What UK clinics must do when an AI agent answers the phone.

Intentionally intercepting a call in the UK without lawful authority is a crime. A business may record its own calls with the system controller's express consent, for a listed purpose, if it has made all reasonable efforts to tell users that calls may be intercepted. The rule asks for reasonable efforts to inform, not caller consent. Whether a cloud phone line counts as a private system is unsettled.

For an AI agent: open each call with a recorded notice that calls may be recorded, record only for a stated business purpose, and treat voice recognition used to identify callers as special category data needing its own conditions.

• UK Parliament: Investigatory Powers Act 2016, section 3(1) (2018-06-27)“the interception is carried out in the United Kingdom, and (c) the person does not have lawful authority to carry out the interception”
• Home Office: Business interception regulations 2018, reg 3(1)(a)“it consists of the interception of a communication, in the course of its transmission by means of a telecommunication system, which is effected by or with the express consent of the system controller”
• Home Office: Business interception regulations 2018, reg 4(1)(c)“the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted”
• ICO: Biometric recognition“If you are using a biometric recognition system, you are processing special category biometric data.”

We found no UK law or regulator rule that requires a business to tell callers the voice is AI. Data protection law asks for information about who is collecting data and why, at the time of collection, and consumer law bars misleading information. Neither mentions AI. Whether consumer law reaches a patient booking call is a legal question the source does not answer.

For an AI agent: we found nothing that requires it to say it is AI, but callers must still get the data protection information and must not be misled.

• Our search (2026-11-14): No UK rule found requiring disclosure that a caller is speaking to AI
• UK Parliament: UK GDPR, Article 13(1)“the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information”
• UK Parliament: Digital Markets, Competition and Consumers Act 2024, section 226 (2025-04-06)“the provision of false or misleading information relating to a product, a trader or any other matter relevant to a transactional decision”

Automated marketing calls need the line subscriber's earlier consent to such calls. Whether an AI voice counts as automated is unsettled; if not, live-call rules apply: no unsolicited marketing calls to numbers on the Telephone Preference Service register or to people who objected. Every marketing call must show its number or a contact line. Marketing texts to individuals need consent or a narrow soft opt-in; companies are treated differently.

For an AI agent: collect consent to automated calls before any outbound marketing call, show a number on every marketing call, and keep reminder texts purely administrative, because promotion turns a reminder into marketing.

• UK Government: Privacy and Electronic Communications Regulations 2003, reg 19(1)“A person shall neither transmit, nor instigate the transmission of, communications comprising recorded matter for direct marketing purposes by means of an automated calling”
• UK Government: PECR, regulation 21(1) (unsolicited live marketing calls)“A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where”
• UK Government: PECR, regulation 21(A1) (calling line identity)“does not prevent presentation of the identity of the calling line on the called line”
• UK Government: Privacy and Electronic Communications Regulations 2003, reg 22(2)“unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender”
• ICO: Electronic mail marketing“You must not send marketing emails or texts to individuals without specific consent.”
• ICO: Mixed service and marketing messages“If your service message has elements that are direct marketing, even if that is not the main purpose of your message, then it will count as direct marketing.”

A processor (a vendor handling data for you) must be bound by a written contract to act only on documented instructions from the controller, usually the clinic. Sending data abroad needs an approved route, and we found no rule that data must stay in the UK. A breach must be reported within 72 hours of becoming aware, where feasible, unless it is unlikely to risk people's rights.

For an AI agent: the clinic needs a vendor contract, a record of where the vendor sends data, and a way to report a breach within 72 hours where feasible.

• UK Parliament: UK GDPR, Article 28(3)(a)“processes the personal data only on documented instructions from the controller”
• UK Parliament: UK GDPR, Article 44A(1)“A controller or processor may transfer personal data to a third country or an international organisation only if”
• Our search (2026-11-14): No UK rule found requiring caller data to be stored only in the UK
• UK Parliament: UK GDPR, Article 33(1)“the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to”

Since 5 February 2026, a significant decision taken with no meaningful human involvement is restricted. If it uses health data it is barred unless a listed condition applies, and people must be able to get human intervention. Fines can reach 17,500,000 pounds or 4 per cent of worldwide turnover, whichever is higher. ICO guidance, not law, says to tell job candidates how an AI tool uses their data.

For an AI agent: if it refuses care or decides who is seen with no person involved, these rules may apply; the sources do not say whether booking or triage decisions count as significant.

• UK Parliament: UK GDPR, Article 22A(1) (2026-02-05)“a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision”
• UK Parliament: UK GDPR, Article 22B(1)“A significant decision based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on automated processing, unless one of the following conditions is met.”
• UK Parliament: UK GDPR, Article 22C(2)“enable the data subject to obtain human intervention on the part of the controller in relation to such decisions”
• UK Parliament: UK GDPR, Article 83(5)“or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”
• ICO: AI and recruitment“You must ensure that you inform candidates how an AI tool will process their personal information.”

Health data is special category data: processing is banned unless an Article 9 condition applies and a lawful basis exists. One condition covers medical diagnosis, health or social care and managing health services, with professional secrecy safeguards, which are met where processing is under a health professional's responsibility. Registered dentists are listed as health professionals. Which body registers the clinic differs by nation.

For an AI agent: health details it collects sit under these special category rules, so collect them for the booking or care purposes the health care condition covers.

• UK Parliament: UK GDPR, Article 9(1)“biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited”
• UK Parliament: UK GDPR, Article 9(2)(h)“medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”
• UK Parliament: Data Protection Act 2018, section 11(1)“by or under the responsibility of a health professional or a social work professional”
• UK Parliament: Data Protection Act 2018, section 204(1)(c)“a registered dentist within the meaning of the Dentists Act 1984 (see section 53 of that Act)”

These are professional standards and guidance, not AI law. The General Dental Council says a task can be delegated but not the accountability. GMC learning material says doctors are responsible for decisions they take when using AI, and GMC guidance says patient information must be protected against improper access, disclosure or loss. We found no UK-wide rule on mental capacity, which differs by nation.

For an AI agent: handing a call task to an agent does not move the professional's accountability to the vendor; on our reading, making sure valid consent is in place stays with the registrant.

• General Dental Council: Standards for the dental team, 6.3.1“You can delegate the responsibility for a task but not the accountability.”
• General Medical Council: GMC: AI and innovative technologies (learning material)“Doctors, physician associates and anaesthesia associates are responsible for the decisions they take when using new technologies like AI, and the principles in our professional standards continue to apply.”
• General Medical Council: GMC confidentiality guidance, paragraph 119“You must make sure any personal information about patients that you hold or control is effectively protected at all times against improper access, disclosure or loss.”
• General Dental Council: Standards for the dental team, 3.1.1“You must make sure you have valid consent before starting any treatment or investigation.”
• Our search (2026-11-14): No UK-wide mental capacity rule found

Personal data may be kept in identifiable form only as long as necessary, and people can ask for a copy of their data, with a limited exemption for some health data. We found no UK-wide fixed retention period; national records codes differ. The MHRA says some AI scribe products are not medical devices but need safe use; that guidance covers Great Britain only and does not name phone agents.

For an AI agent: give call recordings and transcripts a stated retention period and keep them findable for a person's access request.

• UK Parliament: UK GDPR, Article 5(1)(e)“kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”
• UK Parliament: UK GDPR, Article 15(1)“The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed”
• Our search (2026-11-14): No UK-wide retention schedule for dental and health records found
• MHRA: Ambient voice technology products“Some AVT products do not qualify as medical devices, and users in healthcare should carefully consider what information you may need and practices you should follow to deploy and use these products safely in healthcare environments.”

Software meant by its maker for diagnosis, prevention, monitoring or treatment of disease is a medical device in Great Britain; Northern Ireland follows the EU device rules. We found no rule that always requires a human option on an ordinary booking call, though one applies to significant solely automated decisions. Disability law may require adjustments: the Equality Act in England, Wales and Scotland, an older Act in Northern Ireland.

For an AI agent: one that only books and takes messages is aimed at admin, but clinical advice or triage could meet the device test, so offer an easy route to a person.

• UK Government: Medical Devices Regulations 2002, reg 2(1)“any instrument, apparatus, appliance, software, material or other article, whether used alone or in combination”
• Our search (2026-11-14): No UK rule found requiring a human option on an ordinary booking line
• UK Parliament: Equality Act 2010, section 20(3)“puts a disabled person at a substantial disadvantage in relation to a relevant matter in comparison with persons who are not disabled, to take such steps as it is reasonable to have to take to avoid the disadvantage”
• UK Parliament: Disability Discrimination Act 1995, section 21(1)“it is his duty to take such steps as it is reasonable, in all the circumstances of the case, for him to have to take in order to change that practice, policy or procedure”

The General Dental Council's Standards govern each registered dental professional across the UK, and only registered dental professionals can legally provide dental treatment. We found no GDC standard or guidance written for dentists using AI. In September 2026 health regulators, the GDC among them, said they will develop AI principles; that is intent, not a rule. The body that registers the premises differs by nation.

For an AI agent: it may handle admin and booking but cannot provide treatment, and the Standards apply by default because we found no extra AI rule.

• General Dental Council: Standards for the dental team“sets out the standards of conduct, performance and ethics that govern you as a dental professional”
• General Dental Council: GDC standards and guidance: working within the law“only registered dental professionals can legally provide dental treatments”
• Our search (2026-11-14): No General Dental Council guidance written for dentists using AI found
• Professional Standards Authority: PSA: joint statement of intent on regulating AI in healthcare (2026-09-17)“have committed to jointly developing a set of high-level principles to guide how they will regulate the use of artificial intelligence (AI) by health and social care professionals across the UK.”

Audio or visual recordings of consultations form part of the patient record, but whether a recorded booking call is a consultation is unsettled. Registrants must not make recordings or images of patients without permission, and the GDC sets no retention period, telling them to follow national advice. An X-ray needs justification by a registered practitioner; Great Britain and Northern Ireland have separate regulations.

For an AI agent: it can book an X-ray but cannot justify or authorise one, and because it is unsettled whether a recorded booking call falls under the GDC recording standards, the practice should decide how call recordings are handled.

• General Dental Council: Standards for the dental team, 4.1.1“Radiographs, consent forms, photographs, models, audio or visual recordings of consultations, laboratory prescriptions, statements of conformity and referral letters all form part of patients records where they are available.”
• General Dental Council: Standards for the dental team, 4.2.9“You must not make any recordings or images without the patient’s permission.”
• General Dental Council: Standards for the dental team, 4.1.3“You must follow appropriate national advice on retaining, storing and disposing of patient records.”
• UK Government: Ionising Radiation (Medical Exposure) Regulations 2017, reg 11(1) (2018-02-06)“it has been justified by the practitioner as showing a sufficient net benefit giving appropriate weight to the matters set out in paragraph (2); (c) it has been authorised by the practitioner or, where paragraph (5) applies, the operator;”
• Northern Ireland Executive: Ionising Radiation (Medical Exposure) Regulations (Northern Ireland) 2018, reg 11(1)“it has been justified by the practitioner as showing a sufficient net benefit”

The law treats the practice of dentistry as including the kind of treatment and advice dentists usually give, and people who are not registered must not practise or hold themselves out as ready to. Whether an AI agent giving treatment-type advice does either is unsettled. The GDC says suitability for orthodontic treatment needs a full assessment, and that registrants should refer patients on when treatment is outside their scope.

For an AI agent: do not tell a caller a treatment suits them or suggest treatment, and give a clear route to a person for clinical questions.

• UK Parliament: Dentists Act 1984, section 37(1)“the practice of dentistry shall be deemed to include the performance of any such operation and the giving of any such treatment, advice or attendance as is usually performed or given by dentists”
• UK Parliament: Dentists Act 1984, section 38(1)“shall not practise or hold himself out, whether directly or by implication, as practising or as being prepared to practise dentistry.”
• General Dental Council: GDC statement on direct-to-consumer orthodontics“clinical judgements about the suitability of a proposed course of orthodontic treatment must be based on a full assessment of the patient’s oral health.”
• General Dental Council: Standards for the dental team, 6.3.3“You should refer patients on if the treatment required is outside your scope of practice or competence.”

Advertising and other information a dental practice produces must be accurate and not misleading. Publicity must say whether the practice is NHS, mixed or wholly private. Offers on marketing sites must say the treatment may not suit every patient and depends on assessment. CAP advice says advertisers should hold signed and dated proof that before and after photos are genuine.

For an AI agent: what it says about services, results or NHS status is practice information the practice answers for, so keep scripts accurate and conditional on assessment.

• General Dental Council: Standards for the dental team, 1.3.3“You must make sure that any advertising, promotional material or other information that you produce is accurate and not misleading”
• General Dental Council: GDC guidance on advertising: NHS, mixed or private“You must make clear in advertisements and other practice publicity whether the practice is NHS (or equivalent health service), mixed or wholly private.”
• General Dental Council: GDC guidance on advertising: marketing websites“you must make clear that the treatment advertised may not be appropriate for every patient and that it is conditional on a satisfactory assessment being carried out.”
• Advertising Standards Authority and CAP: CAP advice: before and after photos“They should hold signed and dated proof that the photos are genuine and have not been manipulated”

The General Medical Council, the UK-wide regulator of doctors, has guidance for doctors who offer cosmetic interventions; it is guidance, not law. In England, cosmetic surgery by a healthcare professional needs Care Quality Commission registration; this differs by nation. In September 2026 health regulators, the GMC among them, said they will develop principles on regulating AI. We found no Royal College of Surgeons standard on surgeons using AI.

For an AI agent: do not describe anyone as a doctor or surgeon unless true, and keep surgery apart from injectables in what it says.

• General Medical Council: GMC guidance for doctors who offer cosmetic interventions“This guidance came into effect 1 June 2016. It was updated on 13 December 2024 when regulation of physician associates and anaesthesia associates by the GMC came into effect.”
• UK Parliament: Medical Act 1983, section 49(1)“any person who wilfully and falsely pretends to be or takes or uses the name or title of physician, doctor of medicine, licentiate in medicine and surgery, bachelor of medicine, surgeon, general practitioner or apothecary”
• UK Government: Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 1“cosmetic purposes, where the procedure involves the use of instruments or equipment which are inserted into the body”
• Professional Standards Authority: PSA: joint statement of intent on regulating AI in healthcare (2026-09-17)“have committed to jointly developing a set of high-level principles to guide how they will regulate the use of artificial intelligence (AI) by health and social care professionals across the UK.”
• Our search (2026-11-14): No Royal College of Surgeons standard on surgeons using AI found

The advertising code says cosmetic intervention ads must not be directed at under 18s through media choice or context. The Human Medicines Regulations bar advertisements likely to lead to use of a prescription-only medicine, with limited exceptions. GMC guidance says doctors must not use promotional tactics that could encourage an ill-considered decision. CAP advice says to hold signed and dated proof that before and after photos are genuine.

For an AI agent: avoid promoting a prescription-only medicine, aim no cosmetic promotion at under 18s, and share before and after photos only where the clinic holds signed, dated proof.

• Advertising Standards Authority and CAP: CAP Code, rule 12.25“Marketing communications for cosmetic interventions must not be directed at those aged below 18 years through the selection of media or context in which they appear.”
• UK Government: Human Medicines Regulations 2012, reg 284(1)“A person may not publish an advertisement that is likely to lead to the use of a prescription only medicine.”
• General Medical Council: GMC cosmetic interventions guidance: marketing“You must not use promotional tactics in ways that could encourage people to make an ill-considered decision.”
• Advertising Standards Authority and CAP: CAP advice: before and after photos“They should hold signed and dated proof that the photos are genuine and have not been manipulated”

A 2016 Royal College of Surgeons standard, not law, says consent should come in two stages at least two weeks apart, with reasons recorded if not; GMC guidance sets no fixed number of days. Consumers can cancel distance contracts within 14 days for services, but whether a phone-booked surgery contract is one is unsettled. CMA guidance says a genuine deposit, normally small, may be kept if clearly stated.

For an AI agent: it cannot take consent, and what it says about deposits, cancelling and surgery dates should match the clinic's written terms and be left to staff where unsure.

• Royal College of Surgeons of England: Professional Standards for Cosmetic Surgery“Ensure that consent is obtained in a two-stage process with a cooling-off period of at least two weeks between the stages to allow the patient to reflect on the decision.”
• General Medical Council: GMC cosmetic interventions guidance: consent“It is essential to a shared understanding of expectations and limitations that consent to a cosmetic intervention is sought by the medical professional who will perform it, or supervise its performance by another practitioner.”
• UK Government: Consumer Contracts Regulations 2013, reg 29(1)“The consumer may cancel a distance or off-premises contract at any time in the cancellation period without giving any reason”
• Competition and Markets Authority: CMA37: unfair contract terms guidance (2026-07-22)“A genuine deposit may legitimately be kept in full as long as it operates as a binding reservation”

In England, injecting botulinum toxin or cosmetic filler into anyone under 18 is an offence; defences include registered medical practitioners, people acting on their directions and reasonable steps to check age. A business owner commits one if arrangements are made on their behalf for an unapproved person to do it; whether automated booking counts is unsettled. GMC guidance says doctors must physically examine patients before prescribing injectable cosmetic medicines.

For an AI agent: booking such an injection for someone under 18 in England may expose the business owner unless a defence applies, and it must never imply a prescription can follow a call alone.

• UK Parliament: Botulinum Toxin and Cosmetic Fillers (Children) Act 2021, section 1(1) (2021-10-01)“a subcutaneous, submucous or intradermal injection of a filler for a cosmetic purpose, where A is under the age of 18.”
• UK Parliament: Botulinum Toxin and Cosmetic Fillers (Children) Act 2021, section 2(1)(b) (2021-10-01)“arrangements are made, in England, by or on behalf of the business owner, for a person other than an approved person to administer”
• General Medical Council: GMC cosmetic interventions guidance: prescribing“You must carry out a physical examination of patients before prescribing injectable cosmetic medicines. You must not therefore prescribe these medicines by telephone, video link, online or at the request of others for patients you have not examined.”
• Care Quality Commission: CQC: choosing cosmetic surgery“subcutaneous injections of muscle relaxing substances used to alter appearance”

A 2016 Royal College of Surgeons standard says surgeons should ensure aftercare, including out-of-hours care, is available, with clear arrangements for emergency transfer. GMC guidance says doctors must make sure patients know how to contact them or another named qualified person with complications outside normal hours. In England, post-operative care within the regulated surgical activity may include a planned follow-up consultation; further treatment decided there is outside it.

For an AI agent: route emergency words to a person or emergency services and give out-of-hours callers the contact route the clinician has set up, rather than triaging.

• Royal College of Surgeons of England: Professional Standards for Cosmetic Surgery: aftercare“Ensure that appropriate aftercare (eg dressings or medication), including out-of-hours care, is available to the patient.”
• Royal College of Surgeons of England: Professional Standards for Cosmetic Surgery: emergency transfer“Ensure that there are clear arrangements for transfer where appropriate in the case of an emergency.”
• General Medical Council: GMC cosmetic interventions guidance: continuity of care“You must make sure that your patients know how to contact you or another named suitably-qualified person if they experience complications outside your normal working hours.”
• Care Quality Commission: CQC: surgical procedures, post-operative care“Post-operative care may include a planned follow-up consultation after surgery”