"Hi, this is Julie. How can I help you today?" The caller books her appointment, says thanks, hangs up. Forty seconds, start to finish. She never found out she'd just spoken to software.
Two years ago nobody asked about this. Now it's the first question we get from Canadian businesses putting an AI voice agent on their main line: does it have to say it's an AI? The short answer — yes, in almost every case — hides a longer answer that's far more useful.
This guide walks through five concrete steps to get AI voice agent disclosure right in Canada, and to make sure it doesn't cost you a single booking. Budget about thirty minutes of configuration. No legal background needed.
Before you start: four rulebooks apply, and none of them is an "AI law"
Let's kill a myth first. Canada has no statute that says "a bot must announce itself on the phone." The federal Artificial Intelligence and Data Act (AIDA), tucked inside Bill C-27, died on prorogation in January 2025 and never came into force. There is no pan-Canadian AI disclosure mandate today.
That doesn't leave you in the clear. Four existing frameworks already apply, and it's the stack that creates the obligation.
- PIPEDA — federal privacy law requires meaningful consent for the collection of personal information. Consent is hard to call meaningful when the person doesn't know who, or what, they're talking to.
- CRTC Unsolicited Telecommunications Rules — any message delivered by an automatic dialing-announcing device must identify, at the outset, the person on whose behalf the call is made, plus a brief description of its purpose. The CRTC rules predate voice AI but were drafted broadly enough to catch it.
- Provincial privacy statutes — Alberta and British Columbia have their own PIPA regimes; Quebec's Act respecting the protection of personal information in the private sector (Law 25) is the strictest in the country and includes an automated-decision rule with no federal equivalent. If you take calls from Montreal, it applies to you even if your office is in Mississauga.
- Consumer protection and misleading-practice law — every province prohibits material misrepresentation. Letting a customer believe they're speaking to a person when they're speaking to a system is a material omission. You don't need an AI-specific law to be on the hook.
Add a fifth if you have even one European customer: Article 50 of the EU AI Act explicitly requires that people be told they're interacting with an AI system. Those transparency obligations start applying on 2 August 2026 — days from now. Penalties reach EUR 15 million or 3% of worldwide turnover. It's the text half the industry blogs quote. It's rarely the one that governs your line.
Step 1 — Write the opening line that solves 90% of this
Compliance lives in the first six seconds of the call. Not in a privacy policy nobody opens.
The wording that works fits in one sentence: "Northside Dental, good morning. You're speaking with our virtual assistant — that's an artificial intelligence. I can book appointments, or put you through to someone on the team."
Three non-negotiables in there. The business name (CRTC identification). The words artificial intelligence — not "automated assistant," not "virtual agent," euphemisms that a large share of callers read as "a human reading a script." And an explicit route to a person.
What most owners fear here is scaring the caller off. The data doesn't back that fear up. We dug into this before: 80% of callers can no longer tell whether they're talking to an AI, which is precisely why disclosure has become necessary — and, oddly enough, it barely moves call completion rates. What loses customers is finding out afterward.
One detail that matters more than it looks: disclosure has to land before the first question that collects personal information. An agent that asks "can I get your name and date of birth?" and mentions it's an AI two minutes later has already collected without meaningful consent.
Les six premieres secondes: nom de l entreprise, mention IA, sortie vers un humain
Step 2 — Settle recording before the first word
This is where deployments go wrong most often. "I'm an AI" and "this call is being recorded" are two separate obligations, and the second one is heavier.
An AI voice agent produces three artifacts: audio, transcript, and a structured summary. All three are personal information the moment they contain a name, a number, or a reason for calling. Canadian privacy law — federal or provincial — requires the caller to know they're being collected, for what purpose, and by whom.
The practical fix costs you one extra second of audio: "This call is transcribed so we can follow up on your file." Then an architecture decision most vendors dodge: are you keeping raw audio at all? In the majority of deployments we build, the answer is no. The transcript covers the follow-up need, it's less sensitive than the recording, and it shrinks your exposure. A voiceprint is biometric data. Text isn't.
We laid out the questions worth asking a vendor in our guide to the privacy questions to ask before choosing an AI voice agent. The most revealing one is also the simplest: where do the transcription servers physically sit, and under whose jurisdiction? For a business in Calgary or Halifax routing calls through a US-hosted speech stack, that answer belongs in your privacy notice.
Step 3 — Build the human escape hatch
Disclosure without a way out is half a disclosure. If the caller learns they're talking to an AI but can't do anything about it, you've ticked a box without fixing the problem.
Three mechanisms to configure — and test them by calling your own line:
- The keyword — "speak to someone," "a human," "an agent" should trigger an immediate transfer, no negotiation. No "I'm sure I can help you first."
- The failure threshold — two consecutive misunderstandings and the agent hands off. An AI that asks the same question three times does more damage than voicemail.
- The emotional trigger — a caller who raises their voice or uses distress language leaves the script.
We mapped these situations in the 6 moments an AI voice agent should hand the call to a human. The principle: a transfer isn't the technology failing. It's what makes the technology defensible.
Step 4 — Check whether your agent is making an "automated decision"
Almost everyone skips this step, and it's the most interesting one legally.
Since 22 September 2023, section 12.1 of Quebec's Law 25 has imposed three duties whenever a decision about a person is based exclusively on automated processing of their personal information: tell them the decision was automated, explain it on request, and let them submit observations to a staff member able to review it. No other Canadian jurisdiction has an equivalent in force — which means a business in Toronto or Vancouver taking calls from Quebec residents inherits the strictest rule in the country by default.
The word doing all the work is "exclusively." So ask the honest question: does your voice agent decide anything?
Booking into an open slot: no, that's execution. Taking a message: no. But an agent that declines a booking based on eligibility criteria, that triages an emergency into priority 1 versus priority 3, that qualifies or disqualifies a lead before a human ever sees it? Now you're in scope. A triage step that routes a caller to "callback within 48 hours" instead of the on-call tech is a decision with real consequences.
The fix isn't to strip the feature out. It's to insert a genuine human review — a staff member who looks at the classification and can change it — or to add the notice and a contest channel. Law 25 penalties run to $10 million in administrative monetary penalties and $25 million in penal fines. For a small business the realistic risk isn't a maximum fine; it's a complaint that surfaces the fact that no review channel exists at all.
Step 5 — Get the language right, then document it
Disclosure has to happen in the language of the conversation. That sounds obvious until you look at how Canadian phone lines actually work.
A clinic in Ottawa answers in English and French. A property manager in Surrey or Brampton fields calls in Punjabi and Mandarin. A contractor in Winnipeg gets Tagalog. If your agent switches languages mid-call — and modern ones do it well — the disclosure has to have happened already, in the language the caller started in. It cannot be English-only on a line that advertises service in six languages.
The common failure is translation drift. The English disclosure is flawless; the French or Punjabi version was machine-translated into something that says "automated assistant" and never says "artificial intelligence." Compliance evaporates at the translation layer. Have a fluent human read every version out loud.
Then document it. One page does the job: the exact disclosure text in each language, the go-live date, who approved it, and a log of human transfers. If a privacy commissioner ever asks, that page is your answer. Without it you're arguing from memory.
Executer un rendez-vous ou rendre une decision automatisee: la difference qui declenche l article 12.1
The mistakes that actually cost money
Roughly half the deployments we take over contain at least one of these.
A human first name with no "AI" anywhere. "Hi, this is Sophie" and nothing else is the riskiest configuration there is, because a name is an implied representation. Keep the name — callers respond well to it — as long as the next clause says what Sophie is.
Disclosure buried in the hold message. Callers routed straight through never hear it.
Relying on the website. An "this site uses AI" banner doesn't cover a phone call. Disclosure has to travel in the same channel as the interaction.
Varying disclosure by call type. Announcing the AI on service calls but not on sales calls is precisely the pattern misleading-practice rules exist to catch.
Outsourcing compliance to the vendor and never checking. It's your business answering the phone, not theirs. Call your own line once a month. Two minutes, and it beats any audit.
What disclosure actually does to your calls
Here's the part the legal write-ups never mention: done well, disclosure makes the calls better.
A caller who knows they're talking to an AI changes how they speak. They structure. They give a phone number as one clean block instead of burying it in a sentence. They ask one thing at a time. Comprehension goes up, not down. And the caller who genuinely wants a person asks in the first ten seconds instead of the third minute — which is where the expensive frustration usually happens.
There's a commercial effect too. Saying "we use AI, and here's how we protect your information" is now a differentiator against competitors who say nothing at all. We've watched it work on clinic and professional-services lines across the country: transparency clears the objection before the caller has to raise it.
Frequently asked questions
Is it illegal in Canada not to say it's an AI?
There's no single offence called "failure to disclose AI." But skipping it exposes you on three fronts at once: consent that isn't meaningful under PIPEDA or a provincial equivalent, identification at the outset under CRTC rules for automated messages, and misleading practice under provincial consumer protection law. It's an accumulation of risk, not one box.
Can I give my AI voice agent a human name?
Yes. A name makes the exchange feel natural and nothing prohibits it. The problem is a name without the AI mention in the same greeting. "This is Sophie, the clinic's virtual assistant — an artificial intelligence" is perfectly defensible.
What if my agent only takes messages?
Disclosure is still required, because the caller is handing over personal information. But the automated-decision rule doesn't apply: taking a message isn't rendering a decision. Your obligations are lighter, not absent.
Does the EU AI Act apply to a Canadian business?
Only if you offer the service to people located in the EU, or the system's output is used there. A dental clinic in Edmonton serving Edmonton patients is out of scope. A professional-services firm with clients in Germany should look hard at the 2 August 2026 date.
How long does compliance take to set up?
The technical configuration — greeting, recording notice, transfer keywords — takes about thirty minutes. The automated-decision analysis and the documentation page take half a day the first time. That's substantially less than the time you'll spend writing the agent's actual conversation scripts.
Conclusion
"Does my AI voice agent have to say it's an AI?" has a simple answer and a useful one. Simple: yes. Useful: say it in the first six seconds, in the caller's language, using the words "artificial intelligence," with a real route to a human, and write it down on one page.
This isn't a burden to absorb. It's what lets you put software on your main line without crossing your fingers every time it rings.
At Agent IA Vocal, disclosure, recording consent and transfer rules are part of the standard build — our team configures them with you; it isn't a self-serve product. Book 15 minutes to hear what a compliant greeting sounds like, or see our plans starting at $49/month.