ServIA
For business owners and operations managers at SMEs who are about to put an AI in charge of answering the phone, handling WhatsApp or calling customers. No jargon: what each regulation requires, what happens if you don't comply, and a checklist.
Since 2 August 2026, an AI that talks to people has to say so from the outset (AI Act, Art. 50). If you also record the call, GDPR still applies: inform people, have a legal basis and set how long the recording is kept. And if you make the call for commercial purposes, you need consent or another legal basis (Telecommunications Act, Art. 66) and must respect the calling hours and exclusion lists set by the AEPD.
The European Artificial Intelligence Regulation (the «AI Act») is being applied in phases. The one that affects almost every business is the phase covering Article 50, on transparency: from that date, AI systems designed to interact directly with people must be built so that the person knows they are dealing with an AI. The only exception is where this is obvious to a reasonably well-informed and attentive person, and the Commission's guidelines interpret this strictly: a natural-sounding voice receptionist answering your company's phone is not «obvious».
In Spain, the Government approved on 26 May 2026 the draft Organic Law on the proper use and governance of AI, which brings the regulation into Spanish law and strengthens the AESIA (Spanish Agency for the Supervision of AI) as the authority and single point of contact, and sets the national penalty regime. It is currently going through Parliament; the European obligations apply with or without it.
Before the person has said anything, the agent identifies itself as an AI. This applies to voice, WhatsApp, web chat and automated email. Putting it in the terms and conditions or saying it at the end doesn't count.
The AI Act doesn't require you to record; GDPR regulates recording if you do it: tell people at the start that the call is being recorded and why, have a legal basis (consent or documented legitimate interest), set a retention period and store the audio securely. The transcript is personal data, just like the audio.
Since June 2023, the General Telecommunications Act has prohibited unsolicited commercial calls without prior consent or another legal basis under GDPR. The AEPD (Circular 1/2023) also requires you to check the Robinson List and your own internal exclusion list before every campaign, identify the company and the reason for the call, and call only at reasonable hours (Monday to Friday, between 9 am and 9 pm).
Since 2025, the AI Act has prohibited manipulative practices and those that exploit vulnerabilities. In practice, for a small business this means two things: the agent must not pass itself off as a person or apply pressure, and anything sensitive (a complaint, a claim, a payment) must be passed to someone on your team. Keeping a record of what the system did is what lets you prove it.
Whoever develops the system is the «provider»; whoever uses it in their business is the «deployer». Both roles have obligations, and the transparency obligation falls on both. Ask your provider in writing how it complies with Article 50, where the data is stored and who has access, and sign a data processing agreement (GDPR, Art. 28).
| Non-compliance | Regulation | Maximum penalty |
|---|---|---|
| Failing to disclose that people are talking to an AI | AI Act, Art. 99.4 | €15M or 3 % of worldwide annual turnover, whichever is higher. For SMEs and start-ups, whichever is lower. |
| Prohibited practices (manipulation, exploiting vulnerabilities) | AI Act, art. 99.3 | €35M or 7 % of turnover. |
| Recording without informing people or without a legal basis; failing to honour data subjects' rights | GDPR, art. 83 | Up to €20M or 4 %, depending on the infringement. The AEPD often fines below that, but it does fine. |
| Commercial calls without consent | Ley 11/2022, art. 66 and GDPR | Data protection breach: the AEPD has imposed fines of hundreds of thousands of euros on companies that made calls without a legal basis. |
These figures are the legal ceilings. What usually happens to an SME is not the maximum fine: it is a customer complaint that ends up at the AEPD, and the burden of proving you did things properly. Having the record is what decides that case.
Tick what you already have. It is saved in this browser so you can come back to it.
The obligations are the same; what changes is where they pinch. Technical services and maintenance · Clinics and health centres · Academies and training.