AI voice and GDPR can work together in care, if you settle a short list of questions first. The calls contain health data. The system is a processor acting for you. Callers must be told what is happening. And since 2 August 2026, the EU AI Act adds a duty to tell people they are speaking to an AI system. This article walks through each point in plain terms. Treat it as general information for Irish care providers, and involve your data protection officer or adviser.
AI voice and GDPR: why care calls are different
A call to a home care agency is rarely just a name and a number. A daughter says her father has had a fall. A client says she has not taken her tablets. A family member says Mam is very confused tonight. That is information about health. The GDPR treats it with extra care.
What the GDPR says about health data
Article 9 of the GDPR starts from a prohibition. Processing of data concerning health is prohibited unless an exception applies. One exception, Article 9(2)(h), covers processing necessary for the provision of health or social care, on the basis of EU or Member State law or a contract with a health professional. Article 9(3) adds that the data must be handled by a professional bound by secrecy, or another person bound by a secrecy obligation.
Ireland applies this through section 52 of the Data Protection Act 2018. That section allows processing for purposes such as providing medical or social care and managing health and social care systems, subject to suitable and specific safeguards. Under subsection (2), the processing must be done by, or under the responsibility of, a health practitioner or a person who owes an equivalent duty of confidentiality.
In practice, this means two things for an AI voice service. The processing must serve your care purposes. And anyone handling the data on your behalf must be bound by confidentiality and work under your responsibility. Your vendor's contract and staff terms should say so.
A call about a fall is health data. Expect to show who handled it, why, and under what rules.
Who is the controller and who is the processor
Your agency decides why and how client data is used, so you are the controller. A vendor that answers calls for you, on your instructions, is normally a processor. Article 28 says controllers must use only processors that provide sufficient guarantees. It also says the processing must be governed by a binding contract that sets out the subject matter and duration, the nature and purpose, the types of data and categories of people, and the obligations of each party. The processor may process the data only on your documented instructions.
Ask to see the data processing agreement before you sign anything else. If a vendor says it will use your call data to train its own general-purpose models, that is a decision for you and your data protection officer. It is a separate purpose, and it would need its own justification.
What callers must be told
Callers have a right to know who is handling their data and why. Article 13 lists what you must give at the time data is obtained, including the identity and contact details of the controller, the contact details of the data protection officer where there is one, and the purposes and legal basis for the processing.
In a phone call you cannot read a full notice. The usual approach is a short statement at the start of the call and a fuller privacy notice that people can find on your website or in the service guide. A good opening covers four things in a few seconds:
- Who is calling or answering, in the agency's name.
- That the caller is speaking to an automated assistant.
- That the call is recorded and why.
- Where to find more information or ask for a person.
Your own service guide and website should then carry the fuller detail, including retention periods and how to exercise rights. Our security page shows the kind of detail a provider should expect from a vendor.
Do you need a data protection impact assessment
Probably yes. The Data Protection Commission explains that a DPIA is mandatory where processing is likely to result in a high risk to people's rights and freedoms. Its examples include large-scale processing of special category data. It also lists criteria drawn from European guidance, among them data about vulnerable individuals such as patients, innovative use of new technology and sensitive data. As a rule of thumb, processing that meets at least two criteria will generally need a DPIA.
An AI voice answering calls from older clients about their health meets several of them. Do the DPIA before go-live. Involve your data protection officer if you have one. Record the risks you see, such as mishearing, wrong routing, over-collection and recordings kept too long, and the controls you put in place. Review it when anything changes.
The EU AI Act: what applies to a care call line
The AI Act adds a second layer of rules. Four are relevant.
Telling people they are speaking to AI. Article 50(1) requires that AI systems intended to interact directly with people are designed so that those people are informed they are interacting with an AI system. According to Goodwin, the duty applies regardless of risk classification, does not apply where it is obvious from context, and became enforceable on 2 August 2026. Goodwin also reports that the AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, did not change the substance of these transparency rules. Fines for breaches of this provision can reach €15 million or 3% of worldwide annual turnover, whichever is higher, according to the same source.
The duty falls first on the provider of the system. As the agency deploying it, you should still confirm in writing that the system discloses itself on every call.
Emotion recognition. Article 50(3) says deployers of an emotion recognition system must inform the people exposed to it. Ask any vendor whether its system infers emotions or intentions from voices. A service that records what people say, and does not infer health or mood from the sound of the voice, avoids that question. Hettie works that way by design.
AI literacy. Article 4, applicable since 2 February 2025, requires providers and deployers to take measures to ensure a sufficient level of AI literacy among their staff. For you, that means brief training for the people who read summaries and receive escalations.
High-risk classification. Annex III lists AI systems intended to evaluate and classify emergency calls, or to prioritise the dispatch of emergency first response services, including emergency healthcare patient triage. A care agency's own line is not an emergency service. The wording is still a reminder of why urgency should be set by rules your people write and own, and why you should ask any vendor to explain where its system sits. Take advice if a product does more than record, route and escalate.
The public sector direction of travel
The HSE launched its AI for Care 2026-2030 strategy on 11 March 2026. Its six principles include transparency and human in the loop, described as clinical judgement staying central, with AI in a supporting role. A private provider sits outside the HSE's strategy. Your commissioners and clients will still expect similar standards. A system that keeps people in control of clinical decisions is easier to defend.
Ten questions to ask any AI voice vendor
- Will you sign an Article 28 processor agreement, and can I read it now?
- Where are the recordings, transcripts and logs stored and processed, in every part of the chain?
- What do you tell callers at the start of each call?
- Does the system ever give medical advice? What does it say when asked?
- What happens if it is unsure, or the caller is distressed?
- Does an urgent call reach a person live, and what happens if nobody answers?
- Who at your company can open a recording, and is each access logged?
- How long do you keep data, and can I set the period?
- Do you use my call data to train any model?
- What is your process if there is a data breach?
On data location, ask for a clear answer about the whole chain: telephony, speech recognition, language model, voice and storage. Hettie keeps client data in the EU. Whatever the vendor, get it in writing.
Putting it together
Start with the contract and the DPIA. Then script the opening statement, check that it works on a real call and keep clinical judgement with your staff. If you are comparing models for your phone line, our article on answering services, on-call rotas and AI voice agents sets out the strengths and limits of each. For the routing rules that sit behind any good system, see how to write on-call escalation rules.
Sources
- GDPR Article 9: Processing of special categories of personal data
- GDPR Article 28: Processor
- GDPR Article 13: Information to be provided where personal data are collected from the data subject
- Irish Revised Acts: Data Protection Act 2018, section 52
- Data Protection Commission: Data Protection Impact Assessments
- EU AI Act, Article 50: Transparency obligations
- EU AI Act, Article 4: AI literacy
- EU AI Act, Annex III: High-risk AI systems
- Goodwin: Not Delayed, Not Deferred, EU AI Act transparency obligations are now in force (August 2026)
- HSE: The Artificial Intelligence Strategy for Healthcare in Ireland 2026 to 2030
Frequently asked questions
Do we need consent to record a care call?
Not necessarily. Consent is one possible basis, but health and social care purposes can rest on Article 9(2)(h) and section 52, with a lawful basis under Article 6 as well. The right basis depends on your purpose, so settle it with your data protection officer. Whatever the basis, callers must be told that the call is recorded.
Must an AI voice tell the caller it is not a person?
Yes, under Article 50(1) of the AI Act, unless it is obvious from context. That obligation became enforceable on 2 August 2026, according to Goodwin. Most providers open each call with a short statement that the caller is speaking to an automated assistant.
Can an AI voice give medical advice to callers?
It should not. A care agency's AI voice should record what is said, route the call by rules your staff set and escalate to a person. If a caller describes an emergency, it should tell them to ring 112 or 999 and alert your on-call team.
