The AI Outbound Compliance Checklist for Enterprise Buyers (AU + US, 2026)

Most AI outbound programmes inside large companies do not die in the pilot. They die in the review. Marketing runs a test, the numbers look good, the deck goes to legal or procurement — and the questions start. Where did this consent come from? What happens when someone says stop? Is the recording legal in that state? The programme stalls quietly and nobody writes the rejection down.

This is the checklist those reviewers work through, from their side of the table. Australia and the United States are covered separately, because the rules genuinely differ and the worst mistakes come from applying one country’s assumptions to the other. Every point links to its primary source.

This is not legal advice — it is a buyer-side checklist built from primary sources, current as at August 2026. Where the position is unsettled we say so. Confirm with counsel.

1. Consent: what is your basis, and can you prove it?

This is where most reviews stop — not because consent is missing, but because nobody can produce it in a form that survives scrutiny.

Australia

Two regimes run in parallel. For calls, the Do Not Call Register Act 2006 bars unsolicited telemarketing calls to registered numbers absent consent or an exemption. For SMS, the Spam Act 2003 requires consent, sender identification and a working unsubscribe on commercial electronic messages with an Australian link. One carve-out is worth knowing before someone else raises it: Schedule 1 designates certain messages — broadly, factual information carrying no more than the sender’s name, logo and contact details — and the Schedule’s note records that designated messages “are exempt from section 16 … and section 18”, the consent and unsubscribe sections, while sender identification under section 17 still applies. Marketing SMS almost never qualifies. Three details catch enterprise teams out:

• Express consent for calls has a shelf life. Where it has not been given for a set period or indefinitely, consent is taken to expire three months after it was given. A form fill from last year is not a live basis.
• The burden of proof is yours. Record who gave consent, when and how, because under the Spam Act it is up to you to prove that you have a person’s consent.
• Buying a list does not buy consent. The ACMA’s position on bought or rented lists is that you are still responsible for making sure you have consent for any addresses you use.

United States

The TCPA separates prior express consent from prior express written consent. Telemarketing calls or texts using an autodialer or an artificial or prerecorded voice need the written tier: 47 CFR § 64.1200(f)(9) requires a signed written agreement clearly authorising the seller to deliver such messages, specifying the telephone number.

The one-to-one consent saga is often reported wrongly. The FCC’s 2023 rule would have required consent to be given to one identified seller at a time, logically and topically related to the originating interaction. On 24 January 2025 the Eleventh Circuit vacated it in Insurance Marketing Coalition Ltd. v. FCC (No. 24‑10277) as exceeding the FCC’s authority, and the FCC conformed its rules effective 29 August 2025, restoring the pre-2023 definition.

So shared or lead-aggregator consent is not federally prohibited today. It is also not safe: it was remanded, and state statutes and plaintiff firms fill the gap regardless. Treat it as an accepted risk with a named owner, not a solved problem. Deeper treatment: TCPA compliance for AI voice and SMS agents.

2. AI disclosure: does the person know what they are talking to?

No federal US rule requires you to announce that a call is AI-generated. One rule does put the technology inside the TCPA: in a Declaratory Ruling adopted on 2 February 2024 and announced on 8 February 2024 (FCC 24‑17), the Commission recognised that calls made with AI-generated voices are “artificial” under the Telephone Consumer Protection Act, effective immediately. An AI voice call is therefore an artificial-voice call — and where the call is telemarketing, that is the written-consent tier above.

A dedicated disclosure requirement was proposed in the FCC’s August 2024 rulemaking on AI-generated calls and, as at August 2026, has not been adopted. Anyone calling federal AI disclosure mandatory is describing a proposal, not a rule.

States have not waited. California’s AB 2905 (2024) amended Public Utilities Code § 2874 so the natural-voice announcement preceding a prerecorded message must also tell the person called if that message uses an artificial voice. Treat AI disclosure as a state-by-state matrix, configured per campaign.

Australia has no AI-specific disclosure rule, but something close in effect: the ACMA requires a telemarketing call to say who it is as soon as the call starts, say why they are calling, and end the call immediately if someone asks or indicates they want it to end. An agent that dodges “am I speaking to a person?” creates a misleading-conduct problem instead. Our position is simpler than the law requires: disclose early, in the script.

3. Suppression: registers, internal lists and the 31-day clock

Reviewers care less that you scrub than how recently, and against what.

Australia’s calling hours and identification rules sit in the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017, which also requires calling line identification to be enabled and a return contact number to stay reachable for at least 30 days after the call. Research calls get a wider window, but one carrying a commercial purpose is a telemarketing call.

4. Opt-out propagation: the question nobody asks precisely enough

“Do you honour opt-outs?” is the wrong question; every vendor says yes. The right ones are how fast, across which channels and which business units.

Under § 64.1200(a)(10), a US recipient may revoke consent by any reasonable method. Replying stop, quit, end, revoke, opt out, cancel or unsubscribe is a reasonable means per se — as is any other wording a reasonable person would read as revocation. You may not designate an exclusive opt-out mechanism, and requests must be honoured within a reasonable time not exceeding ten business days.

The part not yet in force is the one enterprises must plan for: that a revocation made in response to one type of informational message applies to all future robocalls and robotexts from that caller on unrelated matters. The FCC extended that provision’s effective date to 31 January 2027. With several business units and several messaging vendors, that is an integration project, not a policy update — see the TCPA revoke-all rule. Ten business days is the ceiling, not a target: ask for measured propagation time from opt-out to suppression across every channel, in a report rather than a slide.

5. Call recording consent

Recording is where AI outbound quietly acquires criminal exposure, because the case for recording everything is so strong. In the US the federal floor is one-party consent, but several states require all parties to consent — California makes it an offence to record a confidential communication without the consent of all parties (Penal Code § 632). Dialling nationally, record with disclosure everywhere and route by the stricter rule.

Australia has no single answer either. Interception of a communication passing over a telecommunications system is governed federally by the Telecommunications (Interception and Access) Act 1979, while recording a private conversation falls under state and territory surveillance devices legislation that differs by jurisdiction. Confirm with counsel for each state you dial into.

6. Data handling and audit trail

Under the Privacy Act 1988, APP 7 restricts using personal information for direct marketing and requires you to honour opt-outs. The clause reviewers forget is provenance: OAIC guidance on APP 7 notes an organisation must, on request, notify an individual of its source for their personal information unless doing so is impracticable or unreasonable. If your stack cannot say where a record came from, you cannot answer.

Two reform points, stated honestly rather than guessed. The statutory tort for serious invasions of privacy commenced on 10 June 2025, giving individuals a cause of action independent of the Privacy Act complaints process. The automated decision-making transparency obligation in APP 1 commences 10 December 2026 — the OAIC’s May 2026 issues paper confirms the date and says guidance is intended by September 2026. Whether an AI agent scoring a lead crosses that threshold is a question for counsel now, not November. The rest of the reform programme, including removal of the small business exemption, is not law and has no commencement date.

Outsourcing does not outsource liability. In Australia both the telemarketer and the business requiring the call must comply; under § 64.1200(d)(3), where do-not-call requests sit with another party, the entity on whose behalf the call is made is liable for failures to honour them. So the due diligence question is not “are you compliant?” but “what will you show me, and how fast?” A reviewable programme produces, for any contacted record:

• the consent artefact — source, timestamp, wording, number authorised
• the scrub evidence — which suppression lists ran, and when
• the call or message log, including the disclosure text delivered
• the recording and its legal basis in that jurisdiction
• the opt-out event, when it landed, when suppression took effect everywhere
• every subprocessor that touched the record, and each copy’s retention clock

Ask for that pack on a real record before you sign. A vendor who cannot assemble it in a week cannot assemble it for a regulator. On certifications, ask what they hold and treat an unevidenced claim as a red flag.

Where LeadsNow sits

50,769+ AI-booked sales appointments since 2017 and 1M+ leads generated, across Australian and US programmes — so we have had this conversation with a lot of compliance teams. Our position: consent-based outbound and database reactivation for businesses that already own the relationship, AI disclosed early in scripts, suppression and calling windows set per jurisdiction, and a per-record audit pack of the kind above.

What we will not do is claim a certification, audit or accreditation we have not been told we hold, or offer a legal opinion. If your reviewer wants a specific attestation, ask and we will answer yes or no. See also enterprise lead generation services and, for billing-related outreach, failed payment recovery with call and SMS agents. Or book a call.

Frequently asked questions

Is AI outbound calling legal for enterprises in Australia and the US?

Yes, on a consent basis, in both. Neither country bans AI voice or SMS outbound. Both regulate the consent behind it, the hours you may call, the identification you must give and how fast you must stop. The failure mode is rarely the technology; it is a consent record nobody can produce, or suppression that propagates too slowly.

Does the FCC require us to disclose that a call uses AI?

Not as at August 2026. The FCC’s February 2024 Declaratory Ruling established that AI-generated voices are “artificial” under the TCPA, which drives the consent tier. A specific disclosure obligation was proposed in the August 2024 rulemaking and has not been adopted. Several states impose their own, so a national programme should disclose anyway. Confirm the state matrix with counsel.

How quickly must an opt-out take effect?

In the US, within a reasonable time not exceeding ten business days, and you may not force people to use one designated method. In Australia, Spam Act unsubscribe requests must be honoured within 5 working days and the facility must stay functional for at least 30 days after the message was sent. For calls, consent ends the moment the person says stop.

Is the one-to-one consent rule still in force in the US?

No. The Eleventh Circuit vacated it on 24 January 2025 and the FCC conformed its rules effective 29 August 2025, restoring the earlier definition of prior express written consent. It was remanded rather than resolved, so this is live. If your lead supply depends on shared consent, document it as an accepted risk.

Does Australian privacy reform change anything for AI outbound?

One dated change matters. The automated decision-making transparency obligation commences on 10 December 2026 and will require APP entities to disclose in their privacy policy the kinds of personal information used, and the kinds of decisions made, by computer programs that significantly affect people’s rights or interests. The rest of the programme, including the small business exemption, remains proposed rather than legislated.

See if we’re a fit

Three quick questions. If it’s a fit, our live calendar loads on the next screen. If it isn’t, we’ll point you to free resources instead — you won’t have to sit through a sales call to find out.