Compliance Without a Legal Team

Four regulations apply simultaneously to an AI agent making a phone call:

TCPA (47 U.S.C. § 227): Requires express written consent before automated calls or SMS to US numbers. Violation: $500–$1,500 per call. Class actions are common.

GDPR (Regulation 2016/679): Requires documented lawful basis for processing contact data. Covers any EU resident regardless of where your agent is running. Requires immediate data deletion on request.

CAN-SPAM Act: Requires physical address, opt-out mechanism, and honoring unsubscribe requests within 10 business days for commercial email. For agents sending at scale, the opt-out management problem is non-trivial.

EU AI Act (Regulation 2024/1689) Article 52: Requires that users be informed when they're interacting with an AI system in real-time conversational contexts. This is the "mandatory disclosure" requirement — your agent must tell humans it's an AI.

None of these were written with AI agents in mind. Compliance teams are making it up as they go.

The current approach: fire drills

The way most teams handle this today is reactive. The agent ships. It communicates. Someone (legal, a concerned board member, a customer) asks a compliance question.

Then comes the audit:

Answers: nobody's sure. The consent was somewhere in the signup flow. The STOP propagation was never built. Call recording disclosure was in the agent's prompt, so... sometimes? The deletion request is in a Zendesk ticket that nobody has processed.

This is not a legal team failure. It's an architecture failure. Compliance was treated as the legal team's problem, when it should have been the infrastructure layer's problem.

What protocol-level compliance looks like

The right architecture enforces compliance at the infrastructure layer — before messages are dispatched, not after audits reveal violations.

TCPA consent verification

Every outbound call or SMS is blocked at the dispatch layer if consent cannot be verified:

# This call will fail if TCPA consent isn't verified
client.send(
    from_acn="acn://getdial.ai/yourco/sales-agent",
    to="+14155559876",
    content={"type": "voice", "body": "Hi, following up on your trial..."},
    session_id="sess_lead_123"
)
# CAL checks consent store at dispatch time
# If consent not found: raises ConsentNotVerifiedError
# If consent found: call proceeds with consent_verified=true in message envelope

Cross-channel unsubscribe propagation

When a contact replies STOP to an SMS, that suppression record is written to a global suppression list. Every subsequent communication attempt — voice, email, WhatsApp — checks this list at dispatch time. One opt-out stops all channels.

Mandatory AI disclosure

For voice calls, when policy.disclosure: "required", the disclosure is enforced before the agent's first turn. This isn't in the agent's system prompt where it can be edited out. It's in the infrastructure layer.

GDPR data minimization

Session context in the store is automatically pruned based on the data retention policy attached to the ACN. When a contact requests deletion, the cascade propagates across the session store, consent records, and audit logs.

The audit trail

Every ACES message carries a policy envelope:

"policy": {
  "disclosure_sent":          true,
  "consent_verified":         true,
  "tcpa_consent_timestamp":   "2026-05-20T10:14:22Z",
  "can_spam_compliant":       true,
  "recording_disclosed":      false,
  "gdpr_basis":               "legitimate_interest"
}

This isn't a log file. It's the message envelope — attached to every communication event, immutable, auditable. When the compliance audit comes, the answers are in the protocol, not in someone's memory.

The shift

Compliance treated as the legal team's problem is reactive, expensive, and scales poorly with agent volume. Compliance built into the infrastructure layer is proactive, automatic, and scales with the protocol.

The legal team still matters — they set the policies. But they set them once, in the ACN policy record, and the infrastructure enforces them at every dispatch. The compliance question isn't "did we do this right?" — the answer is in the envelope.