Introduction
Picture this scenario: your AI voice agent is in the middle of a great call with an anxious patient who asks a medical question. The agent, trying to be helpful, gives advice the front desk would never have given. Three weeks later, your clinic receives a privacy complaint.
This is exactly the kind of incident ElevenLabs is trying to eliminate with Guardrails 2.0, its new control layer rolled out between March and May 2026.
The change is not cosmetic. According to the official ElevenLabs announcement, Guardrails 2.0 adds four independent layers of protection that run in real time, during the call, to block problematic responses before they reach the customer. For a Quebec SME bound by Law 25, this is the safety net that was missing until now.
The context: why AI voice agents kept going off-script in production
Before Guardrails 2.0, the safety of an AI voice agent rested almost entirely on the quality of its system prompt. You wrote 'never give medical advice', tested a few scenarios, and crossed your fingers.
The problem: conversational models are non-deterministic. In a long conversation, the agent can drift. A customer can phrase an unexpected request that sidesteps the instructions. And even a well-defined policy doesn't always hold when the model is under pressure.
Gartner has quantified the impact. According to 2026 projections published by Atlan, more than 2,000 AI-related legal claims will be filed by year-end, mostly because of insufficient guardrails. That is the context in which ElevenLabs redesigned its control layer.
Data point 1: Three independent enforcement layers, not a single filter
The first thing to understand is the architecture. Guardrails 2.0 is not a filter. It is three layers that reinforce one another.
The first layer hardens the system prompt with a Focus Guardrail that reminds the agent of its limits throughout the conversation. The second layer validates what the user says, blocking prompt injection and manipulation attempts. The third layer evaluates every agent reply before it is spoken.
This layered logic changes the risk posture. Before, a single point of failure in the system prompt could let a problematic response slip through. Now, all three layers would have to fail at the same time.
Data point 2: Four prebuilt guardrail types
ElevenLabs ships Guardrails 2.0 with four prebuilt protection types. Each targets a distinct risk.
Focus Guardrail keeps the agent inside the system prompt's perimeter. Useful for long or complex conversations where the drift risk is high. Manipulation Guardrail detects jailbreak attempts and can terminate the call if the conversation becomes a security risk. Content Guardrail filters sensitive categories with tunable thresholds: sexual, violence, harassment, self-harm, profanity, religion/politics, medical/legal. And Custom Guardrails let you define your own policies in natural language.
For a Quebec SME, this last category is the game-changer. You can say 'the agent never discusses specific pricing', 'the agent never confirms insurance coverage', 'the agent never offers a diagnosis' — and a lightweight model evaluates every response against that rule, running independently and in parallel with response generation.
Data point 3: Four exit strategies when a guardrail fires
Blocking a bad response is one thing. But what happens next? Does the call cut off abruptly? Does the agent fall silent?
ElevenLabs defined four exit strategies: end the conversation, transfer to a different agent, escalate to a human, or retry the response with corrective instructions. You pick the strategy per guardrail type.
The customer experience becomes configurable rather than reactive. A call drifting toward a medical question can be transferred gracefully to the human receptionist instead of cut off. A call where someone is trying to jailbreak the agent can be terminated cleanly. For implementation details, you can review our analysis of the SDK v2.47 locks that lay the technical foundation for this layer.
Data point 4: Execution modes — trading latency against safety
This is where the engineering gets interesting for a voice agent. In text, you can wait an extra 200 ms to validate a response. In voice, that is an eternity.
Guardrails 2.0 offers two execution modes. Parallel mode runs the guardrail at the same time as response generation: latency is near-zero, but a fraction of a second of audio may play before interception. Blocking mode holds responses until the guardrail clears them: slightly slower, but nothing reaches the customer unchecked.
For most SME use cases — appointment booking, qualification, first-level troubleshooting — parallel mode is sufficient. For high-risk cases like medical or financial questions, blocking mode is worth the extra few hundred milliseconds. This is a decision to make per use case, not per agent.
Why Law 25 changes the math for Quebec
Europe's GDPR gets most of the press, but Quebec's Law 25 has been in force since September 2023 and the penalties are real. For an SME, we are talking about fines of up to 25 million dollars or 4 % of worldwide revenue, whichever is higher.
An AI voice agent that mistakenly discloses personal information — a patient file number, an insurance coverage detail, an informal diagnosis — falls directly inside the scope of Law 25. The conversation is recorded, the customer can request access to their data, and the Commissioner can investigate.
Before Guardrails 2.0, the legal posture of an SME deploying a voice agent was fragile: 'we configured the system prompt properly'. After Guardrails 2.0, the posture becomes defensible: 'we have four independent layers blocking problematic responses, with a full log of every trigger'. This shift is documented in our analysis of the 7 mistakes that derail a Quebec deployment, where the compliance layer sits at the top of the list.
What this actually means for your Quebec SME
If you already have an AI voice agent in production, three actions to take now.
Action one: turn on the prebuilt guardrails in your agent's Security tab. Focus and Content should be on in almost every case. Manipulation is essential the moment your agent is publicly reachable by phone. Configuration takes under an hour.
Action two: define 2 to 4 Custom Guardrails specific to your industry. For a clinic: 'never give medical advice, always direct to a professional'. For an insurance broker: 'never confirm coverage without verification'. For retail: 'never promise a price without checking the system'.
Action three: configure the exit strategies. For critical cases, human escalation. For jailbreak attempts, termination. For minor ambiguities, retry with corrective instructions. This step requires thinking about real-world scenarios — which is where an integration partner like TECHMA adds value, because the decisions are made with operations managers, not developers.
The market signal: ElevenLabs, AIUC-1 and agent insurance
Guardrails 2.0 does not ship in a vacuum. ElevenLabs has positioned it as the foundation of its eligibility for AIUC-1 certification and the industry's first AI agent insurance policy.
That is a signal for the entire market. According to a recent AssemblyAI analysis, organizations that implement a full guardrails layer see data breach costs an average of $1.76M lower. Insurers are starting to reflect that delta in their premiums.
For a Quebec SME, the implication is concrete: deploying an AI voice agent without a guardrails layer is going to get progressively more expensive — either in insurance or in legal risk absorbed directly. The math has changed.
How TECHMA configures Guardrails 2.0 for our clients
At Agent IA Vocal, we now integrate the Guardrails 2.0 layer into every new ElevenLabs deployment, and we offer a free upgrade for existing clients.
The process takes two weeks on average. Week 1: industry-specific risk audit, identification of the necessary Custom Guardrails, definition of exit strategies. Week 2: configuration, regression testing on real calls, threshold tuning, training your team on the analytics dashboard where every trigger is logged. Weekly maintenance then follows our 12-minute Monday ritual, where the weekend's guardrail triggers are reviewed.
No work on your end beyond the policy decisions. The entire integration and ongoing maintenance is handled by the TECHMA team — that is the model we apply to every deployment. Book 20 minutes so we can review your current configuration together, or explore our plans starting at $49/month.
FAQ
Is Guardrails 2.0 free for existing ElevenLabs customers? The prebuilt guardrails are available across all Agents plans. Conversation history redaction and Zero Retention Mode are reserved for enterprise clients.
How much latency does blocking mode add? ElevenLabs has not published an official figure, but our internal tests on real calls show a 150 to 400 ms increase depending on guardrail complexity. Acceptable for most cases, perceptible but tolerable for the others.
Can Guardrails 2.0 be combined with another voice vendor? No. Guardrails 2.0 is integrated into the ElevenLabs Agents pipeline. If your stack uses VAPI, Retell, or Bland, you have to implement an equivalent layer yourself.
Do the guardrails work in Quebec French? Yes. Content detection and Custom Guardrails are multilingual. Custom Guardrails written in French are evaluated directly in French, with no translation model in between.
How do I know if a guardrail fired during a real call? Every trigger is logged in the analytics dashboard with the guardrail type, the reason, and the action taken. You can also configure email alerts for critical triggers.