AI Voice Agents for Insurance (UK): PECR and the Consumer Duty

In the UK, AI voice agents for insurance can generally make service calls about an existing policy without marketing consent, though UK GDPR still applies. Treat any AI marketing call, such as a quote chase or win-back, as automated under PECR, which needs specific consent to automated calls. The FCA Consumer Duty shapes how every call is spoken.

Key Takeaways

• Service calls about a policy sit outside PECR's marketing rules; UK GDPR still applies.
• Treat an AI marketing call as automated: specific consent comes first.
• Ask whether the customer understood, then test and monitor the script.

This post is part of our guide to AI voice agents for insurance. The guide's section "Calling rules: US, UK and Spanish-speaking callers" gives the UK rule in one line: an AI agent is not a live person, so the safe reading is the automated-call rule, specific consent before the call. Here is that rule in full, the Consumer Duty side, and how to build for both in Dograh, an open-source, self-hostable voice agent platform.

Sort each insurance call: service or marketing

The Privacy and Electronic Communications Regulations (PECR) govern marketing calls, so the first job is to decide whether a call markets anything. The Information Commissioner's Office (ICO) says in its guidance on live calls that the definition of direct marketing "doesn't cover live calls made for administrative or customer service purposes". These are "service messages", and "They don't count as direct marketing if you use them purely for administrative purposes." The same page draws the line that matters for insurers: "However, if you include promotional content within your service call, then the call counts as direct marketing."

So a call that says a premium is due, asks for a missing document, confirms a mid-term change or reads the renewal date and price from the renewal notice is generally a service message. A renewal call that suggests breakdown cover or a higher level of cover is marketing. So are quote chases and win-back calls. AI voice agents for policy renewals shows how to keep a renewal call on the service side.

Service calls still handle personal data, so UK GDPR applies to them. Write the renewal agent's prompt so it reads the notice and records intent, and sends any question about changing cover to a person.

Treat an AI marketing call as automated

PECR has one set of rules for live marketing calls and a stricter set for automated ones, and an AI agent sits between them. The ICO's telephone marketing guidance says the automated-call rules are in regulation 19. It defines an automated marketing call as "a call made by an automated dialling system that plays a recorded message", which you may make only if "the person has specifically consented to receive this type of call from you." It adds: "General consent for marketing, or even consent for live calls, is not enough".

The ICO guidance does not mention AI voices. An AI agent is not a live person, so the safe reading is the automated-call rule: specific consent before the call. The ICO's own enforcement points the same way. In September 2025 it fined two energy companies for automated marketing calls made with avatar software, which played scripted lines recorded by voice actors while callers thought they were talking to a person.

Live marketing calls follow regulation 21: screen every list against the Telephone Preference Service (TPS) and the Corporate TPS, and against your own do-not-call list. If any human-made marketing calls sit alongside the AI agent, that screening still applies to them. AI voice agents for real estate in the UK walks through the same split for estate agents.

The ICO says its guidance "is under review and may be subject to change" after the Data (Use and Access) Act 2025, so these rules may change. This is general information, not legal advice; check with a data protection adviser.

What the opening line must say

Automated calls have identity rules, and the opening line carries them. The ICO says "All automated calls must include your name and a contact address or freephone number", and you must allow your number, or another contact number, to be displayed.

Put the firm's name and the contact number in the Greeting Text, the optional fixed line Dograh speaks word for word as the call connects. If you want to tell callers they're speaking with an automated assistant, or your location requires it by law, write it in the Greeting Text along with the business's name. The greeting plays before the caller is verified, so it never names a policy, a premium or a claim.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

How the Consumer Duty shapes the call

PECR decides whether you may call, and the Financial Conduct Authority (FCA) Consumer Duty decides how the call is spoken. On its Consumer Duty page, the FCA says: "The Duty sets high standards of protection for retail consumers across financial services and requires firms to put their customers' needs first."

The rule text is specific about telephone calls. PRIN 2A.5.9R says that when a firm is interacting with a customer one to one, including "during a telephone conversation", it must, where appropriate, "ask the retail customer whether they understand the information and if they have any further questions". PRIN 2A.5.10R asks firms to "test communications before communicating them to retail customers" and to monitor their impact afterwards.

In the agent, those rules become prompt instructions. Tell it to ask "does that make sense?" after key facts such as the renewal premium or the excess, and to repeat in plainer words when the answer is no. Test the script on real phone calls before launch, then run QA on a random 5 to 10% sample of live calls. QA summaries are in English.

Some callers need a person. Tell the agent in the prompt to hand the call over when a caller mentions a bereavement, illness, money trouble or confusion, or asks which cover to buy. Choosing that path is the model reading its written condition, so check it on transcripts. Advising on and arranging insurance are regulated activities, and the permission sits with your firm, never with the agent. Transfer Call works on Twilio, Telnyx and Asterisk ARI. It passes no summary by default; on Twilio it can play a short spoken introduction to both people. Write the details to your system with an HTTP API tool before the transfer.

Opt-outs, recordings and UK data

Outbound lists run in Campaigns, with calling hours by weekday in one time zone, which suits a UK-only list. Only numbers with the right consent, and screened where needed, should reach the upload.

Dograh keeps no do-not-call list. When a caller opts out, an HTTP API tool writes it to your own list, and you remove those numbers before the next campaign upload. The do_not_call call tag records the request but never blocks a later call.

Recordings and transcripts keep whatever is said, so the call never asks for a full account or card number; use a short check such as the last digits of the policy number, and send payment links by text or email from your own system.

Where the data lives is a UK GDPR question too. To keep recordings and transcripts in the UK, self-host Dograh in a UK data centre. Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose, so run those in the UK as well; bringing your own keys to a hosted provider moves the contract, not the audio. The call audio stays in-house only when the speech and language models run on your own servers too. AI voice agents for hospitals in the UK covers that setup.

Dograh starts every account on its own managed models. To keep call audio away from Dograh, open Models, switch the Organization default to BYOK with your own speech and language providers (or local models), and check that no agent has its own model override. For teams that would rather not run servers, Dograh Cloud handles the security work for you. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee.

Firms that also sell in the US face different rules, set out in AI voice agents for insurance in the US. This post is general information, not legal advice; check with a data protection adviser.