibly valid grounds. Disputes must be recognised and routed for investigation.
• Vulnerable customers (FG21/1, guidance). The agent must recognise signs of vulnerability and give the customer an effective route to a person. We cover this in how AI voice agents should handle vulnerable customers.
• The FCA's AI publication (19 October 2026). Illustrative examples of good practice and areas for improvement, with no new rules. It informs escalation, disclosure, records, testing and senior management responsibility. See what the FCA's October 2026 AI publication means for collections.

Other regimes apply alongside the FCA rules: data protection law (UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025), Ofcom's persistent misuse policy for outbound calling, PECR where a call includes marketing (a purely administrative collections call is generally not direct marketing), and the Breathing Space scheme, which applies in England and Wales; Scotland has its own statutory protections. For a provision-by-provision view, see does AI debt collection comply with FCA CONC 7?

What does data protection law require?

Before launch, complete a data protection impact assessment. Vulnerability often means health information, which is special category data: recording or acting on it needs an Article 9 condition as well as a lawful basis. Decisions taken solely by automated means with legal or similarly significant effects need the safeguards set by UK GDPR as amended by the Data (Use and Access) Act 2025, including human intervention and the right to contest the decision. Using approved wording does not take a journey outside these rules.

What makes an AI collections call unsafe?

The risks are specific and predictable. Most are design failures, not technology failures.

• Invented wording. A generative agent writes its replies during the call, so it can say something nobody approved, such as a promise the firm cannot keep. We explain the difference in deterministic vs generative voice AI for FCA-regulated collections.
• Wrong data or wrong response. Even with approved wording, an agent can read out a wrong balance from bad data, or choose the wrong approved response if it misunderstands the customer.
• Disclosure to the wrong person. Debt details are given before the customer or their representative is verified, contrary to CONC 7.9.10R. An opening line or voicemail that mentions the debt does the same.
• Missed vulnerability. The agent does not recognise distress or illness, or recognises it and has nowhere to send the customer. The FCA warns against assuming a language model reliably identifies vulnerability from text without adequate testing, particularly temporary vulnerability.
• Collection that should have stopped. A repayment plan in progress, a capacity concern or a disputed debt is recognised on the call, but nothing stops the next call or letter.
• Pressure by repetition. An agent that repeats the payment request every time the customer hesitates creates the pressure CONC 7.3.10R prohibits.
• No way out. The FCA lists inflexible automated journeys with no route to another channel as an area for improvement.
• Blurred identity. The FCA lists being unclear whether AI or a person performed a function, and overstating accuracy, as areas for improvement.
• No evidence. Without a record of what was said and why, the firm cannot handle a complaint or show that its controls work.

What controls make an AI voice agent safe to use in collections?

1. Approved wording, validated data. The agent can say only what the firm approved before the call. The live data inserted into that wording is validated, and the choice of response is tested.
2. Identity before disclosure. Suitable verification on the firm's ID&V rules before any debt detail is given, with a route for authorised representatives.
3. Vulnerability checks throughout the call. Signs of vulnerability are checked from the first thing the customer says and trigger a defined route to a person. Detection is tested, not assumed.
4. A person on request. The customer can reach a person, the transfer carries the context so they do not have to repeat themselves, and there is a fallback when the team is unavailable.
5. Clear disclosure. The customer is told who is calling, why and that it is an AI, without the debt being mentioned before verification.
6. Forbearance and debt advice in the journey. Difficulty is recognised and routed to the firm's forbearance options, with debt advice signposted where appropriate.
7. Holds that reach the firm's systems. When a call shows that collection must pause, for a repayment plan in progress, a capacity concern, a dispute or Breathing Space, the firm's systems apply the hold.
8. A complete record. Every call can be reconstructed step by step for monitoring, complaints and audit, under documented retention rules.
9. Outbound calling limits. Calling windows, attempt limits and suppression checks are enforced before each dial.

How does MEGA.AI apply these controls?

MEGA.AI is a vendor too, so this section sticks to what the MEGA.AI platform does today.

• Approved wording only. MEGA.AI's agents are deterministic: they speak only wording the client approved before the call. Language models classify what the customer said; they do not write the replies. The client designs the journey and approves the wording, and MEGA.AI builds it. Approved wording stops invented wording, but it does not correct wrong source data, so the data feeding the agent needs the same controls as any other customer channel.
• Uncertain speech. When speech recognition is unsure, the agent re-confirms what it heard or hands the call to a person.
• Identity first. Debt details are not disclosed until the caller has passed the client's ID&V rules.
• Vulnerability. Vulnerability indicators are checked on every customer turn from the first, before ID&V is complete, and the agent can respond and route the customer without revealing account details. A mention of Breathing Space or a debt adviser is flagged and the call is transferred to the client's team, which applies any hold in its own systems.
• A person on request. Customers can ask for a person at any point. If the team is closed or a transfer fails, the agent can send an SMS with the team's direct number and opening hours.
• Disclosure. In the UK the agent tells the customer it is an AI by default.
• Records. Every call is recorded, transcribed and logged step by step in a Call Phase Log. If a customer objects to recording, the call goes straight to a person.
• Outbound calls. No predictive dialling: an agent is ready the moment the customer answers, which is designed to avoid silent and abandoned calls. Attempts, spacing and calling hours are capped, each number is checked against the client's suppression data before dialling, and the agent does not make outbound calls to estates.

Who is responsible if an AI voice agent gets it wrong?

The firm. Using a vendor does not move the firm's regulatory responsibility: the FCA says firms can outsource AI services but remain responsible for them, and it describes clear senior management ownership of AI risk as good practice. The vendor carries its own contractual and data protection duties. We explain the split in who is accountable when an AI voice agent harms a customer.

Is an AI voice agent safer than a human agent?

Not automatically. A well-controlled AI agent is consistent: it does not skip the ID&V step, improvise a threat or forget to log the call. But it can misunderstand a customer or act on wrong data, and it does not exercise judgement. The FCA describes comparing a model's performance against human-led processes as good practice. Measure both on the same outcomes, across different customer groups, before you decide.

What should you ask before deploying an AI voice agent in collections?

1. Can the agent say anything we have not approved?
2. Can we reconstruct a single call, including why the agent said what it said?
3. What happens, step by step, when a customer shows signs of vulnerability?
4. When a call shows that collection must pause, how does the hold reach our systems?
5. How does a customer reach a person, and what is passed to them?
6. What independent evidence exists: certificates, audit reports and results from comparable firms?
7. What notice do we get of changes to the models the agent relies on?

Our guide to choosing a voice AI platform for a regulated UK enterprise covers these questions in detail.

Frequently asked questions

Is AI debt collection legal in the UK?

Yes, for a firm with the right FCA permissions. No FCA rule prohibits it. For consumer credit debts, the firm must meet the same rules as for any other collections call, including CONC 7 and the Consumer Duty.

Does the FCA approve AI voice agents?

No. The FCA authorises firms, not products, and has no approval or certification scheme for AI tools. A firm's authorisation is not an endorsement of the tools it uses.

Do customers have to be told they are speaking to an AI?

No FCA rule says so in those words. But CONC 7.9.1R requires the caller to explain who they work for and their role, the Consumer Duty requires communications customers can understand, and the FCA describes clear explanation of AI use as good practice. The disclosure must not reveal the debt before the customer is verified. MEGA.AI's agents disclose that they are an AI by default in the UK.

Can an AI voice agent take a card payment during the call?

Only through a payment flow that meets PCI DSS, with card details kept out of recordings and transcripts. Today MEGA.AI sends a secure payment link by SMS through the client's payment platform, or transfers the customer to the client's payment line. In-call card capture will not be released until MEGA.AI's PCI DSS compliance has been validated.

What about utility, telecoms and council tax arrears?

They are generally outside CONC, which covers consumer credit and consumer hire debts. Other rules apply, including the relevant sector regulator's rules and data protection law. The controls on this page are still good practice, but check the rules for each debt type.

Is MEGA.AI regulated by the FCA?

MEGA.AI is not authorised by the FCA. MEGA.AI Limited is a supplier member of the Credit Services Association.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001, is audited under SOC 2 Type II and holds Cyber Essentials Plus; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to walk through how one of your own collections journeys would meet these rules.

Sources

• FCA, AI in financial services: good practice and areas for improvement (19 October 2026, updated 20 October 2026)
• FCA Handbook, CONC 7.1 Application
• FCA Handbook, CONC 7.3 Treatment of customers in or approaching arrears or in default
• FCA Handbook, CONC 7.9 Contact with customers
• FCA Handbook, CONC 7.10 Treatment of customers with mental capacity limitations
• FCA Handbook, CONC 7.14 Settlements, disputed and deadlocked debt
• FCA Handbook, CONC 1.2 (CONC 1.2.2R)
• FCA FG21/1, Guidance for firms on the fair treatment of vulnerable customers

This article explains how existing UK rules apply to AI voice agents in consumer credit collections. It is general information, not legal advice. Last reviewed: November 2026.