The first question we hear from a cautious owner is not 'does it work' but 'are we allowed'. It is the right question, and the answer is yes, with conditions. None of the conditions is difficult. All of them are the sort of thing that is easy to skip when a vendor is keen to switch you on. This is a guide, not legal advice; check anything that matters to your business with your adviser.
Tell people they are talking to an AI
There is no single UK law that says 'an AI must announce itself', but the effect of several is the same. GDPR requires you to be transparent about how personal data is processed, and a caller cannot understand that if they think they are speaking to a person. Consumer protection law prohibits misleading commercial practices. And the reputational point is stronger than either: in our own research, being deceived about talking to a machine was the single largest driver of lost trust, ahead of the machine making a mistake.
The practical rule is simple. The assistant says who it is in the first sentence, in every channel, every time. 'Hello, you're through to Brightside Dental. I'm the practice's AI assistant and I can book you in or take a message.' Customers are, overwhelmingly, fine with this. They are not fine with finding out later.
Recording and transcribing calls
Most AI assistants work from a transcript, which means the call is being recorded or transcribed in real time. In the UK that is lawful for a business, but you need a lawful basis under GDPR (usually legitimate interests or contract), you need to tell the caller, and you need to be able to say how long you keep it and who can hear it. A short line at the start of the call covers the telling. The retention period should be written down, short, and actually enforced by the system rather than by someone remembering.
PECR, the rules on electronic marketing, matters if the assistant ever makes outbound calls or sends texts. Booking confirmations and reminders to existing customers are fine. Anything that looks like marketing to someone who has not consented is not, whether a person or a machine sends it.
Where the data goes
Ask three things of any vendor: where the data is stored, whether it is used to train models, and how it is deleted when you leave. You want a clear answer to each. UK or EU storage keeps the transfer questions simple. 'Not used for training' should be in the contract, not just the sales deck. And deletion on request should be something they can demonstrate, because your customers can ask you to do it and you will need to pass the request on.
Under GDPR you are the controller and the vendor is a processor, which means you need a written data processing agreement with them. Any serious provider has one ready. If they look surprised to be asked, that tells you something.
What the machine may decide on its own
GDPR gives people the right not to be subject to decisions with legal or similarly significant effects made solely by automated means. Booking an appointment does not meet that bar. Refusing someone service, deciding a complaint or cancelling a contract might. The safe design is the one we use anyway: the assistant may book, remind, answer and collect; anything that changes what a customer is owed or entitled to goes to a person. Write that rule down and make the system enforce it.
Sector rules on top
If you are regulated, your regulator's expectations sit on top of all of this and are usually stricter. A dental practice is answerable to the GDC and CQC for what is said to patients, which is why a good assistant books and reminds but never gives clinical advice. A law firm's assistant must not create a conflict or give legal advice, so it qualifies and books and stops there. A financial adviser's assistant may collect documents and arrange the review; it may not describe a product. The pattern is the same everywhere: the assistant does the administration, the regulated professional does the regulated thing.
A checklist you can actually use
The assistant identifies itself as AI in the first sentence. Callers are told the call is transcribed, and retention is short and enforced. You have a data processing agreement with the vendor, UK or EU storage, and 'not used for training' in writing. Nothing that changes a customer's rights or money happens without a person. Your sector's rules are written into what the assistant may and may not say. Every action is logged, so you can answer 'what did it do?' about any call. If those six hold, you are on solid ground, and you are also, as it happens, running a better service than most of the people still relying on voicemail.