AI phone assistants for resident appointments: the AI Act rules in force since 2 August 2026

Thursday, 5:40 pm. Two weeks ago, a resident got a letter saying her heat cost allocators would be replaced. Now a friendly voice calls and offers her an appointment on Tuesday between 8 am and noon. After a minute, she asks: "Am I actually talking to a real person?"

Since 2 August 2026, she shouldn't have to ask. That is when the transparency obligations in Article 50 of the EU AI Act started to apply. This lands right in the busy run-up to 31 December 2026. By then, heat cost allocators and heat meters in Germany that can't be read remotely must, as a rule, be retrofitted or replaced.

If you leave appointment calls to an AI phone assistant, or plan to, you should know the rules. This post sums them up as of 21 October 2026 and shows what a fair AI appointment call sounds like.

The disclosure duty under Article 50

Article 50(1) of the AI Act, Regulation (EU) 2024/1689, is addressed to providers. They must ensure that AI systems intended to interact directly with natural persons are "designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system". The duty does not apply where this is obvious "from the point of view of a natural person who is reasonably well-informed, observant and circumspect", given the circumstances and context. The information must come "at the latest at the time of the first interaction" and "in a clear and distinguishable manner" (Article 50(5)). It must also meet the applicable accessibility requirements.

There is no transition period for the AI disclosure (Article 113), not even for voice assistants that were already running before 2 August 2026. The Commission's non-binding guidelines on Article 50 say so explicitly (para. 153; content approved on 20 July 2026, not yet formally adopted as of 21 October 2026, see below).

Providers and deployers have different duties

Article 50(1) places the duty on the provider. Article 3(3) defines the provider as whoever develops an AI system, or "has an AI system ... developed", and places it on the market or puts it into service under its own name or trademark. The deployer is whoever uses it "under its authority" (Article 3(4)).

A vendor's ready-made voice assistant under the vendor's name: The vendor is the provider and must build the AI disclosure into the system. As a rule, you are the deployer.
Your own bot under your name, built in-house or by an agency: As we understand it, you are then the provider yourself (Guidelines, para. 11).
Gray areas: If you buy a bot and have it adapted under your brand, or set one up yourself on someone else's platform, your company may also count as a provider. Settle the roles before the first call, and write into the contract who is responsible for each duty.

Deployers have no duty of their own under Article 50(1). They do have duties under other paragraphs of Article 50, for example for emotion recognition (Article 50(3)) and deepfakes (Article 50(4)). In our view, the contract with the vendor should still include an AI disclosure that cannot be switched off, and a ban on using your call data to train AI. You also need a data processing agreement. It should name the subprocessors and set out storage locations and deletion periods.

Breaches of Article 50 can cost up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)(g)). For SMEs and small mid-caps, whichever amount is lower applies (Article 99(6) and (6a)). For breaches of Article 50(1), the fine falls on the provider. Under KI-MIG, Germany's act implementing the AI Act, the competent authority is, as a rule, the Federal Network Agency (Bundesnetzagentur, BNetzA). Residents can also send their complaints there. Where personal data is involved, the data protection authority is usually responsible.

The AI omnibus changes little for phone bots

Regulation (EU) 2026/1744, the digital omnibus regulation on AI (the AI omnibus for short), has been in force since 27 July 2026. For voice assistants on the phone, it changes little. Article 50(1) and (5) are unchanged. The only change to Article 50 is in paragraph 7, on codes of practice. The omnibus postponed the high-risk obligations (Annex III, to 2 December 2027), not the AI disclosure duty.

The new deadline of 2 December 2026 (Article 111(4)) only covers the machine-readable marking of AI-generated content under Article 50(2), for generative systems placed on the market before 2 August 2026. However, the synthetic voice of a voice assistant can itself be such content (Guidelines, paras. 60 and 63), and the provider must then mark it. Para. 88 considers an exception for transient real-time content. Whether it covers phone calls is still open. That is a question for your vendor or, if you built the bot yourself, for you.

The AI omnibus did not change the GDPR. The separate data omnibus (a Commission proposal of 19 November 2025) was still with the European Parliament's lead committee on 21 October 2026.

What the Commission's guidelines say about phone calls

The Commission approved the content of its guidelines on 20 July 2026. According to the Commission, they will only be formally adopted, and so become applicable, once all language versions are available. On 21 October 2026, only the English version existed. The guidelines are not binding, but they show how the Commission reads Article 50:

Outbound calls are covered too (paras. 30 and 31). AI agents that make bookings, for example, should say that they are artificial and on whose behalf they act.
The disclosure is spoken at the start (para. 37). A beep alone is not enough. Calling the bot just an "assistant" is too vague. A notice that only appears in the terms and conditions or the documentation is not enough either (para. 38).
"Obvious" is to be read narrowly (paras. 44 and 45). A human-sounding voice makes it less likely that the AI is obvious. According to the guidelines, if your calls also reach vulnerable people, you cannot rely on the exception. A meter swap affects the whole building, including older people and people with disabilities (recital 132).

Recording and data protection

Anyone who records another person's non-public spoken words on a recording medium "without authorization" ("unbefugt") commits a criminal offense under § 201 of the German Criminal Code (Strafgesetzbuch, StGB). We found no court ruling that settles whether a voice assistant "records" ("aufnimmt") in this sense if it only processes the call in real time, without storing it. GDD, the German data protection association (Gesellschaft für Datenschutz und Datensicherheit), generally treats temporary buffering in transcription tools as a recording. For data protection purposes, it sees explicit, documented consent as the usual legal basis.

In our view, recording should therefore be off by default, and only run with a clear purpose and after consent. Anyone who says no still gets their appointment, if need be through a callback from a person. Audio should be deleted as soon as the transcript is ready. Check with your data protection officer or a lawyer whether your technical setup counts as a recording under § 201 StGB.

The information duties under Articles 13 and 14 of the GDPR continue to apply in full alongside Article 50. If the property manager supplied the phone number, the resident must also be told where it came from, at the latest when they are first contacted (Article 14(2)(f) and (3)(b)), unless the advance letter already said so (Article 14(5)(a)). On the phone, layered information is possible: the essentials in the call, the rest via an SMS link or in the letter. Who has to provide the information, you or your client, depends on whether you are the controller or the processor in the project. Check this, and the legal basis for the call, with your data protection officer before you start.

When an appointment call can become advertising

Advertising calls to consumers need their prior express consent under § 7(2) of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG). For advertising with an automated calling machine, every recipient must have consented, businesses included. AI calls to win new customers are telephone advertising. This post is not about them.

As we understand it, a call that only sets the date for an announced meter swap, or for a house connection that has already been ordered, as a rule falls outside § 7(2) UWG, as long as it sticks to the appointment. It may be different if the purpose of the call is to win a fiber contract or to get the property owner's consent. Two further limits remain:

It doesn't take much to count as advertising. The Federal Court of Justice (Bundesgerichtshof, BGH) classed a customer satisfaction survey sent by email as advertising, even though the same email delivered the invoice (judgment of 10 July 2018, VI ZR 225/17). In our view, an add-on offer or a survey can therefore turn an appointment call into advertising too. As far as we can tell, it is still open whether an AI voice assistant then counts as an "automated calling machine" ("automatische Anrufmaschine").
Harassment stays prohibited. § 7(1) UWG prohibits unreasonable harassment, and under § 2(1) no. 2 UWG this also applies while a contract is being performed. In our assessment, a very large number of repeat calls can therefore be unlawful even without any advertising. We have not found case law on this.

Germany's telecoms and digital services data protection act only requires the caller's number to be shown on advertising calls (§ 15(2) TDDDG). We still recommend showing a German number that people can call back, and printing the same number in the advance letter. When it comes to access to their flat, residents are rightly wary of strangers.

What a fair AI appointment call sounds like

In our view, a fair call starts before the phone rings, with the advance letter. The letter should say that an AI may call and from which number. It should also say how to reach a person, and it can point to the privacy notice with a web address or a QR code. The call then starts something like this:

"Hello, this is [Company]'s AI voice assistant. I'm not a person. I'm an artificial intelligence. I'm calling on behalf of your property manager, [Name], about the announced replacement of your heat cost allocators. We got your number from the property manager. If you'd rather speak to a person, just say 'representative'."

For the rest of the call, we recommend:

Stay honest. The bot always answers "Are you a real person?" truthfully (Guidelines, para. 40). It repeats the AI disclosure after an interruption or a complaint. It also repeats it when an older person is on the line or someone seems confused.
Keep the privacy part short. Name the controller and the purpose, and send the details by SMS link or letter, unless they were already in the advance letter.
A person on request. The AI Act does not require a transfer to a person for bots like this. We still recommend one: a direct transfer during service hours, otherwise a callback within a fixed time window. Complaints and refusals go to a person automatically. So do calls with communication problems and calls where the resident has a court-appointed legal representative (rechtlicher Betreuer).
No pressure, no advertising. Under Germany's heating cost regulation (Heizkostenverordnung, HeizkostenV), occupants must tolerate the installation (§ 4(2) HeizkostenV: "die Nutzer haben dies zu dulden"). For electricity meters, connection users (Anschlussnutzer, the consumer who uses the grid connection) must give access once they have been notified in advance. This follows from the Low-Voltage Connection Ordinance (Niederspannungsanschlussverordnung, NAV; § 21 NAV) or, when a smart metering system is installed, from Germany's Metering Point Operation Act (Messstellenbetriebsgesetz, MsbG; § 38 MsbG). Neither group has to talk to an AI. Anyone who doesn't want to gets a portal link by SMS or a letter. Add-on offers and surveys don't belong in an appointment call.
Only the data you need. Record the order or meter number and the time window, plus access details and notes such as "needs more time". No date of birth, no health details.
No emotion recognition, no cloned voice. Recognizing emotions from someone's voice is high-risk AI (Annex III, point 1(c), of the AI Act), and the deployer must tell the people affected (Article 50(3)). We do not consider a plain appointment bot high-risk. An AI voice that resembles a real member of staff can be a deepfake (Article 3(60)), which the deployer must disclose (Article 50(4)).
Limit the attempts. Set a fixed maximum number of call attempts and only call at reasonable times of day. After "please don't call again", the calls stop.
A clean ending. The bot repeats the appointment and time window and gives the callback number. The resident then gets a confirmation by SMS, or by letter for landline numbers. The confirmation is labeled as an AI message and says how to rebook.

When residents call in

If the resident calls in herself in the evening, the same disclosure duty applies: the AI disclosure comes in the greeting, before the first question. We also recommend:

Saying "representative" or pressing 0 works at any time. During service hours, it puts the caller through to a person. Outside them, the caller is promised a callback.
The order number from the letter is usually enough to identify the caller. Without it, the bot asks for the address and name. It only discusses key handovers, or times when nobody will be home, once it is sure who is calling.
No blanket "this call may be recorded". If audio or a verbatim transcript is stored, the caller hears a specific notice and is asked for consent.
If someone smells gas, the bot immediately advises them to leave the building and, once outside, call the gas network operator's emergency line or 112. For water damage, it gives the property manager's emergency number.

What dispatchers and project managers should decide

Rules per project. Before the first call, settle the client and the reason for the call. Set the time windows and the callback number too.
The result on the work order. The technician sees what was agreed, for example "key with the neighbor" or "don't call again". Health information is specially protected (Article 9 GDPR). In our view, it belongs on the work order only with explicit consent.
Follow-up. Dropped or declined AI calls go on a list for the dispatchers.
Test calls and training. Regular test calls show whether the points above are being followed. Dispatchers who work with the bot should get brief training (AI literacy under Article 4 of the AI Act).

How Jarvis arranges appointments with residents

Jarvis arranges appointments with residents and the contacts who handle access, by phone and SMS as well as by email and letter, in more than 15 languages. Residents can confirm or move their appointment themselves around the clock, by phone or in an online portal.

We sign a data processing agreement with every customer. Ask any software vendor, including us, how they handle the points above.

If you are thinking about booking resident appointments by AI over the phone, we are happy to show you how that works with Jarvis. Book a 15-minute walkthrough.

This article is not legal advice. It reflects the situation as of 21 October 2026. For questions about your project, check the current text of the provisions mentioned or ask a lawyer.

By Valter Pasanen, Founder, Grid Jarvis. Published 2026-10-21. 2026-10-21