Compliance is the part of voice AI nobody enjoys talking about. It is also the part that can turn a genuinely useful system into a genuine liability if it gets skipped. At Bolder Digital, it is the first conversation we have with any business considering a voice agent, before we talk about scripts, features, or pricing. A voice agent that answers every call is only an asset if it answers them lawfully.

Let me walk you through the main rules in plain language. This is general information based on published guidance, not legal advice, and any business deploying voice AI should confirm its specific obligations with a qualified lawyer.

Recording Consent: The Announcement Comes First

Two separate bodies of law sit behind call recording in Australia. The federal Telecommunications (Interception and Access) Act 1979 mainly targets third parties tapping into calls in transit. Whether a business can record a call it is actually part of is largely a state and territory matter, and the states do not all take the same approach. Tasmania's Listening Devices Act 1991 is widely reported as requiring the consent of everyone in a private conversation before it is recorded. New South Wales, Western Australia, South Australia, and the ACT are commonly described the same way.

Because the rules vary, and a voice agent can take calls from anywhere in the country, the safe approach is the conservative one. Announce at the very start of every call, before any recording begins, that the call may be recorded. Something like, "This call may be recorded so we can help you properly, and you are speaking with an AI assistant." A caller who hears that and carries on has had a clear opportunity to object, and you have a record showing it.

Treat transcripts exactly like audio. If the system captures a written version of the conversation, that is a recording for practical purposes.

Tell Callers They Are Talking to an AI

This is separate from recording, and it matters just as much. The OAIC's guidance on commercially available AI products stresses that public facing tools such as chatbots should be clearly identified as AI. Passing an AI off as a person also invites misleading conduct concerns on top of the trust damage I have written about elsewhere in this series.

At Bolder Digital, we build every voice agent to be upfront about what it is, and to hand off to a real person the moment a caller asks.

The Privacy Act: What Happens to a Recording Once It Exists

The moment a recording or transcript exists, it is very likely personal information. For businesses covered by the Privacy Act, the Australian Privacy Principles come into play. Four matter most in practice.

• Notification.Callers should be told what is collected and why, through your opening announcement and your privacy policy. The OAIC's AI guidance says notices should cover AI related purposes and any disclosure to the AI provider.

• Retention.Personal information should be destroyed or de identified once you no longer need it, so decide a retention period rather than keeping every call forever.

• Access.People can ask to see the personal information you hold about them, and that includes recordings.

• Overseas processing.If audio or transcripts are handled by a provider outside Australia, the cross border disclosure rules apply, and you remain responsible for how that information is treated.

One nuance is worth knowing. Many small businesses with an annual turnover of three million dollars or less fall outside the Privacy Act, with exceptions such as health service providers. That exemption has been under review for reform, so check its current status. The state recording laws apply regardless of turnover.

Ask Your Provider Where the Data Actually Lives

Before you sign with any voice AI provider, ours included, put a few plain questions to them.

• Where are audio and transcripts stored and processed?

• How long are they kept?

• Can they be deleted on request?

• Are your callers' conversations used to train anyone's models?

The OAIC recommends caution about putting personal information, especially sensitive information, into publicly available generative AI tools. That is worth checking against how your provider actually handles the data. These are questions we expect from clients at Bolder Digital, and we answer them plainly. A provider unable to answer them is telling you something.

A New Rule Arriving on 10 December 2026

From 10 December 2026, businesses covered by the Privacy Act must describe certain automated decision making in their privacy policy. It applies where a computer program, including AI, uses personal information to make decisions, or do things substantially related to making decisions, that could reasonably be expected to significantly affect a person's rights or interests. The policy must cover the kinds of personal information used and the kinds of decisions involved.

The OAIC has been developing guidance on how this applies, so check its latest version. A voice agent that simply books appointments is less likely to be caught than one that screens, qualifies, or declines callers. That judgement should still be made deliberately, not assumed.

Outbound Calls Follow a Different Rulebook

Everything above is about inbound calls. If a voice agent makes outbound calls, the Do Not Call Register Act 2006 and ACMA's telemarketing standard come into play, and an AI voice is treated like any other telemarketer.

• Numbers must be checked against the Register within the previous 30 days, unless an exemption or consent applies.

• Calls are limited to set hours, with no telemarketing calls on Sundays or public holidays.

• Caller identification must be presented.

• The call must end immediately when the person asks.

An inbound AI receptionist answering calls that customers chose to make is not telemarketing, so the Register is generally not engaged. If a voice agent sends follow up SMS or email, the Spam Act 2003 adds its own consent and unsubscribe requirements, which I have written about elsewhere.

How Bolder Digital Approaches Voice AI Compliance

Compliance works best when it is built into the setup rather than left to memory. Before a Bolder Digital voice agent answers a real call, we work through the recording announcement, the AI disclosure, how long recordings and transcripts are kept, where the data is stored, and how a caller reaches a real person. We then test the agent against difficult scenarios, not just the easy ones.

You can see how this fits into the service on ourAI Receptionist page. We would still always suggest having your own lawyer confirm the specifics for your industry and state, particularly for health, finance, or any business handling sensitive information.

The Bottom Line

Voice AI compliance in Australia comes down to a handful of habits:

• Announce recording before it starts.

• Tell callers they are speaking with an AI.

• Treat recordings and transcripts as personal information with a defined life cycle.

• Know where your provider stores the data.

• Keep an eye on the December 2026 change.

• Treat any outbound calling as a completely separate rulebook.

Get these right and voice AI is a genuine asset. Skip them and the risk falls on the business, not the software. That is the standard we hold every Bolder Digital voice agent to.

Frequently Asked Questions

Do I need to tell callers that a voice AI call is being recorded?
Announcing at the start of every call, before recording begins, is the safe approach. State laws differ, and Tasmania is widely reported as requiring the consent of all parties to a private conversation. A clear upfront announcement is the conservative standard for a business taking calls across the country. Confirm your specific position with a lawyer.

Do callers have to be told they are speaking with an AI?
It is strongly recommended. OAIC guidance stresses that public facing AI tools should be clearly identified. Presenting an AI as a person risks both misleading conduct concerns and a loss of trust.

Does the Do Not Call Register apply to an AI receptionist answering inbound calls?
Generally no. The Register governs outbound telemarketing calls, and an AI voice is treated like any other telemarketer when it calls out. An inbound receptionist answering calls that customers chose to make is not telemarketing.

What changes on 10 December 2026?
Businesses covered by the Privacy Act that use AI or other computer programs to make, or do things substantially related to making, decisions that could significantly affect a person's rights or interests must describe this in their privacy policy. The OAIC has been developing guidance on how it applies, so check its latest version.

How does Bolder Digital handle compliance for its voice AI setups?
We treat it as part of the build, not an afterthought. That means agreeing the recording announcement and AI disclosure wording, working through retention and data location questions, and setting up a reliable handoff to a real person before anything goes live. Businesses with specific legal obligations should still confirm them with their own lawyer.

Jarryd Holmes, Founder & Owner, Bolder Digital | Prospect Vale, Tasmania |bolderdigital.com.au