Compliance

Operating a voice or SMS communication platform comes with regulatory responsibilities that vary widely by country, industry, and use case. This page is an awareness reference for PulsyAI users — covering the major regulations and core principles that apply when you deploy AI voice or SMS agents.

​

PulsyAI’s role vs your role

When you use PulsyAI to place phone calls, send SMS messages, or operate AI assistants, legal responsibility is split clearly:

• PulsyAI provides the platform infrastructure — telephony routing, AI conversation capabilities, integrations, white-label tooling, and the dashboard you use to configure your agents.
• You (the user or reseller) are the legal “caller” and “sender” under telecom and consumer protection laws. You are responsible for the content of your scripts and messages, obtaining and documenting recipient consent, maintaining opt-out lists, respecting calling hours, and complying with every applicable regulation in every jurisdiction where you contact recipients.
• Your end-clients (if you operate as a PulsyAI reseller) are similarly responsible for their own usage. Your reseller agreement with each end-client should explicitly require their compliance with applicable laws and indemnify you against violations.

This responsibility split is the industry-standard model for communication platforms — the infrastructure provider is not the regulated party; the user is.

​

Core compliance concepts

The principles below apply broadly across most telecom and consumer protection regulations worldwide. They are starting points to understand, not exhaustive requirements for any specific jurisdiction.

​

Consent

Most jurisdictions require some form of consent before contacting recipients with automated voice calls or SMS, especially for marketing or commercial purposes. Common consent types include:

• Prior Express Written Consent (PEWC) — Required in the United States under the TCPA for marketing calls and texts. Requires a signed agreement (electronic signatures qualify) with clear disclosure that the recipient agrees to receive automated communications, that consent is not a condition of purchase, and identification of the calling party.
• Prior Express Consent (PEC) — Required in the United States under the TCPA for non-marketing automated calls. Less formal than PEWC but still requires an affirmative opt-in.
• Express Consent — Required under Canada’s CASL and the EU’s GDPR. Requires an affirmative, documented opt-in.
• Implied Consent — Available in some jurisdictions under specific conditions (such as an existing business relationship or voluntary publication of a phone number).

Pre-checked boxes and bundled consents (where opting in is required to access an unrelated service) generally do not qualify as valid consent.

​

Do-Not-Call and Do-Not-Text lists

Most jurisdictions maintain national registries of phone numbers that have opted out of telemarketing. Before launching any outbound campaign, scrub your contact list against the relevant national registries — and maintain your own internal opt-out list of recipients who have specifically asked you to stop contacting them. Internal opt-outs apply across all channels and all campaigns, not just the one the recipient opted out from.

​

Calling and messaging hours

Calls and texts are restricted to specific local time windows in many jurisdictions. The most cited standard is the United States TCPA, which permits calls only between 8:00 AM and 9:00 PM in the recipient’s local time zone. Other jurisdictions follow similar principles with their own specific hours — always set your PulsyAI campaign and Auto Call Back time windows to the recipient’s local time, not your own business timezone.

​

Caller and sender identification

In nearly all jurisdictions, you must identify yourself clearly during every call or message:

• The name of your business
• The purpose of the communication
• A clear way to opt out
• For AI-generated calls: increasingly, an explicit disclosure that the recipient is interacting with an AI assistant rather than a human. This is required by the EU AI Act (Article 50) starting August 2026, and by several US states including California.

​

Opt-out mechanisms

Recipients must have a clear way to revoke consent at any time:

• SMS: Honor keyword replies like STOP, UNSUBSCRIBE, QUIT, CANCEL, and END.
• Voice: Provide a clear way during the call to opt out — telephone keypress, verbal statement to a representative, or a follow-up unsubscribe URL.
• Cross-channel: An opt-out from one channel generally applies to all channels for the same campaign or sender.

Opt-out requests must be honored immediately. Delayed processing is a common source of TCPA litigation.

​

Record-keeping

Maintain documented records of:

• The consent each recipient gave — when, how (channel and form), and the exact consent language they agreed to.
• The opt-out requests received and when they were processed.
• The phone numbers on your internal DNC list.
• Your privacy policy and terms of service in effect at the time consent was given.

Retain these records for at least the statute of limitations in your jurisdiction — commonly four to six years, but verify locally.

​

Regional regulations overview

The summary below covers major regulations at a high level. Each entry names the law and points you toward what to research further — it is not a complete description of any single regulation. Always verify current requirements with official sources.

​

United States

• TCPA (Telephone Consumer Protection Act) — Federal law governing automated calls and texts to wireless and residential numbers. Statutory damages run from $500 to$1,500 per violating call or message, with no aggregate cap. Class action exposure is significant.
• TSR (Telemarketing Sales Rule) — Enforced by the FTC. Covers telemarketing practices, do-not-call compliance, abandoned call rates, and required disclosures.
• CAN-SPAM Act — Federal law for commercial email with implications for SMS marketing.
• CTIA Messaging Guidelines — Wireless industry guidelines covering SMS content, frequency, opt-outs, and program registration.
• 10DLC Registration — Mandatory registration with US carriers for application-to-person (A2P) SMS traffic.
• State laws — Several US states including California, Florida, Oklahoma, and Washington have telemarketing or consumer protection rules stricter than federal law.
• CCPA and CPRA (California) — Consumer privacy laws affecting data collected during calls.

​

Canada

• CASL (Canada’s Anti-Spam Legislation) — Covers commercial electronic messages including SMS.
• CRTC Unsolicited Telecommunications Rules — Cover telemarketing, automated dialing devices, and the National Do Not Call List.
• PIPEDA (Personal Information Protection and Electronic Documents Act) — Federal privacy law for personal information handling in commercial activities.

​

United Kingdom

• PECR (Privacy and Electronic Communications Regulations) — Governs marketing calls, SMS, and email.
• TPS (Telephone Preference Service) — National opt-out registry for marketing calls. CTPS is the equivalent for business-to-business calls.
• UK GDPR — Post-Brexit version of the EU GDPR, governing personal data processing.

​

European Union

• GDPR (General Data Protection Regulation) — Governs personal data processing across all member states. Requires informed, explicit consent for marketing communications.
• ePrivacy Directive — Specifically covers electronic communications privacy and direct marketing.
• EU AI Act — From 2026, requires (under Article 50) that users be informed when they are interacting with an AI system.
• Member state laws — Each EU member state has additional implementing rules; verify the specific country where your recipients are located.

​

Australia

• Spam Act 2003 — Covers commercial electronic messages including SMS.
• Do Not Call Register Act 2006 — National opt-out registry for telemarketing operated by ACMA.
• Privacy Act 1988 — Covers personal information handling.

​

Other jurisdictions

If you operate outside the regions above, consult local legal counsel before launching campaigns. Most countries have telecom regulations that mirror the universal principles in the previous section (consent, DNC, hours, identification, opt-out) but with jurisdiction-specific requirements and penalties.

​

For PulsyAI resellers and master partners

If you operate as a PulsyAI reseller or master partner — providing the platform to your own end-clients under your white-label brand — additional compliance considerations apply.

• Your reseller agreement with each end-client should explicitly require their compliance with applicable laws in every jurisdiction they operate, and indemnify you against violations they cause.
• Your end-clients are the legal callers and senders for their own activity on your white-labeled platform. Make this clear in writing in your contracts.
• Maintain internal records of which end-clients operate in which jurisdictions, what features they use, and any compliance acknowledgments they have signed.
• Train your end-clients on basic compliance principles. Many violations come from end-clients who simply did not know the rules. Including a compliance overview in your onboarding flow reduces your exposure significantly.
• Avoid taking custody of recipient lists, consent records, or opt-out lists belonging to your end-clients. Those belong to them and are their responsibility to maintain — your role is to provide the platform, not to manage their data.
• Monitor for abuse — if an end-client is clearly violating laws (sending to non-consented lists, ignoring opt-outs, calling outside permitted hours), you may have a contractual or platform-level obligation to suspend their access regardless of your reseller agreement. Document this process clearly in your terms.

​

Best practices checklist

A starting checklist for any organization using PulsyAI for voice or SMS communications:

• ✅ Document and maintain consent records — store proof of consent for every recipient, including timestamp, channel, and the exact consent language.
• ✅ Capture explicit consent confirmation at end-of-call where appropriate — PulsyAI’s Verify User Information feature can send an SMS recap of what was discussed and what the recipient agreed to, creating a documented audit trail you can retain alongside your other compliance records.
• ✅ Implement opt-out keywords for SMS — recognize STOP, UNSUBSCRIBE, QUIT, CANCEL, and END; honor them immediately and across all channels.
• ✅ Respect calling hours per recipient’s local time — use the Timezone fields in PulsyAI Campaigns and Auto Call Back to align with each recipient’s local hours.
• ✅ Maintain internal DNC and opt-out lists — separate from any national registries, and applied across every campaign and channel.
• ✅ Identify yourself clearly — script your agent to state your business name and purpose at the beginning of every call.
• ✅ Disclose AI interaction where required — multiple jurisdictions (EU AI Act, California, Utah, and others) require explicit AI disclosure of AI-generated voice or chat interactions.
• ✅ Train your team and end-clients on compliance basics — most violations are accidental rather than malicious.
• ✅ Review your scripts and SMS templates regularly for compliance language.
• ✅ Scrub outbound lists against national registries before each campaign.
• ✅ Keep up with regulatory changes — laws shift frequently, especially around AI-generated communications.

​

Next steps

Compliance is a moving target. To stay current:

• Consult qualified legal counsel in every jurisdiction where you operate or contact recipients. This is the single most important step — generic guidance like this page is not a substitute for advice tailored to your specific business.
• Subscribe to official regulatory updates — FCC alerts (US), CRTC bulletins (Canada), ICO updates (UK), EDPB guidance (EU), ACMA notices (Australia).
• Industry associations publish ongoing guidance — CTIA (US wireless), ACA International, and others.
• Review your compliance posture at least quarterly — re-verify your consent processes, opt-out mechanisms, recipient lists, and script language.