The rule that matters most for AI voice agents: automated or pre-recorded marketing calls require the recipient's prior consent under PECR, for both individuals and organisations. Consent to receive a live call does not cover an automated one.
Live (human or AI-conducted, non-recorded) marketing calls are treated differently: they generally don't require prior consent, but you must screen numbers against the Telephone Preference Service (TPS) and Corporate TPS (CTPS) do-not-call registries and honour opt-outs.
For a Callsy-style abandoned-cart or payment-reminder call, the lawful basis is usually the customer's existing relationship and the transactional or legitimate-interest purpose, with an easy opt-out on every contact. The ICO updated its direct-marketing guidance in 2026 to expect explicit AI disclosure where AI is used.
This is a UK-specific layer on top of GDPR. An EU-only GDPR view misses PECR, which is exactly why US-built tools often get UK compliance wrong.