AI Outbound for Regulated Industries in Australia: Finance, Health and Education

Most outbound compliance content in Australia stops at the general layer: consent, identification, unsubscribe, wash the list against the Do Not Call Register. That is the easy part. If you sell financial products, deliver a health service or run an RTO, a second regulator sits on top, with its own rules about approaching someone who has not asked to hear from you. Those rules shape an AI voice, SMS or chat program — and they are why thinner competitors avoid your sector.

This page is general information, not legal advice. Every rule below links to the regulator’s own guidance so you can read the primary text. Obligations turn on facts we do not know about your business — confirm your position with your compliance function or a lawyer.

The general layer, briefly

The ACMA administers the Spam Act 2003 for email and SMS: consent, identification, unsubscribe. Two details matter when a vendor does the sending. ACMA states that even if someone else sends your marketing messages for you, you must still have consent from each person who receives them; and that the message must still identify you as the business that authorised it. It is on you to prove consent, and an unsubscribe must be honoured within five working days.

The Do Not Call Register Act 2006 covers telemarketing. The register does not block calls — it lets businesses check lists and remove registered numbers before dialling. Business numbers cannot be added, but a mixed-use number can be if personal use exceeds 50% of total use; after 30 days, telemarketers can only call with consent or under an exemption.

The outsourcing point is sharper. The industry FAQs say both the person making the call and the business requiring it must comply, and that the legislation places a positive obligation on anyone contracting a third party to do telemarketing to include express provisions requiring compliance with the Act. If your contract has no such clause, that is a gap in the contract itself.

We will not re-list the general controls. Our AI outbound compliance checklist for enterprise buyers covers the AU and US baseline item by item, and SMS Sender ID registration in Australia covers the carrier layer. Everything below is added on top.

Financial services: ASIC

The hawking prohibition in s992A of the Corporations Act reshapes a calling program. In Regulatory Guide 38, ASIC explains that s992A(1) prevents offering a financial product for issue or sale to a retail client, or inviting them to ask or apply for one, where that happens in the course of or because of unsolicited contact. Two paragraphs matter most.

RG 38.36 states the prohibition is technology neutral and extends to real-time interactions in the nature of a discussion or conversation, including instant messages, as well as through media that use artificial intelligence such as chat-bots. An AI voice agent sits squarely inside the regime.

RG 38.37 closes the workaround. ASIC says the prohibition cannot be circumvented by engaging a third party to make offers on a person’s behalf, and that this includes third parties contracted to develop AI sales tools such as chat-bots — the person commissioning the chat-bot’s use, or under whose licence it operates, is responsible for any offer, request or invitation it makes. You can outsource the work, not the liability.

Operationally, the consent record is the campaign. RG 38 notes s992A(5)(d) and (e) require consent to be positive, voluntary and clear. The question stops being whether the list is good and becomes: for each record, what did this person consent to, when, and can I produce it. It also constrains the script. RG 38.15 says a breach happens when the offer, request or invitation is made, and RG 38’s worked examples treat giving factual information about a product differently from inviting someone to ask for or apply for it. Where your script sits on that line is a question for your compliance function, not for a vendor.

The second finance layer is the design and distribution obligations in Part 7.8A. Regulatory Guide 274 requires a target market determination and reasonable steps so distribution is consistent with it. ASIC says it will take into account the content and medium of delivery of promotional materials circulated by distributors, which should be informed by and consistent with the TMD — noting that mass market advertising or prominent online methods such as banner advertising generally are not appropriate for a product with a narrow target market.

Read that as a volume constraint: a broad, unsegmented AI blast is in tension with a narrow TMD, and the compliant version of scale in finance is tighter targeting, not more dials. One scope caution — RG 38.17 notes the prohibition applies only to offers made to a retail client, and RG 38.107 states that s992A does not apply to credit products except where they are also financial products.

Health: the OAIC

Health information is sensitive information under the Privacy Act 1988: under APP 3.3 an entity must not collect sensitive information unless the individual consents and the collection is reasonably necessary for its functions, subject to the exceptions in APP 3.4; and under APP 7.4 an organisation may only use or disclose it for direct marketing with consent.

The line that surprises operators is in the OAIC’s Guide to Health Privacy: you can only use or disclose a patient’s health information for direct marketing if the patient has consented — and a patient’s health information includes their name and contact details. The contact list is itself health information, which rules out most of what passes for list-building elsewhere.

Two more. The small business exemption does not apply to an organisation that provides a health service and holds health information, regardless of whether turnover is $3 million or less. The OAIC also notes private sector health providers in NSW, Victoria and the ACT must comply with state or territory privacy law as well as the Commonwealth Act, including the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic). Check the relevant state regulator for what those add.

The vendor consequence is data residency. APP 8 makes you accountable for conduct by an overseas recipient that would breach the APPs, so if your stack routes transcripts or recordings offshore, that is your exposure. Our sibling page on data privacy and AI sales agents covers what security reviews ask.

Education and VET: ASQA

RTOs are regulated by ASQA under the Standards for RTOs, in full regulatory effect from 1 July 2025. ASQA’s Information and Transparency practice guide sets out the marketing requirements; three bite directly on outbound.

First, marketing materials published or disseminated by the organisation, a third party or an engaged expert must include the RTO’s registration code or a link to it on the National Register — including material a lead-gen partner sends.

Second, where materials refer to services an RTO has engaged a third party to deliver, they must identify which services that third party is delivering — explicitly including where a third party is recruiting prospective VET students on behalf of the organisation. An outbound vendor calling for you is exactly that.

Third, an RTO must not make verbal or written guarantees that a student will obtain a particular employment outcome where that outcome is not within the organisation’s control. Guarantees are the default failure mode of an enthusiastic setter, human or AI — a script and QA problem, not a policy-document one. ASQA also requires accurate information about financial support arrangements, and says that where government funding is used, marketing must meet any additional requirements in the funding contract.

The sector version is covered in ASQA-compliant marketing for RTOs and RTO lead generation in Australia.

What changes, sector by sector

Where a generic setter tool falls over

Not on capability — a cheap tool will dial, talk and book. It falls over on four things that only surface in a regulated account.

It has no consent ledger. Most tools import a CSV and cannot tell you, per record, what the person agreed to and when. In finance and health that is the compliance case.

It optimises against your script constraints. Self-improving prompts drift toward whatever books more meetings — precisely the wording a regulator objects to: the outcome guarantee, the product invitation. Nobody reviews the drift.

It has no identification discipline. ACMA requires the authorising business to be identified in messages a third party sends; ASQA requires the registration code and third-party disclosure. Generic tools default to their own branding.

It cannot answer the data question. Where recordings live, how long they are kept, who can access them, whether anything crosses a border.

The honest trade-off: compliant outbound in a regulated sector is slower to launch and produces fewer conversations per thousand records. Anyone promising volume comparable to an unregulated B2C campaign either does not understand your obligations or plans to breach them on your licence — a difference explored in enterprise vs SMB lead generation.

What we actually do in regulated accounts

LeadsNow has generated 1M+ leads and 50,769+ AI-booked sales appointments since 2017. Regulated sectors are part of that work, and they stay under-served because compliance fear keeps thinner vendors out.

In finance we run outbound for brokers including Sam Tajvidi’s 121 Brokers; in education, Lambda Academy. The pattern is unglamorous: start from your consented base, not a purchased list, and treat database reactivation as the primary motion, because a record that opted in with you already carries the consent history a regulator will ask about.

Scripts are reviewed against the sector rule before launch, not after a complaint: the AI handles the conversation, a named human owns what it may say. See AI voice agents for sales in Australia for the voice layer.

To talk through your own sector, book a call.

Frequently asked questions

Does the hawking prohibition apply to an AI voice agent or chatbot?

Yes. ASIC’s Regulatory Guide 38 says at RG 38.36 that the prohibition is technology neutral and extends to real-time interactions in the nature of a discussion or conversation, including instant messages, as well as through media that use artificial intelligence such as chat-bots. RG 38.37 adds that the person commissioning the chat-bot’s use, or under whose licence it operates, is responsible for any offer, request or invitation it makes.

Can we cold call or SMS a purchased list in health?

The OAIC’s Guide to Health Privacy states that a patient’s health information can only be used or disclosed for direct marketing if the patient has consented, and that a patient’s health information includes their name and contact details. A purchased list carries no consent you can evidence, so health outbound runs on your own consented patient base.

Does our lead-gen vendor’s consent count as our consent?

No. ACMA’s guidance is that even if someone else sends your marketing messages for you, you must still have consent from each person who will receive them, and that under the Spam Act it is up to you to prove it. The Do Not Call Register industry FAQs separately note a positive obligation to include express compliance provisions in the contract.

What does ASQA require if a third party makes enrolment calls for us?

ASQA’s Information and Transparency practice guide requires marketing materials published or disseminated by the organisation, a third party or an engaged expert to include the RTO’s registration code or a link to it on the National Register, and to identify which services a third party is delivering — explicitly including where a third party is recruiting prospective VET students on behalf of the organisation.

Are business numbers covered by the Do Not Call Register?

ACMA states you cannot add a business phone number to the Do Not Call Register, but a number used for both business and personal purposes can be registered as long as personal use is more than 50% of total use. So B2B lists still need washing: mixed-use mobiles are common and indistinguishable from the outside.

See if we’re a fit

A few quick questions. If it’s a fit, our live calendar loads on the next screen. If it isn’t, we’ll point you to free resources instead — you won’t have to sit through a sales call to find out.