AI Receptionists · 8 min read
Is an AI Receptionist Legal in the UK?
Published 2026-10-16 · The Scaling Firm
Published 2026-10-16 · The Scaling Firm
Yes. UK law lets a business answer its calls with an AI receptionist. The rules are the ones that apply to any call handling: tell callers who you are and how their information is used, tell them if calls are recorded, protect health details properly, and never mislead anyone into thinking they are speaking to a person. This guide sets out each rule and where it comes from. It is general information, not legal advice.
No UK law says, in those words, that you must announce an AI. Two sets of rules get you to the same place. Under UK GDPR, when you collect someone’s details you must tell them at that time who you are, why you are using their data and whether any automated decision-making is involved (Article 13). And the Competition and Markets Authority’s guidance on AI agents (9 March 2026) tells businesses to tell customers they use them, and to consider labelling them so customers are not misled into thinking they are dealing with a person. The CMA also says you are responsible for what an AI agent does in the same way you are responsible for an employee, and that breaking consumer law can mean fines of up to 10% of worldwide turnover under the Digital Markets, Competition and Consumers Act 2024. The simple answer is to have the receptionist say it is an AI at the start of the call, or at least whenever it is asked.
If calls are recorded, the ICO says callers must be told that the call may be recorded and why, and that a recorded message is good practice; the rest of your privacy information can follow by other means, such as a link to your privacy notice (ICO). The business monitoring regulations under the Investigatory Powers Act 2016 also expect you to make all reasonable efforts to tell callers that calls may be intercepted (regulation 4). An AI receptionist turns speech into text to do its job, so treat transcripts with the same care as recordings, and keep each for a set period.
Health information is special category data. As well as a normal lawful basis, a clinic needs a condition under Article 9. For care provided by or under a health professional bound by confidentiality, that is usually the health or social care condition, completed by Schedule 1, paragraph 2 of the Data Protection Act 2018; explicit consent is the alternative. The ICO lists artificial intelligence combined with sensitive data among the processing that needs a data protection impact assessment, so a clinic should complete one before going live (ICO list). The AI provider must sign a processor contract covering the points in Article 28. If calls are processed in the United States, the transfer needs a lawful route: a recipient certified to the UK Extension to the EU-US Data Privacy Framework, or the UK’s international data transfer agreement or addendum with a transfer risk assessment (ICO).
Since 5 February 2026, new Articles 22A to 22D, added by section 80 of the Data (Use and Access) Act 2025, govern significant decisions made with no meaningful human involvement. They require safeguards, including the right to a human review, and decisions based on health data still need explicit consent or another narrow legal route. In our view, taking a booking or a message is unlikely to be a significant decision. Deciding whether or how quickly a patient is seen could be, so keep a person in charge of triage.
The strict rules apply to calls you make. Marketing calls that play recorded or automated speech need the person’s prior consent to automated calls specifically (PECR regulation 19). Live marketing calls must not go to numbers on the Telephone Preference Service unless the person has said they do not object (regulation 21). Appointment confirmations and reminders count as service messages, as long as they contain no promotion (ICO). Since 5 February 2026 the ICO can fine up to £17.5 million or 4% of global turnover for breaking these rules.
The GDC standards still require dental professionals to keep patient information confidential and secure, and to make sure non-registered team members understand confidentiality. The CQC does not approve particular technologies, but its AI guidance expects AI to support human decisions without replacing them, people to be told about the role of AI in their care, and a data protection impact assessment.
The EU AI Act is not UK law. It can reach a UK business whose AI system’s output is used in the EU, and from 2 August 2026 Article 50 requires AI systems that talk to people to tell them they are dealing with an AI, unless that is obvious (EUR-Lex). That duty falls on the provider of the system. If you take calls from EU callers, ask your provider how it meets it.
Our AI receptionist says it is an AI if asked, and we can have it say so at the start of every call. We agree UK GDPR processing terms with every practice before it handles live calls, and we explain before activation where calls are processed, which can include the United States. It never gives clinical advice and flags urgent calls to your team. Sources were checked on 16 October 2026. For your own practice, speak to your data protection officer or a solicitor.
No UK law says those exact words, but UK GDPR requires you to tell callers how their data is used when you collect it, and CMA guidance says to tell customers you use AI agents and to consider labelling them so nobody is misled. Saying so at the start of the call meets both.
If the AI handles patient health details, treat one as required. The ICO lists AI combined with sensitive data among the processing that needs one.
HIPAA is United States law and does not apply to UK practices. In the UK the rules are UK GDPR, the Data Protection Act 2018, PECR and your professional regulator’s standards.
Yes, if the call is purely a reminder or confirmation with no promotion. Once a call markets anything, the automated marketing rules apply and you need specific prior consent.
Related service: AI receptionist for clinics and local businesses
Five changes that win a small clinic more bookings without a new hire: count missed calls, take bookings and deposits online, send reminders and cover the phone.
Read article AI Receptionists · 7 minThe alternatives to Moneypenny for a small UK clinic: human answering services and AI receptionists, with published prices, contract terms and what to check.
Read article Company News · 6 minThe Brentwood Chamber of Commerce August 2026 Member Spotlight on Mohamed Omar, founder of The Scaling Firm: what we build and the principles behind it.
Read article