AI voice agents in the European Union: AI Act Article 50, GDPR and EU hosting

Market shape

The European Union is one regulatory space, twenty-four official languages and twenty-seven telemarketing regimes. A hotel group in Lisbon, a Polish collections agency and a German insurer buy under the same AI Act and GDPR, then meet different national rules for consent to automated calls, calling hours and recording. Small businesses say KI-Telefonassistent, assistant vocal IA or AI receptionist; enterprises say voice agent or conversational AI for the contact centre.

Four facts shape buying. First, the AI Act's transparency duties apply from 2 August 2026, so any agent live in the EU today must tell callers it is an AI system. Second, the Digital Omnibus package, agreed politically on 6 May 2026, delayed the high-risk obligations, not the transparency ones; see the flag below. Third, EU hosting is the single most common procurement condition in tenders, regardless of what GDPR strictly requires. Fourth, the German-speaking markets generate a large share of enterprise demand and bring their own gates: German-language quality in both registers, EU hosting by default, criminal-law recording rules and, for agent-assist deployments, works-council sign-off. On market size, MarketsandMarkets estimates Europe at USD 510 million in 2025 rising to USD 6.0 billion by 2032 (report page as retrieved 1 October 2026); Astute Analytica publishes no Europe-only figure. Neither is a measurement.

Regulatory quick card

The compliance matrix row is eu. The rule as published, informational rather than advice:

• AI disclosure (AI Act Article 50). Providers must design AI systems that interact directly with people so that those people are informed they are interacting with an AI system, unless it is obvious to a reasonably well-informed person. The information must be given clearly at first interaction. Transparency obligations apply from 2 August 2026.
• Digital Omnibus: read this before relying on dates. Law-firm analyses of the Omnibus report that it moved the stand-alone high-risk deadline (Annex III) from 2 August 2026 to 2 December 2027 and the embedded-product deadline (Annex I) to 2 August 2028, while leaving Article 50 on 2 August 2026, with one carve-out: systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2). We have verified this against two law-firm summaries, not against the Official Journal text. Confirm the published regulation before you rely on any date here.
• Consent for automated calls. The ePrivacy Directive (Article 13), as transposed by each member state, requires prior consent for direct marketing by automated calling systems without human intervention. The national transposition decides the detail; the GDPR requires a lawful basis for the processing itself.
• Recording. Recording needs a GDPR lawful basis and a transparent notice at the start. Several member states go further: in Germany, section 201 of the Criminal Code makes recording another person's non-public spoken word without authorisation punishable by up to three years' imprisonment or a fine. Configure all-party consent as the default.
• Calling hours. National law and codes; no EU-wide statutory window.
• High-risk overlay. Agents used for credit scoring, essential-service eligibility or employment decisions may fall under high-risk obligations beyond disclosure.

Telephony and numbering

Calls reach agents through national operators, pan-European SIP trunk providers or CPaaS, or through a CCaaS platform's bundled telephony. Numbering plans are national. Most member states distinguish geographic, national non-geographic, freephone and mobile ranges, and most regulators now expect presentation numbers to be ones the caller is entitled to use; several block or label calls whose CLI does not match an assigned number. Buy numbers in each country you call, present them consistently, and make sure they answer on ring-back with an identification and an opt-out. The agent must also know the national emergency number for each country it serves.

Language and accent gates

Multilingual is the default requirement, not a premium one. The languages listed in this page's data are the ones buyers most often specify; the gates are register (Du or Sie, tu or vous, Lei), number read-back in French above sixty, Polish declension in confirmations, Flemish and Netherlands Dutch, and English loanwords mid-sentence in every market. Pan-EU shared-service centres add language detection at the start of a call and a clean hand-off when the caller switches. Test each language with recorded callers from that country; a demo in one language predicts little about another.

Data residency and hosting

GDPR Chapter V permits transfers outside the EU only with an adequacy decision or appropriate safeguards. Public bodies, banks, insurers and health providers usually convert that into a procurement condition: EU hosting for every component in the audio path. The deciding document is the sub-processor list across telephony, speech recognition, language model and voice synthesis, with the hosting region and transfer mechanism for each. Ask for retention periods for recordings and transcripts and a no-training clause. If the vendor's EU region excludes any one component, the data map is incomplete.

Buyer landscape

Collections and insurance servicing are the earliest production use because those buyers already record calls and already run under conduct rules. Hotels and travel buy for multilingual reservation lines. Health and recruiting buyers are present but must first check the high-risk overlay. Across all of them, DACH buyers tend to run the longest procurements and the strictest hosting and works-council requirements; southern and eastern member states tend to buy through CCaaS incumbents and national integrators.

Vendor landscape

The vendor list in this page's data is alphabetical and typed, not ranked. Global platforms sell the agent builder with the voice stack included or pluggable; CCaaS incumbents, including several European-headquartered ones, sell the agent as a feature of a contact centre you may already run; infrastructure vendors supply numbers, SIP trunks and components. Fifteen names appear; any of them can pass or fail your demo. The acceptance test is a booking, a payment arrangement or a case note landing in your own system during a call made in your language, with the Article 50 disclosure audible in the first turn.

Questions to ask vendors in this market

The six questions in this page's data, in order: how Article 50 is met in each language from 2 August 2026; which of your use cases could be high-risk and what Omnibus dates the vendor is working to; how ePrivacy consent is checked per member state before dialling; where audio is processed and which sub-processors sit outside the EU; how the recording notice changes for a German caller; and the all-in cost per connected minute in euros, per language.