On a Friday morning in March 2026, a Montérégie auto dealership received a letter from the CRTC. Subject: 42 outbound calls generated by its AI voice agent, placed to numbers registered on the National Do Not Call List. Proposed penalty: $15,000 per violation, multiplied by the snowball effect of an automated campaign that had dialed 3,800 numbers in three weeks.
The owner didn't even know the list existed.
This is the blind spot of 2026. Everyone talks about the efficiency gains of outbound AI voice agents — few talk about the rules the CRTC has been enforcing since 2008, rules that apply exactly the same way to a synthetic voice as to a human one. Here are the 7 rules your Quebec SMB must bake in before its next outbound call — and how TECHMA configures the AI voice agent to respect them automatically.
1. Mandatory DNCL registration, even for a single call
Any business doing telemarketing in Canada must register with the National Do Not Call List (DNCL). Not 10,000 calls. Not 1,000. A single outbound marketing call to a non-consenting number puts you under the jurisdiction of the CRTC telemarketing rules.
Many owners think the DNCL only applies to big call centers. Wrong. A dental office in Sherbrooke launching an AI voice agent to call patients back with a promotional offer falls under the same legal category as a telemarketing firm. The only exception: strictly transactional calls (appointment confirmations, billing reminders). The moment a commercial offer slips into the script, the rule kicks in.
Technically, registration takes about 10 business days. Budget $80 per year for the base account, plus a subscription per area code (see rule 2). TECHMA folds this registration into the regulatory scoping phase of any outbound project — because deploying an AI voice agent without a valid DNCL account is literally opening a $15,000-per-call line of credit to the CRTC.
2. Per-area-code subscriptions, with 31-day maximum refresh
Once registered, your business must buy a subscription for each area code it calls: 514, 438, 450, 819, 581, 418, 367, 263. You download the DNCL numbers for that area code, cross-reference them with your database, and strip registered numbers before launching the campaign.
The trap: the refresh cadence. Your local copy of the DNCL cannot be more than 31 days old. An AI voice agent campaign that runs continuously for 45 days with the same list downloaded on day one violates the rule for every new registration in the last 14 days. And fines don't distinguish between negligence and fraud.
Concretely, a well-configured outbound AI voice agent must have a scheduled job that re-syncs the DNCL weekly (ideally nightly). ElevenLabs' recent outbound calling updates since April 2026 — especially the visited_agents arrays and multimodal hooks — allow this scrubbing logic to be embedded before a number is even composed. With gpt-realtime-mini and its +18.6-point gain in tool-calling accuracy, the agent can automatically refuse a call if the DNCL verification hasn't been performed in the last 24 hours.
3. Internal suppression list: 14 days to add, 3 years to retain
The moment a recipient tells you "don't call me again" — in French, in English, through an AI voice agent or a human — you have 14 days to add that number to your internal suppression list. And you must keep that list for 3 years after the entry.
This is the most underestimated rule among Quebec SMBs. A Laval real estate broker we audited in January 2026 had a suppression list… stored in a Google Sheet shared across 4 agents, manually updated, without timestamps. Result: 11 numbers that had requested a stop were called back 3 to 9 weeks later by the AI voice agent, because the sheet updates weren't synchronized with the campaign database.
A correctly configured AI voice agent automatically detects refusal expressions ("remove me from your list," "enlevez-moi," "stop calling me") and writes directly to a central table. It logs the timestamp, the audio recording, and the call identifier. Without that, your suppression list is just a pious wish.
4. Legal calling window: 9 AM to 9:30 PM weekdays, 10 AM to 6 PM weekends
Permitted calling hours in Canada are strict: Monday to Friday, between 9 AM and 9:30 PM; Saturday and Sunday, between 10 AM and 6 PM. And careful — it's the recipient's local time that counts, not the caller's. An AI voice agent calling a prospect in Val-d'Or (Eastern time) from a server configured in Vancouver (Pacific time) must respect Eastern time.
The rule sounds obvious, but AI voice agents often run 24/7 by default, and many integrators forget to set the timezone guard at the dispatcher level. We watched a Quebec travel agency let its AI voice agent call clients back at 10:47 PM for three weeks. They received 7 CRTC complaints. Fix: 15 minutes of orchestration-layer config. Potential cost avoided: $105,000 (7 violations × $15,000).
5. Mandatory caller identification — even more critical for an AI voice
Within the first 15 seconds of the call, your AI voice agent must communicate three non-negotiable pieces of information: the calling business's legal name, a valid callback number reaching a human or reachable system, and the reason for the call. No hiding identity behind a synthetic "Sophie" voice without naming TECHMA Inc. or the business it's calling on behalf of.
The CRTC clarified in Telecom Decision CRTC 2026-73 that identification rules apply identically to synthetic voices. An AI voice that presents itself as human without disclosing its automated nature when the recipient explicitly asks violates the rules. Plainly: if someone asks "are you a human or an AI?", your agent must answer honestly.
For the SMB, this is good news. Forced transparency reduces complaints — a recipient informed they're speaking with a professional AI voice agent from TECHMA for a Quebec SMB is statistically 3x less likely to file a complaint than someone who feels deceived.
6. Express vs implied consent: the 18-month rule
Not every outbound call needs express written consent. If your business has an existing business relationship with the recipient (purchase, quote request, subscription, etc.), you benefit from implied consent for 18 months after the last transaction. For an inquiry without purchase (a web form, for example), it's 6 months.
Beyond those windows, you need documented express consent. That means: a checkbox in a form, an email reply, an explicit voice recording — with timestamp and the version of the consent text shown. A well-designed AI voice agent queries the CRM database before dialing: date of last transaction, lead source, consent status. If information is missing, it abstains.
That's the exact same principle we cover in our 7-step Law 25 guide — except the CRTC governs the calling channel while Law 25 governs the personal data itself. Both regimes stack, and you have to satisfy both.
7. Record-keeping: 3 years of logs per campaign
Call recordings, scripts used, source lists, suppression history, proof of consent, refusal logs — all must be kept for 3 years. The CRTC can demand access to this data during an investigation, with short notice. An SMB that cannot produce the records of a contested campaign starts at a serious disadvantage.
The upside: an AI voice agent generates these logs automatically. Every interaction is transcribed, dated, linked to its original consent, and archived in Law-25-compliant storage (ideally hosted in Canada, encrypted at rest). It's even a sales argument: in case of a complaint, you can produce the full transcript in 30 seconds rather than 3 weeks of manual investigation.
SMBs that entrust their outbound infrastructure to TECHMA benefit from centralized recording storage indexed by number, date, call result, and operator. Retention is configured to 3 years + 14 days by default to cover legal timelines.
How CRTC and Quebec Law 25 overlap — two regimes, one infrastructure
The CRTC regulates the channel: who you can call, when, with what identification. Law 25 regulates the data: how you store, use, and delete the personal information collected during the call. For a Quebec SMB, you must satisfy both — and it's done with a single well-thought-out infrastructure.
A concrete example: an AI voice agent calling a prospect in Quebec City to offer a service. The CRTC requires consent for the call. Law 25 requires consent for processing the name, number, call result, and audio recording. Both consents can be collected in 10 seconds at the start of the conversation, using a script validated by TECHMA that documents them properly.
The difference with an inbound call is major: on inbound, the customer dialed the number — implicit consent. On outbound, you have to prove it. If you're still weighing the two approaches for your SMB, revisit the inbound vs outbound decision framework we detailed. And to understand the real costs that compliance adds, read the 7 hidden billing fees we see too often in AI vendor contracts.
What TECHMA handles for you
DNCL registration, per-area-code subscriptions, nightly scrubbing jobs, timezone guards, identification guardrails in the script, bilingual consent management, 3-year + 14-day archiving — all of it is part of the standard configuration of an outbound AI voice agent by our team. The client SMB never touches these technical layers. It validates scripts, approves lists, and receives performance reports.
That's our model since 2023: a compliant AI voice agent isn't a product we sell, it's an infrastructure we operate for the client. If your Quebec SMB is planning an outbound campaign in 2026 and the 7 rules above feel heavy, that's normal — and that's exactly why TECHMA exists.
Talk to our team via agentiavocal.ca. An initial compliance audit takes 30 minutes and can save you six-figure fines.