GDPR and the EU AI Act in a voice agent, in practice

A call recording contains personal data of the caller, and almost always of third parties mentioned along the way. That alone puts you squarely inside GDPR.

There is a further step. If the voice is used to identify the speaker, it becomes biometric data, under the reinforced regime of article 9. Transcribing a call is not the same as recognising someone by their voice, and it is worth being clear which one you are doing.

You are the controller. The platform is a processor. That means the important decisions are yours, and that you need a signed processing agreement, the list of sub-processors, and a clear answer on where data is processed.

It also means that informing the caller is your responsibility, not the platform one. You can do it in the agent greeting, and in Lera that greeting is editable precisely for this reason.

Hosting is in the European Union. The six data processing agreements with voice providers are signed.

Call recording ships switched off. If you do not turn it on, there is no audio to keep, and the retention problem disappears instead of being managed.

When a customer clones their voice, the audio sample is not stored, only its cryptographic fingerprint. A voice sample is biometric data and keeping it without needing it is keeping the risk without the benefit. On top of that, the record keeps who gave consent, when, from which IP address and against which version of the text.

The European AI regulation requires transparency when a person interacts with an automated system. In practice you solve it by saying so in the greeting.

Lera does not force that notice from the engine. It ships in the default greeting and it is editable, because informing is your duty as controller and the exact wording depends on your context and sector. Forcing it from the platform would be deciding for you something the law assigns to you.

Where audio is processed and stored, naming the country. The list of sub-processors. How long transcripts and recordings are kept, and whether you set that period. Whether you can disable recording. And how you export or delete your data the day you leave.

If an answer arrives as a brochure instead of in writing, treat that as data.

This is a practical explanation, not legal advice. Your specific case depends on your sector, the data involved and your own risk assessment. If you handle health data or biometric data, talk to someone who signs.