AI Voice Agents for Recruitment: A UK Compliance and Buying Guide

AI Voice Agents for Recruitment: A UK Compliance and Buying Guide

Most of what you will find searching this term is a vendor telling you why their tool is the best of eight. Plivo compares itself favourably to Twilio and Voiceflow. CloudTalk promises a 21x lift in qualification odds. None of it tells a UK recruitment agency the one thing that actually determines whether you can switch this on: what has to be true before the first call goes out.

AI voice agents handle candidate screening calls, availability checks, and interview scheduling without a recruiter dialling the number. They are legal for a UK agency to use. But the legal basis is different depending on who you are calling, and getting that distinction wrong is the mistake we see most often when agencies scope this work.

What can an AI voice agent actually do in a recruitment workflow?

Three jobs come up in almost every scoping conversation we run with agencies.

Screening calls to applicants. A candidate applies, the agent calls within minutes, asks the same qualifying questions a consultant would (right to work, notice period, salary expectations, availability), and logs the answers straight into the ATS. The candidate volunteered their number by applying, which matters for the legal basis below.

Availability and scheduling. Once a candidate is through screening, the agent checks interview availability against the client's diary and books the slot, instead of a five-message WhatsApp back-and-forth that eats a consultant's afternoon.

Passive candidate outreach. Some agencies use voice agents to call people sourced from a database who never applied for anything, to see if they are open to a conversation. This is a different legal category from the first two, and it is the one most agencies skip past without realising.

If "agent" in the software sense is new territory, our plain-English guide to AI automation explains the difference between a chatbot and something that actually completes a task on its own.

Is it legal to record and screen candidates with an AI voice agent in the UK?

Yes, and the legal basis splits along the line drawn above.

For a screening call to someone who applied for a specific role, the relevant framework is UK GDPR fair processing, not PECR. The candidate initiated contact by applying. The agency needs to tell them plainly that an AI system is conducting the call, disclose if it is recorded, and give them a way to ask for a human instead if the call outcome feeds into a decision about their application. Where that decision is automated (an AI voice agent scores the call and the score determines whether a human ever sees the candidate), Article 22A UK GDPR gives the candidate a right to meaningful human review, not a rubber-stamped approval of whatever the AI decided.

For an automated outbound call to someone sourced from a database who never applied, PECR Regulation 19 is the sharper risk. The ICO's own PECR guidance states that automated calling systems require prior consent regardless of who wrote the script, and that includes AI-generated voice. The corporate subscriber exemption some agencies rely on for business-to-business marketing covers electronic mail only. It does not stretch to automated voice calls. If your voice agent is cold-calling candidates from a purchased or scraped list rather than answering people who applied, treat it as a marketing call and get consent first.

We built the CV screening version of this same distinction in our notes on AI CV screening compliance, which draws on the ICO's March 2026 report and its finding that many employers' "human review" was, in practice, a rubber stamp of whatever the AI had already filtered. The same finding applies directly to voice: if a recruiter approves a shortlist without ever hearing the calls the AI screened out, that is not meaningful review under UK GDPR.

What UK recruitment agencies get wrong about voice AI consent

The mistake is treating "the candidate applied for the job" as blanket consent for everything that follows. It is not. Applying gives you a lawful basis to process their application and to call them about it. It does not automatically give you a lawful basis to record that call, feed the recording into a model that trains on it, or use the same voice agent to cold-call people from a purchased list next week under the same policy.

Three checks catch most of the gap. First, does the candidate know before the call starts that they are speaking to an AI, not a person, and is that disclosure in plain language rather than buried in a nineteen-page privacy notice? Second, if the call is recorded, was that stated up front rather than mentioned only if the candidate asks? Third, is there a genuinely different process for outbound calls to people who have not applied, or is the same automated system being pointed at both applicant and non-applicant lists without anyone checking which consent regime applies to which list?

Agencies that can answer all three honestly are in a defensible position. Agencies that cannot are exposed regardless of how good the voice agent's conversation quality is, because the exposure sits in the consent and disclosure layer, not the AI's competence.

Buy an off-the-shelf tool or build a custom voice agent?

Buy when the job is narrow. An AI receptionist answering after-hours candidate calls is a solved problem, and a subscription tool from the vendor comparison lists (Plivo, CloudTalk, Synthflow and similar) will get you there in a week without an engineering project.

Build custom when the workflow crosses systems. A voice agent that writes structured data into Bullhorn, Vincere, or JobAdder, applies a different consent-and-disclosure script depending on whether the candidate is an applicant or a sourced contact, and routes flagged calls to the right consultant rather than a generic inbox is not something an off-the-shelf tool configures out of the box. That is systems integration work. It is also where most of the compliance logic above actually has to live, in the workflow, not in a policy document nobody checks against what the software does.

Fracas builds AI agent systems for recruitment agencies that plug into the ATS you already run, with the human-in-the-loop and audit logging built into the workflow from day one rather than bolted on after a complaint. If you are weighing build against buy for your own agency, our comparison of agency and in-house AI builds works through the trade-offs in more depth than fits here.

A vendor due-diligence checklist before you sign

If you are going the off-the-shelf route, the compliance responsibility stays with your agency as data controller. It does not transfer to the vendor because their marketing page mentions GDPR. Four things to check before signing.

Data processing agreement. The vendor processes candidate voice data only on your documented instructions, not to train their own model. Get this in writing. A line on a features page is not a contract term, and we have seen more than one vendor pitch deck imply GDPR coverage that the actual contract never mentioned.

Recording and log retention. Ask exactly how long call recordings and transcripts are kept, and whether that period is long enough to reconstruct a screening decision if a candidate challenges it six months later.

Bias testing evidence. Voice AI can pick up accent, speech pattern, and pace as proxies for characteristics it should never be scoring against. Ask for the vendor's actual testing results across those variables, not a compliance badge on their homepage.

Your own audit rights. The contract should let your agency run an independent review of how the system is actually scoring calls, not rely solely on a report the vendor produced about itself.

One concrete step for this week: pull up your current or prospective voice AI vendor's terms and check whether all four of those sit in the contract itself, not just the sales deck. Most agencies find at least one gap on the first read.

If you want to talk through where your own screening or scheduling workflow sits against this checklist before committing to a vendor or a build, a call takes 30 minutes and we will tell you honestly which route fits your volume and systems.

Frequently asked questions

Is it legal for a UK recruitment agency to use an AI voice agent?

Yes, provided candidates are told a machine is calling, any recording is disclosed and consented to, and a route to request human review exists where the call feeds an automated shortlisting decision. The legal basis differs depending on whether the agency is calling someone who applied, or cold-sourcing a passive candidate who has not.

Do candidates need to consent to an AI voice screening call?

It depends what the call is for. A screening call to someone who applied for a specific role sits under UK GDPR's fair processing rules, not PECR. An automated outbound call to a passive candidate who has not applied is closer to the PECR Regulation 19 regime for automated calling systems, which does require prior consent.

Should a recruitment agency buy an off-the-shelf voice AI tool or build custom?

Buy when the job is narrow and a single vendor tool solves it, such as after-hours candidate intake. Build custom when the workflow has to plug into your ATS, apply your own compliance rules, or route across systems a vendor's product was never designed to touch.

What should be in a vendor contract before switching on an AI voice agent?

A data processing agreement that restricts the vendor from using candidate data for its own model training, a stated log retention period long enough to reconstruct a screening decision, documented bias testing results the agency can request on demand, and the agency's own right to run an independent audit.