Is an AI phone agent legal in Germany? GDPR, § 201 StGB and AI Act Article 50
GUIDE · GERMAN LAW · 12 MIN
Facts on this page verified August 2026.
The short answer: yes, with three conditions, and a fourth if it dials out
Yes. An AI agent may answer your phone in Germany, and thousands of German practitioners already run one. Three conditions attach. The caller has to be told they are speaking to a machine, at the latest in the first turn. Recording needs the caller's active consent, because recording without it is criminal law and not a fine. And the data needs a lawful basis, a stated retention period and a deletion that actually runs. A fourth condition applies only if the agent calls out instead of picking up: advertising calls placed by an automatic calling machine need prior express consent from the person being called.
Condition one: the caller has to be told, and "obvious" will not save you
The rule has been in force since 2 August 2026 and it is short. Article 50(1) of the AI Act requires that systems intended to interact directly with natural persons are built so that those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances. Article 50(5) adds the timing and the manner: clearly and distinguishably, at the latest at the time of the first interaction. Article 113 is what makes 2 August 2026 the date.
The exemption is the part that gets misread, in one direction. A synthetic voice good enough to book an appointment is a voice good enough to be mistaken for a person, and the European Commission has said in its own Article 50 material that the exemption should be read restrictively. Treat "obvious" as something you can demonstrate rather than something you assume. On a telephone call there is nothing to look at, no interface, no label, and no second chance: the only thing carrying the disclosure is the first sentence.
Now the part almost every vendor page gets wrong. Article 50(1) binds the provider, not the deployer, which is why suppliers tell buyers not to worry about it. Read the definition before you accept that. Article 3(3) calls a person a provider if they have an AI system developed and put it into service under their own name or trademark. A practice that commissions an agent, names it after the practice and answers its own main line with it is inside that wording, whoever wrote the code. The safe reading is that the duty is yours as well as your supplier's, and it costs one sentence to satisfy.
Condition two: recording is criminal law before it is data protection
This is the condition that people underestimate, and the order of the rules is the reason. German firms tend to think about call recording as a data-protection question with a fine at the end of it. In Germany it is first a criminal one. § 201(1) StGB punishes anyone who, without authorisation, records the non-publicly spoken word of another on a sound carrier, with up to three years imprisonment or a fine. Paragraph 4 makes the attempt punishable. The person exposed is a named human being, not the company.
The word doing the work is "without authorisation". Consent is what supplies the authorisation, and the German data-protection authorities have said what consent has to look like on a telephone line. The Datenschutzkonferenz decided in March 2018 that recording calls is as a rule only permissible with the consent of the external party too, that the caller must be asked before the recording begins, and that agreement has to be expressed unambiguously, for example by pressing a telephone key. The same decision says in terms that merely offering a chance to object and then carrying on with the call is not valid consent.
So the announcement everyone has heard is the thing that fails. "This call may be recorded for quality purposes" is a notice, not a request. It gives the caller nothing to press and no moment to decline, and under Article 7(1) of the GDPR you also have to be able to prove afterwards that consent was given. An announcement leaves you nothing to produce.
Condition three: a lawful basis, a retention period, and a deletion that happens
Everything the agent hears is personal data, including the things nobody meant to say. A caller's name, number, appointment and reason for calling are personal data whether they sit in audio or in text. That means a lawful basis under Article 6 before processing starts, and it means telling the caller under Article 13. Article 13(2)(a) is specific: you owe them the period for which the data will be stored or, if that cannot be given, the criteria used to determine it.
The law names no number, and neither does the guidance. Article 5(1)(e) of the GDPR says personal data may be kept in identifiable form no longer than is necessary for the purposes it is processed for. That is a test, not a duration. The 2018 DSK decision, which people often expect to settle this, is a single page and sets no retention period at all. So the number is yours to choose and yours to defend, which means writing it down and building the deletion job at the same time as the agent, not after the first audit letter.
The European Data Protection Board adds one obligation that voice systems create and text systems do not. Its guidelines on virtual voice assistants were written for consumer devices rather than business telephony, so the examples do not transfer, but two principles do. A controller has to define and enforce a retention policy rather than letting storage decide it. And where a voice system accidentally captures personal data it did not need, the controller has to check whether there is a lawful basis for each purpose and delete it where there is not.
Where the data physically sits is a contract question, and it is worth asking early. Model providers, telephony carriers and the agent platform are usually three different companies in three different places. Ask which of them processes the audio, which of them stores it, where, and under what processor terms. A supplier who cannot draw that diagram on request has not thought about it, and you will be the one answering for it.
The fourth condition, which only bites if the agent dials out
Answering a call and making one are not the same legal act, and the gap is wide. § 7(2) UWG treats two things as always an unreasonable nuisance. Number 1: advertising by telephone call to a consumer without their prior express consent, or to another business without at least their presumed consent. Number 2: advertising using an automatic calling machine, a fax machine or electronic mail without the addressee's prior express consent. Number 2 has no business exemption at all.
An AI outbound dialler is the thing number 2 describes. If a machine places the call and speaks the pitch, the honest reading is that you are inside that provision and you need prior express consent from everyone on the list, business or consumer. That does not stop an agent ringing a patient to confirm an appointment they asked for, because a service call about an existing booking is not advertising. It does stop the campaign somebody will eventually propose to you.
What each rule requires, by the thing you actually want to do
Statutes are organised for lawyers. This table is organised for whoever has to configure the thing. Read down the left column until you find what you are trying to do, then read across. The last column is the failure mode we see most often, not a hypothetical.
| What you want to do | Which rule bites | What it requires | What fails it |
|---|---|---|---|
| Let an agent answer inbound calls | AI Act Art. 50(1) and 50(5), applying since 2 August 2026 | The caller is told it is an AI system, clearly, at the latest at the first interaction. | A human-sounding voice that never says what it is, or a disclosure that only exists on your website. |
| Record the audio | § 201 StGB first, then GDPR Art. 6 and Art. 7 | Every party agrees before recording starts, by an active step, and you can prove it later. | "This call may be recorded" as an announcement with nothing to press and no way to decline. |
| Keep a transcript rather than audio | GDPR Art. 5(1)(e) and Art. 13(2)(a) | A named purpose, a retention period you can state to the caller, and a deletion job that runs. | Transcripts kept because storage is cheap, with no stated period and nobody deleting anything. |
| Let the agent place calls | § 7(2) numbers 1 and 2 UWG | Prior express consent from the person being called, before an automatic calling machine dials at all. | A campaign to a bought list, or to lapsed customers who never agreed to be called by a machine. |
| Let it take clinical or legal substance | GDPR Art. 9 and professional confidentiality duties | Either do not collect it, or treat it as special-category data with everything that follows. | Symptom questions in the intake script because the agent was capable of asking them. |
| Run it under your own name | AI Act Art. 3(3), the provider definition | Read the definition before assuming your supplier carries the duty on their own. | Assuming you are only a deployer because you did not write the code. |
What all of this forces at build time
Compliance on a phone agent is six configuration decisions, and every one of them is made before go-live or not at all. None of them is expensive. All of them are close to impossible to retrofit once a few thousand calls have gone through, which is the real argument for settling them in week one.
- The disclosure sentence is written into the first turn and cannot be switched off. Not a setting, not a toggle in an admin panel somebody will find later. If the agent speaks, that sentence has already been said.
- Recording is off, and the default artefact is a structured transcript. Fields, not prose: name, number, intent, slot, outcome. It is smaller, more useful to a human reading it on Monday, and it keeps § 201 StGB out of the conversation entirely.
- Retention is a number chosen with the client and written on the build sheet. The deletion job is built in the same week as the agent and tested with a real record. A retention policy that exists only in the privacy notice is not a retention policy.
- The handover rule is written before launch, not discovered after it. Anger, clinical or legal substance, anything outside the agent's list, and any caller who asks for a person. The transfer carries what has already been collected so nobody has to repeat themselves.
- Outbound is disabled unless there is a documented consent basis for the specific list. Confirming an appointment the patient booked is a service call. Everything else waits for a lawyer's sign-off that we do not give.
- The processor chain is written down: telephony, model, storage, and where each one sits. One page, given to the client at handover, so the answer to a supervisory authority's first question already exists in a drawer.
It is worth saying that none of this is experimental in German healthcare. The most conservative room in this argument is a medical practice, and the practices got there first.
16,000 practitioners · ~3M calls a month
What we build sits inside those six decisions rather than beside them. The Customer Facing Agent answers in seconds, says what it is in the first sentence, books into your own calendar rules, keeps a transcript rather than a recording, and routes anything sensitive to a person with the context attached. If you want the money question rather than the legal one first, the missed-call calculator prices the leak the agent is supposed to close.