Is it legal to use AI voice agents in Australia?

There is no single 'AI calling law' in Australia. What governs an AI voice agent is the same stack that governs a human making the same call, plus the Australian Consumer Law sitting over the top of how you represent yourself. Five instruments do most of the work.

One distinction trips people up regularly: the Spam Act 2003 governs commercial electronic messages — email, SMS, instant messages — not voice calls. If your AI agent follows up by SMS, that follow-up is Spam Act territory and needs consent, sender identification and a working unsubscribe. The call itself is Do Not Call Register territory. Most AI calling programmes do both, so both apply.

As at August 2026, no Australian statute specifically requires you to disclose that a caller is an AI. The federal government's Voluntary AI Safety Standard, published in 2024, includes transparency guardrails, and mandatory guardrails for high-risk AI have been under consultation — but voluntary standards are not law, and this area is moving. Check the current position before you rely on it.

That is not the same as being free to pretend. Section 18 of the Australian Consumer Law prohibits conduct in trade or commerce that is misleading or deceptive, or likely to mislead. An AI agent that is asked directly whether it is a person and says yes is a much easier misleading-conduct case than most. The gap between 'not specifically required to disclose' and 'safe to actively deny' is where the risk sits.

CallableAI's position is to disclose by default: AI Voice Agents introduce themselves as an AI assistant calling on behalf of the business. That is partly compliance and partly evidence — in our own measurement, disclosure does not cost you the conversation. Across 102,154 genuine conversations over 30 days, 253 callers questioned whether they were speaking to an AI: about one in 400. The method, exclusions and caveats are on the proof page.

1. Wash every outbound list against the Do Not Call Register, and re-wash on a schedule rather than once at import.
2. Confirm whether an exemption or a record of consent covers each list — existing-customer relationships and consent are treated differently from cold lists.
3. Constrain calling hours in the platform, not in a document: weekdays 9am–8pm, Saturdays 9am–5pm, nothing on Sundays or public holidays.
4. Script the opening so the agent identifies itself, the business it is calling for, and the purpose of the call, before anything else.
5. Announce recording at the start of every call, inbound and outbound, rather than trying to track consent rules state by state.
6. Make 'stop calling me' a hard stop — honoured mid-sentence, recorded against the contact, and suppressed across every future campaign.
7. Update your privacy policy and collection notice to cover recordings, transcripts and any AI processing, including where data is stored and processed.
8. Decide your disclosure position and write it into the brief, so it is consistent across every AI Voice Agent and every campaign.

• Can the platform enforce calling-hour windows and public holidays automatically, per state?
• Does it support Do Not Call Register washing, and how often is a list re-washed?
• Is a do-not-contact request honoured across every campaign, or only the one it was made on?
• Where are recordings and transcripts stored and processed — onshore or offshore?
• Can you set the disclosure line, and can the agent answer 'are you a robot?' honestly and consistently?
• What happens when a caller asks for a human? Is there a real warm transfer, or does the call end?

The last two matter more than they look. Plenty of platforms will happily let an agent dodge the question, and plenty have no human to hand off to. Both are compliance problems dressed up as product gaps.