The pitch is obvious. AI voice agents can make hundreds of dials without a human touching the phone. They don't get tired. They don't go off script. They can detect hesitation in a prospect's voice and adjust their approach in real time. They can escalate to a human the moment interest spikes. All of this is real technology, available today, at a fraction of the cost of a phone room full of reps.
It is also, in the current legal environment, a near-perfect mechanism for generating liability.
Before you wire an AI voice agent into your commercial lending outreach, understand what you are actually agreeing to. The federal rules are clear. The state rules are layered on top. And the emotion-detection capabilities that make these tools genuinely compelling bring an entirely separate body of law into the conversation.
The FCC's 2024 Ruling: AI Voices Are Robocalls
In February 2024, the FCC issued a declaratory ruling with a straightforward conclusion: any technology that generates a human-sounding voice is "artificial" under the Telephone Consumer Protection Act. That includes real-time conversational AI, voice cloning, large language model–driven agents, and anything that approximates a live human speaker without actually being one.
The practical effect: if your AI voice agent calls someone on a wireless number — any wireless number, including the cell phone of a business owner — without documented prior express written consent (PEWC), you are in violation of 47 U.S.C. § 227(b). Not in a gray area. In violation.
The damages are $500 to $1,500 per call. There is no aggregate cap. A campaign that makes 10,000 calls generates exposure of $5 million to $15 million before a class action multiplier. Class action TCPA litigation targeting commercial lending is not theoretical. It is ongoing, and plaintiffs' attorneys are actively scanning autodial logs for violations.
The FCC has also proposed additional rulemaking — as of early 2026, not yet final — requiring explicit in-call disclosure when a caller is an AI, and consent language that specifically references AI use. The current FCC under Chairman Carr has signaled a lighter regulatory posture generally, but has not reversed the 2024 ruling. The underlying statutory language that makes AI voices "artificial" is in the Communications Act itself, not just agency guidance, which means it would survive any single administration's change of direction.
The B2B argument doesn't help here. The relevant analysis under TCPA is whether the number called is a wireless number, not whether the person answering is a consumer or a business owner. Most small business owners in 2026 use personal cell phones as their business line. Those are wireless numbers. TCPA applies. "We only call businesses" is not a compliance strategy in this framework — it is a misunderstanding that will not survive discovery.
Calling Into Recording-Consent States
Separate from the robocall question, AI voice agents create a recording consent problem in more than a dozen states.
Federal law requires only one-party consent for call recording — meaning one person on the call, including the recorder, must consent. Under federal rules, you can record your own calls. Most states follow this standard.
Twelve states require all-party consent: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington. If a person on the recorded call is located in one of these states and has not been notified and consented to recording, the recording is illegal under state law. Some of these states — California in particular — impose criminal penalties on top of civil liability.
An AI voice system, by definition, is recording or processing the conversation. The moment it is analyzing what the prospect is saying in order to generate a response, it is capturing the audio. Whether that constitutes "recording" under a given state's statute has been litigated, and courts have consistently found that real-time voice processing falls within the scope of recording laws.
New York is a one-party consent state for recording — technically, calls made to New York residents by a New York-based caller are governed by one-party rules. But New York's legislature has been active on AI disclosure requirements, and the analysis changes the moment your list also includes residents of California, Florida, Illinois, or any other all-party state. You don't get to segment your compliance by recipient state after the fact. You need to know before you dial.
The practical reality for national commercial lending outreach: your prospect list is certain to include residents of all-party consent states. Notifying them that an AI is recording the call — which is what compliance requires — is not a small ask. It is an immediate conversion disadvantage in a cold call context, and it requires the AI to surface the disclosure before any substantive conversation begins.
The Emotion Detection Layer
This is where compliance gets genuinely difficult.
A generation of AI voice tools has moved beyond just generating human-sounding speech to analyzing the voice patterns, hesitation cues, tonal variations, and emotional signals of the person they're talking to. Hume AI's Empathic Voice Interface (EVI) processes 27 speech prosody dimensions continuously during a call. Other platforms offer real-time "resistance detection," "interest scoring," and "objection prediction" — all built on voice pattern analysis. The pitch is that your AI knows the prospect is about to hang up before they say it.
These capabilities are powerful. They are also squarely within the scope of biometric data laws in several states.
Illinois' Biometric Information Privacy Act (BIPA) covers voiceprints as biometric identifiers. The statute requires written consent and a publicly available data retention policy before any biometric information is collected. Damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation — per scan, per person, with no requirement to show actual harm. You do not have to hurt someone to face BIPA liability. You just have to collect their biometric data without consent. A commercial lending campaign making calls into Illinois without BIPA compliance is generating $1,000–$5,000 exposures for every prospect it reaches, at scale.
California's Invasion of Privacy Act takes this further: it requires express written consent before analyzing voice recordings to determine the truthfulness or falsity of the spoken content or to detect emotional states. "Emotional state detection" is exactly what these AI platforms advertise as their primary feature. Analyzing a California prospect's hesitation patterns to score their interest level is, under CIPA, a consent-required activity.
And Hume AI's own acceptable use policy explicitly prohibits using its expression measurement technology to "covertly analyze or record people's emotional states without their explicit consent," and bars application in "unsolicited communications or cold calls." The platform commercial lending teams find most compelling for voice AI has told them in its terms of service that their intended use case is off-limits.
"What If a Human Is Still on the Phone?"
A question that comes up immediately: does the legal analysis change if a human rep is doing the talking and the AI is only listening — analyzing the call in real time to give the rep coaching cues, emotion scores, or next-best-action prompts?
Not meaningfully.
The AI is still processing the prospect's voice. Whether it's generating speech or just analyzing incoming audio, the capture and analysis of the call occurs. Recording consent laws apply to the act of capturing or processing voice communications, not just to the generation of output from that data. A real-time AI sentiment analysis tool running in the background of a human call is, functionally, recording and analyzing the prospect's voice without their knowledge or consent.
The BIPA analysis is the same: if the AI is generating an emotion score or voiceprint from a call into Illinois, it is collecting biometric data. The fact that a human rep is also present doesn't change the consent requirement. The Illinois resident's biometric data is being collected either way.
There is one narrow compliance window: if you provide explicit disclosure at the top of every call — "this call is monitored and analyzed by AI systems" — and you're in a one-party consent state calling into other one-party consent states, you may be on the right side of the recording question. But you still have the TCPA question for how the call was initiated, the BIPA question for any Illinois prospects, the CIPA question for any California prospects, and the practical conversion question of whether a cold call that opens with "please be advised this call is monitored and analyzed by an AI" is closing at a rate that justifies the compliance overhead.
The Grey Area Is Too Thin to Operate In
Someone reading this will conclude there must be a safe configuration: one-party consent state, no all-party state prospects, careful disclosure language, human voice only, passive AI analytics only.
Run the analysis:
- TCPA / FCC 2024 ruling: Applies if the AI generates the voice. Human-only voice avoids this specific issue — but only this one.
- Recording consent: Applies in 12 states if you're capturing audio without consent. Eliminate those states entirely and you've cut California, Florida, Illinois, Pennsylvania, and Washington from your prospect universe.
- BIPA (Illinois): Applies to any voice analysis of an Illinois resident, including passive sentiment analysis during a human call. No B2B exception exists.
- CIPA (California): Applies to voice analysis for emotional state detection of California residents. No B2B exception.
- FTC Telemarketing Sales Rule: Requires accurate identification and prohibits deceptive practices — directly relevant when an AI voice is designed to pass as human without disclosure.
- State mini-TCPA laws: Florida, Maryland, Oklahoma, and others with independent private rights of action, their own consent standards, and damage provisions that stack on top of federal exposure.
The configuration that threads all of these simultaneously doesn't exist in a national cold calling campaign. It might exist for a carefully scoped, fully disclosed program operating in a small number of compliant states — but that configuration, with its required disclosures, consent documentation, and state-by-state restrictions, is not the AI cold call product anyone is being sold.
The tools that make AI voice calling compelling are the tools that create the compliance exposure: voice generation that passes as human, real-time emotion analysis, adaptive response to vocal hesitation. Strip those out and what remains is a more expensive, more legally complex version of a power dialer.
The Actual Risk Calculation
Commercial lending brokers and ISOs evaluating AI voice tools are typically comparing them against a phone room — a calculation that focuses on cost per dial and calls per hour. That is the wrong frame.
The right comparison is cost per compliant contact. A compliant AI outreach program requires documented PEWC for every number called, scrubbed lists excluding all-party consent state residents (or full disclosure protocols for those residents), BIPA-compliant data handling for any Illinois prospects, CIPA-compliant consent for any California prospects, and defensible documentation of all of the above for every call. The compliance infrastructure required to make AI calling legal at scale costs more than the AI tool itself.
The plaintiffs' attorneys pursuing TCPA violations in commercial lending are not going to be deterred by the fact that you were using a sophisticated voice AI product rather than a robo-dialer. The statute doesn't care about your vendor's marketing copy.
The simpler answer: the phone is already a high-risk channel for cold prospecting in commercial lending, as covered in our guide to TCPA liability for commercial finance brokers. Adding AI to the phone does not solve the compliance problem. It amplifies it.
What actually works in this environment — referral cultivation, door prospecting, LinkedIn outreach, direct mail — doesn't carry TCPA exposure and doesn't require a compliance attorney on retainer to operate legally. The phone-plus-AI combination isn't a shortcut around the hard work of building a compliant pipeline. It's a shortcut to a class action.
FundScout's model is built on the opposite premise: borrowers come inbound, lender contact is proxied and logged, and no rep is cold dialing on anything. If you're building a book of commercial lending business and wondering where the safe channel is, that's the starting point.
Sources
- FCC Declaratory Ruling on AI-generated voices (February 2024) — FCC 24-17; AI voice agents classified as "artificial" calls under TCPA requiring prior express written consent
- Telephone Consumer Protection Act (TCPA) — 47 U.S.C. § 227(b); $500–$1,500 per call; applies to wireless numbers regardless of business use
- Prior express written consent (PEWC) standard — 47 CFR § 64.1200(a)(2)
- Illinois Biometric Information Privacy Act (BIPA) — 740 ILCS 14; voiceprints are biometric identifiers; $1,000 per negligent violation, $5,000 per intentional violation per scan
- California Invasion of Privacy Act (CIPA) — Cal. Penal Code § 630 et seq.; all-party consent; § 632.7 prohibits recording cellular calls without consent
- All-party (two-party) consent recording states — California (§ 632), Connecticut (C.G.S. § 52-570d), Delaware (11 Del. C. § 2402), Florida (Fla. Stat. § 934.03), Illinois (720 ILCS 5/14-2), Maryland (Md. Code, Cts. § 10-402), Massachusetts (Mass. Gen. Laws ch. 272 § 99), Michigan (Mich. Comp. Laws § 750.539c), Montana (Mont. Code Ann. § 45-8-213), Nevada (Nev. Rev. Stat. § 200.620), New Hampshire (N.H. Rev. Stat. § 570-A:2), Oregon (Or. Rev. Stat. § 165.540), Pennsylvania (18 Pa. Cons. Stat. § 5704), Washington (Wash. Rev. Code § 9.73.030)
- FTC Telemarketing Sales Rule (TSR) — 16 CFR Part 310; requires accurate identification of caller and company on every call
- STIR/SHAKEN authentication — FCC mandate effective June 2021; 47 CFR Part 64 Subpart AA
- Hume AI, Empathic Voice Interface (EVI) Acceptable Use Policy — hume.ai; explicitly prohibits use in unsolicited communications or cold calls without explicit consent