The first question I get about AI voice call disclosure rules is never “will it book appointments.” It is “am I allowed to do this without telling people?”
Fair question, and the answer is messier than either the vendors or the sceptics make out. There is no single statute in New Zealand or Australia dedicated exclusively to this topic. What exists instead is four separate bodies of law that all touch the same phone call from different angles, plus a set of standards that will almost certainly become law within the next few years.
This post walks through what each country actually requires today, where the line sits between “you don’t have to volunteer it” and “you absolutely cannot deny it,” and how to write a disclosure line that keeps you compliant without tanking your booking rate. I am not a lawyer and this is not legal advice, but I have built and run these systems, and most of the risk is avoidable with about eight seconds of script.
Key Takeaways
- AI voice call disclosure rules are not a single law in NZ or Australia. Four separate regimes apply: privacy, consumer, telemarketing and call recording.
- Neither country currently has a statute forcing you to announce an AI caller, but both make it unlawful to actively deny being one when a caller asks.
- Australia’s Do Not Call Register and the 2017 telemarketing standard apply to AI outbound calls exactly as they apply to human ones. No AI exemption exists.
- New Zealand’s Unsolicited Electronic Messages Act covers email and SMS, not voice, so outbound AI calling sits under the Fair Trading Act instead.
- Call recording is one-party consent in New Zealand, but several Australian states require all parties to agree, so announce the recording either way.
- Inbound AI receptionists carry far lighter obligations than outbound AI callers, because the customer initiated the contact.
- A one-line disclosure in the first eight seconds costs almost nothing in conversion and removes most of the legal exposure.
- The EU AI Act’s transparency obligations apply from August 2026, and NZ or AU businesses selling into Europe are caught by them.
The Short Answer on AI Voice Call Disclosure Rules
Here is the position as it stands. Neither New Zealand nor Australia has passed a law that says “you must tell a caller they are speaking to an artificial voice.” No AI-specific statute in either country creates that duty. Anyone who tells you otherwise is either quoting a foreign law or selling you something.
But that is not the same as saying you can do whatever you like.
Four separate regimes reach into an AI phone call:
Privacy law. Both countries require you to tell people what personal information you are collecting and why, at or around the time you collect it. An AI agent that takes a name, a phone number and a description of someone’s problem is collecting personal information.
Consumer law. Both countries prohibit misleading or deceptive conduct in trade. This is the one that matters most. If your AI is asked “am I speaking to a real person?” and it says yes, or dodges in a way designed to leave the caller believing yes, that is a representation about the nature of the service, and it is false.
Telemarketing law. Australia in particular has hard rules about who you can call, when, and what you must say at the start. These rules make no distinction between a human dialler and a synthetic one.
Recording law. If your AI transcribes or records the call, and almost all of them do, you have a separate obligation that has nothing to do with AI at all.
The practical upshot is a distinction worth writing on a whiteboard. There is currently no duty to volunteer that the voice is synthetic, in most inbound scenarios, in either country. There is a hard duty not to deceive about it, in both. The gap between those two positions is where every enforcement action is going to land over the next few years, and it is a bad place to build a business.
New Zealand: What the Law Actually Requires
New Zealand has taken a deliberately light-touch approach to AI regulation. The national AI strategy released in 2025 leaned on existing law rather than creating a new act, on the view that privacy, consumer and human rights legislation already covers most of the ground. That means there is no AI register, no mandatory labelling regime, and no notification requirement specific to synthetic voices.
What there is, is this.
The Privacy Act 2020
Information Privacy Principle 3 says that when you collect personal information directly from someone, you have to make them aware of the fact of collection, the purpose, who is collecting it, and who will hold it. An AI receptionist taking a name and a callback number is squarely inside that.
Note what IPP 3 does and does not require. It requires you to identify the agency collecting the information, meaning your business. It does not require you to identify the technology doing the collecting. A well-drafted opening line covers IPP 3 without ever saying the word “AI.”
That said, the Office of the Privacy Commissioner has published expectations for businesses deploying AI tools, and transparency runs through all of them. The regulator’s stated position has consistently been that people should understand when and how AI is being used on their information. Guidance is not law, but it is a strong signal about how a complaint would be assessed. You can read the current guidance at privacy.org.nz.
The Fair Trading Act 1986
This is the section that actually bites. Section 9 prohibits conduct in trade that is misleading or deceptive, or likely to mislead or deceive. The Commerce Commission enforces it, and the test is about the overall impression created, not just the literal words.
An AI agent that gives itself a human first name, uses filler words, and answers “yep, I’m here in the office” when asked if it is a person has created a misleading impression about a material characteristic of the service. That is a Fair Trading Act problem, and it does not require a single new AI regulation to be a problem.
The safer read: giving your AI a name is fine. Building it to actively assert humanity is not.
What does not apply
The Unsolicited Electronic Messages Act 2007 is the one most people reach for, and it is the wrong law. UEMA covers commercial electronic messages, meaning email, SMS, instant messaging and fax. Voice calls are not electronic messages under that act. So the consent, identification and unsubscribe requirements you know from your SMS campaigns do not carry across to your outbound voice calls.
New Zealand also has no statutory Do Not Call register. The Marketing Association runs a voluntary name removal service, and washing your outbound lists against it is good practice, but it is not a legal requirement in the way Australia’s register is.
Call recording in New Zealand
Section 216B of the Crimes Act 1961 makes it an offence to intercept a private communication with an interception device, with an exception where you are a party to the communication. In plain terms, New Zealand is a one-party consent jurisdiction. You can lawfully record a call you are part of without the other person’s agreement.
That is the criminal position. The privacy position is different. A recording is personal information, and the Privacy Act’s collection principles still apply. The Privacy Commissioner’s consistent guidance is that people should be told a call is being recorded. Between the two, announcing it is the only sensible option, and it costs you three seconds.
Australia: Stricter on Calls Than You Think
Australia is where most people get caught out, because Australian telemarketing law is genuinely prescriptive and it long predates AI. None of it was written with synthetic voices in mind, which is exactly the problem. It applies anyway.
The Do Not Call Register Act 2006
If you make outbound marketing calls to Australian numbers, you must wash your list against the Do Not Call Register. Registrations are permanent. Calling a registered number without consent or an applicable exemption is a breach, and the Australian Communications and Media Authority has issued substantial penalties for it.
There is no carve-out for AI. An AI dialler that hits a registered number is the same breach as a human one. Exemptions exist for charities, government bodies, educational institutions, political parties and, importantly for most businesses, calls made with the recipient’s express or inferred consent. Inferred consent typically comes from an existing customer relationship, but do not stretch it. A lead who filled in a web form six months ago is arguable. A purchased list is not. Details are at donotcall.gov.au.
The Telemarketing Industry Standard
The Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 is the piece almost nobody reads, and it is the closest thing either country has to an actual disclosure rule for voice calls.
It sets calling hours. Weekdays 9 am to 8 pm, Saturdays 9 am to 5 pm, no calls on Sundays or national public holidays. Your AI does not sleep, which makes it very easy to breach this one by accident if the scheduling is not locked down.
It requires the caller to give their name and the name of the organisation on whose behalf the call is made, at the start of the call, and to provide the purpose of the call and contact details on request. It requires the call to be terminated immediately if the recipient asks. It prohibits withholding calling line identification.
Read that list again with an AI agent in mind. “Give their name” is satisfied by a first name. “Terminate immediately on request” is a hard behavioural requirement that your agent’s prompt has to handle reliably, including when the request is phrased as “not interested, bye” rather than a clean instruction. ACMA’s guidance sits at acma.gov.au.
The Privacy Act 1988 and the APPs
Australian Privacy Principle 5 requires notification at or before the time of collection: who you are, why you are collecting, who you might disclose to, and how to access or complain. APP 1 requires an up-to-date privacy policy.
One genuine nuance for the readers of this blog: the small business exemption. Businesses with annual turnover of $3 million or less are generally outside the Privacy Act, unless they provide health services, trade in personal information, or fall into a handful of other categories. A lot of the businesses I work with sit under that threshold today.
I would not build a compliance position on it. Reform to remove or narrow that exemption has been on the agenda through successive tranches of privacy reform, and changes passed in late 2024 already added new obligations around automated decision-making that phase in from late 2026. Build to the standard, not to the exemption. Check the current position at oaic.gov.au.
Australian Consumer Law
Section 18 of the Australian Consumer Law prohibits misleading or deceptive conduct, and section 29 prohibits false or misleading representations about goods or services. Same analysis as the Fair Trading Act in New Zealand. An AI that denies being an AI is making a false representation about the service being supplied.
Call recording is state law
This one trips people up badly. Australia has no single national rule for recording private conversations. Each state and territory has its own surveillance devices legislation. Broadly, Victoria and Queensland allow a party to a private conversation to record it. New South Wales, Western Australia, South Australia, Tasmania, the Northern Territory and the ACT are considerably more restrictive, and generally require the consent of all parties.
If you are calling nationally, you cannot pick a rule per call. Announce the recording at the start of every call. Done.
The Voluntary AI Safety Standard
Australia published a Voluntary AI Safety Standard in 2024 with ten guardrails for organisations deploying AI. One of them deals directly with transparency: telling end users when they are interacting with AI, when AI has contributed to a decision, and when content is AI-generated.
It is voluntary. It is also the near-certain template for whatever mandatory regime follows for higher-risk uses, and a proposals paper for mandatory guardrails was published alongside it. Businesses that adopt the voluntary standard now are not doing extra work. They are doing the same work earlier and more cheaply.
Inbound vs Outbound Changes the AI Voice Call Disclosure Rules
The single most useful distinction in this whole area is who dialled.
Inbound. The customer rang your business. They know they are calling a company. They have chosen to make contact and share information for a purpose they set. Telemarketing law does not apply, because you are not telemarketing. Do Not Call registration is irrelevant, because they called you. Consent to the contact is inherent in the act of dialling.
What remains for inbound is thin: a collection notice under the privacy principles, a recording announcement, and honesty if asked. That is why an AI receptionist answering overflow and after-hours calls is by a wide margin the lowest-risk place to start with voice AI. It is also the one that pays fastest, because the calls are already coming and you are already missing them. One dental practice I worked with had two receptionists and was still losing close to half of all inbound calls at peak. After the AI receptionist went live, missed calls went to zero and booked appointments lifted 44%. There was no disclosure fight, because nobody who rings a dental clinic at 7:40 pm is confused about why the phone was answered.
If that is the shape of your problem, I have written about the mechanics of after-hours call answering and how AI appointment booking actually works in practice.
Outbound. You dialled them. Now everything switches on. In Australia: Do Not Call washing, calling hours, the identification requirements in the industry standard, calling line identification, immediate termination on request. In New Zealand: the Fair Trading Act, the Privacy Act collection notice, and a much closer look at whether you had any basis to call at all.
Outbound also splits again by relationship. Calling an existing customer about their own booking is a service call, not a marketing call, and most of the telemarketing framework does not apply. Calling a cold list is marketing, full stop, and the framework applies in full. Calling a lead who enquired last week sits in between, and the answer depends on what your form said at the point of enquiry.
If you are contracting a vendor to build any of this, the allocation of responsibility for list washing, calling hours and disclosure scripting needs to be written down. I put a set of clauses to look for in the AI automation contract checklist.
How to Disclose Without Killing the Call
The objection I hear is always the same: “if I say it’s an AI, they’ll hang up.”
In my experience, they do not, and the data on this has moved fast. What makes people hang up is not the disclosure. It is the feeling of being tricked, which usually arrives about ninety seconds in, when the pauses stop matching human rhythm, and the caller realises they have been talking to a machine that let them believe otherwise. Disclose in the first eight seconds, and you never create that moment.
Here is how I build it.
Front-load it, then move on
The disclosure goes in the greeting, not in a separate compliance sentence. Something like:
“Kia ora, you’ve reached Northshore Plumbing. I’m Aria, the AI assistant here, and I can get your job booked in. This call’s recorded so the team has the details. What’s happening?”
That single greeting handles the business identity requirement, the AI transparency question, the recording notice, and the purpose of collection. Then it hands straight back to the caller with a question. Total: about nine seconds. No apology, no hedging, no preamble about how technology is changing.
The tone matters more than the words. Announced casually and moved past, disclosure reads as competent. Announced carefully, it reads as an admission.
Never deny, and script for the direct question
The most likely compliance failure is not the greeting. It is the moment forty seconds later when someone says “hang on, is this a real person?”
Your agent needs a scripted, tested answer. Not an inference from a system prompt, an explicit instruction with the exact wording you want, tested against the phrasings people actually use: “am I talking to a robot,” “are you AI,” “is this a recording,” “put me through to a human.”
Mine says something close to: “No, I’m an AI assistant. I can book you in right now, or I can put you through to someone on the team. What would you prefer?” Confirmation, capability, choice. It moves the call forward instead of stalling on the disclosure.
Build a real handover path
“Put me through to a human” has to actually work. Under the Australian industry standard, terminating on request is mandatory for outbound. For inbound, it is not a legal requirement, but a dead end here is the thing that turns a compliant call into a complaint.
Decide in advance what happens during business hours (warm transfer), after hours (take details, promise a callback with a time), and when nobody is available (escalation ticket with a named owner). Test all three before you go live.
Announce recording every time
One line, always, regardless of jurisdiction. New Zealand is one-party consent and Victoria and Queensland allow party recording, but you are not going to run different scripts by area code, and the privacy principles push the same direction anyway. Say it once in the greeting and stop thinking about it.
Log what you would need to prove
The compliance work that actually matters is not the script. It is the record. For every call you want, at minimum: timestamp, direction, number dialled or received, the disclosure line as delivered, whether the recording notice played, and the outcome. For outbound, add the date the list was washed against the Do Not Call Register and the consent basis for each number.
Nobody enjoys this. It also takes about an hour to set up once and then runs itself, and it is the difference between answering a regulator’s question in ten minutes and spending three weeks reconstructing what happened.
Set a review date
Both countries are moving. Australia has a voluntary standard with a mandatory proposal behind it. New Zealand is running on existing law with regulator guidance that keeps getting sharper. And if you sell anything into Europe, the EU AI Act’s transparency obligations for systems that interact directly with people apply from August 2026, and they are considerably more prescriptive than anything in this hemisphere. The European Commission’s AI Act pages are the primary source there.
Put a calendar reminder six months out to re-read your scripts against the current position. That is the whole maintenance burden.
Conclusion
The honest summary of AI voice call disclosure rules in New Zealand and Australia is that the specific rule you are worried about does not exist yet, and four general rules you were not thinking about apply right now. Privacy law wants a collection notice. Consumer law forbids deception about what the caller is. Australian telemarketing law governs when you can dial and what you must say. Recording law wants an announcement.
None of that is hard. All of it fits in one greeting and one logging table.
The bigger point is that this is what every AI deployment looks like once it touches real customers. The technology is the easy part. The compliance, the escalation paths, the records that prove what happened, the ownership of who fixes it when it breaks, that is the part that determines whether the thing survives contact with your business. A voice agent that nobody governs is not a system. It is a liability with a nice accent. What actually works is an AI brain that holds your rules and an AI workforce that follows them consistently, on every call, whether you are watching or not.
If you are weighing up voice AI more broadly, it is worth reading how AI agents for small business fit together, and what the Australian market looks like for operators on both sides of the Tasman.
Ready to Talk It Through?
If you are thinking about putting an AI voice agent on your phones and want a straight answer about whether it fits your business, book a 30-minute Discovery Call. No pitch deck. We will look at your call volume, what you are currently missing, and what the disclosure and consent picture looks like for your situation specifically.
Book a 30-minute Discovery Call
Worth knowing before you commit: if a vendor cannot tell you how their agent responds to “are you a real person,” they have not thought about this properly. Ask them on the first call. The discovery call checklist has the rest of the questions.
Frequently Asked Questions
Do you have to tell callers they are speaking to an AI in New Zealand?
There is no New Zealand statute requiring you to announce that a caller is speaking to an AI. However, the Fair Trading Act prohibits misleading or deceptive conduct, so an agent that denies being artificial when asked, or is built to create the impression it is human, creates real exposure. The Privacy Act separately requires a collection notice. The practical position is that disclosure is not mandatory, but denial is unlawful.
Is it legal to use an AI voice agent to call customers in Australia?
Yes, provided you follow the same rules that apply to human telemarketers. That means washing your list against the Do Not Call Register, calling only within permitted hours, identifying yourself and your business at the start of the call, not withholding calling line identification, and ending the call immediately when asked. No exemption exists for automated or AI callers. Breaches attract ACMA penalties regardless of who or what dialled.
Do AI phone calls need consent to be recorded?
New Zealand is a one-party consent jurisdiction under the Crimes Act, so you can lawfully record a call you are part of. Australia varies by state: Victoria and Queensland generally permit party recording, while New South Wales, Western Australia, South Australia, Tasmania, the Northern Territory and the ACT are stricter. Since you cannot practically run different scripts by region, announce the recording in the greeting on every call.
Does the Do Not Call Register apply to AI voice calls?
Yes. The Do Not Call Register Act 2006 covers marketing calls to Australian numbers regardless of whether a person or a system places them. Registrations are permanent. You need either an exemption or the recipient’s express or inferred consent to call a registered number. Inferred consent from an existing customer relationship can apply, but purchased or scraped lists will not support it.
Can an AI receptionist use a human first name?
Giving an AI agent a name is generally fine and is not deceptive by itself. Businesses name software all the time. The line is crossed when the agent uses that name alongside behaviour designed to assert humanity, such as claiming to be in the office or answering yes when directly asked if it is a real person. Name it, disclose it in the greeting, and never let it deny what it is.
What should the AI say if someone asks whether it is a real person?
It should confirm plainly that it is an AI assistant, then immediately offer a path forward: complete the task now, or transfer to a human. Script this explicitly rather than leaving it to the model to infer, and test it against the phrasings people actually use, including “is this a robot,” “are you AI,” and “put me through to a person.” The handover has to genuinely work.
Does the Spam Act or the Unsolicited Electronic Messages Act cover AI voice calls?
No. Australia’s Spam Act 2003 and New Zealand’s Unsolicited Electronic Messages Act 2007 both cover commercial electronic messages, meaning email, SMS, MMS, instant messaging and fax. Voice calls sit outside both. In Australia, outbound voice is governed by the Do Not Call Register Act and the 2017 telemarketing industry standard instead. In New Zealand, there is no equivalent voice-specific regime.
About Octavius
Titus Mulquiney is the founder of Octavius AI, where he builds AI brains and AI workforces for founder-led businesses stuck running everything out of their own head. Twenty years in marketing, ex-Sony product manager, ex-GM Zeal NZ. Based in Auckland, working with operators across NZ, Australia, and the US. Connect on LinkedIn.