AI Must Identify Itself on Phone Calls: Italy's Law 132/2025 and the AI Act

If you're weighing an AI voice assistant to answer your business calls, there's a question no vendor is asking you, but you should be asking yourself: when the AI answers, does the caller know they're talking to a machine? Until yesterday, that was a style choice. Starting August 2026, it's a legal obligation, backed by two precise pieces of legislation: Italy's Law 132/2025 and the EU Artificial Intelligence Regulation (the AI Act, Regulation (EU) 2024/1689).

The interesting part is that almost no one in the Italian voicebot market explicitly ties their service to this rule. Vendors talk about "24/7 availability," "fewer no-shows," "automatic bookings" — but compliance stays in the corner. That gap is worth knowing about, because responsibility for staying compliant falls on you (the data controller and service operator), not just on the software.

In this article we'll cover, plainly and without legal jargon, what these rules actually require, the real deadlines, and what it concretely means to have a voice assistant that's "compliant by design." A note on scope: this is informational content, not legal advice. For a definitive read on your specific situation, talk to a professional.

The two laws at play: what they actually say

Let's untangle this, because two different instruments tend to get mixed up even though they converge on the same point.

The AI Act (Regulation (EU) 2024/1689)

This is the EU regulation on artificial intelligence, which entered into force in August 2024 with staggered application over time. As far as phone calls go, the key provision is the one on transparency: anyone deploying an AI system designed to interact directly with individuals must ensure those individuals are informed they are interacting with an AI system, unless this is obvious from the context. A voicebot answering the phone with a natural-sounding voice falls squarely under this rule — the average caller has no way of realizing on their own that they're talking to an AI, so they need to be told.

The transparency rules for these systems become applicable from August 2, 2026. That's the date you need to keep in mind.

Italy's Law 132/2025

This is the national law through which Italy set out its own framework on artificial intelligence, aligning with the EU regulation and introducing specific principles and delegated powers. On the point that matters here, it restates and reinforces the principle of transparency and recognizability: the use of AI systems when interacting with people must be made recognizable. In plain terms for your business: when a customer calls and an AI answers, that customer has the right to know it.

The two laws don't contradict each other — they stack. The AI Act sets the minimum EU-wide standard, and the Italian law brings it into our legal system. The practical takeaway for you is a single, simple rule: AI on the phone must identify itself.

What "identifying itself" means in practice

Here's the good news. Becoming compliant doesn't require a technical overhaul — it requires correctly designing the conversation. In practice, this means:

• Disclosure at the start of the call. In the first few seconds, before collecting any data, the assistant states that it's an automated system. Example: "Good morning, this is the virtual assistant for Studio Rossi, I can help you book an appointment." Clear, brief, no pretending to be a person.
• No active deception. The AI must not give a human name or pretend to be a flesh-and-blood receptionist. A natural voice is fine; faking an identity is not.
• A path to a human operator. The caller must be able to ask to speak with a person. This ties into handing off calls to a human operator, which is a good-service requirement as much as a compliance one.
• Proper handling of the data collected. If the call records or processes personal data (name, phone number, reason for calling), GDPR kicks in, requiring proper notice and a valid legal basis.

The core idea is "compliant by design": transparency isn't a disclaimer bolted on at the end — it's built into the flow of the conversation from the first second. Choose a voice assistant designed with that logic, and compliance follows almost on its own. Pick a generic tool that stays silent on the topic, and the risk is yours to carry.

Deadlines to note (no need to panic)

Let's walk through the relevant dates in order, separating what's already in force from what's still coming.

No need to panic, but no reason to delay either: if you're rolling out a voice assistant today, it makes sense for it to be compliant from day one, so you don't have to rework it in 2026. Redesigning a conversation flow later, once customers are already used to it, costs more than getting it right from the start.

Who's responsible: the software or you?

This is the part vendors tend not to highlight. Compliance is a shared responsibility, but the piece that concerns you directly can't be fully outsourced to the software.

• The AI system provider must supply the tools that make transparency possible — configuring the disclosure, managing handoff, handling data correctly.
• You, who use the system to answer your business's calls, decide how it's configured and are accountable for the processing of the data it collects (you're the data controller for GDPR purposes).

That's why it's not enough to buy "any voicebot." You want a partner who has already thought this through and delivers a service set up correctly from the start — disclosure at the opening, a path to a human operator, and proper data handling. If you want to understand the full flow of an AI-handled call, from answering to booking, you'll find the overview in our guide to how an AI phone assistant works.

GDPR and phone calls: the part everyone forgets

Transparency about the AI is only half the story. The other half is how you handle data during the call, and here GDPR applies just as it would to any other personal data you collect. In plain terms, a small business owner needs three things:

1. Know what you're recording. If the call is recorded or transcribed, that's personal data. You must inform the caller.
2. Have a legal basis. Handling a booking is generally tied to performing a service the customer requested; other purposes (marketing, for instance) need a different basis.
3. Keep data only as long as needed. You don't keep recordings "forever" — set a retention period consistent with the purpose.

The relevant authority in Italy is the Garante per la protezione dei dati personali (Italy's data protection authority), which has an established position on handling voice data and call recordings. Again: this is informational, and doesn't replace advice from whoever handles your privacy compliance.