Every AI agent that calls or texts a customer is operating under a law written for robocalls — and this month, that law got sharper teeth on the consent side. The Federal Communications Commission unanimously approved sweeping changes to its TCPA consent revocation rules on September 30, 2026, overhauling how businesses must handle opt-outs for calls and texts (Legal500, Oct 30, 2026). The headline for anyone running agents is simple: consent is no longer a checkbox you collect once. It is a living record — who gave it, what it covered, and whether they took it back. Somebody's name has to be on that record.
AI agent governance: what the FCC just changed about consent
The September 30, 2026 Report and Order scraps the old "revoke all" rule — a revocation for informational messages no longer automatically revokes consent for marketing messages, and vice versa; revocations now apply by category, and informational opt-outs can be applied at campaign level. The FCC itself called the old rule "overinclusive" and out of step with consumers' actual intent (Legal500, Oct 30, 2026). And for calls using an artificial or prerecorded voice — expressly including AI-generated calls — callers must keep providing an automated, interactive opt-out mechanism for do-not-call requests (Legal500, Oct 30, 2026). The changes take effect 30 days after a notice is published in the Federal Register (Legal500, Oct 30, 2026).
Read that as an operator, not a lawyer: your consent system now has to distinguish categories, honor revocations at the right scope, and prove the opt-out path worked — per campaign, per batch, per person. That is record-keeping work. Vague standing permission does not survive contact with it.
Custom CRM: an AI voice is an "artificial voice" — and the meter runs per call
None of this is new law invented for AI. On February 8, 2024, the FCC's Declaratory Ruling FCC 24-17 classified AI-generated voices as "artificial voices" under the TCPA, putting AI voice agents in the same compliance category as legacy robocalls — consent requirements, calling windows, opt-out obligations, and caller identification all apply (TheTechBoss via Medium, Oct 12, 2026). TCPA statutory damages run $500 per call for negligent violations and $1,500 per call for willful ones (TheTechBoss via Medium, Oct 12, 2026). Do the arithmetic the way a plaintiff's firm does: an agent that dials a badly consented list does not make one mistake. It makes the same mistake at machine speed, priced per call.
And the pressure is already building to loosen the consent side: a petition filed August 31, 2026 asks the FCC to let noncommercial political callers use AI-generated voices on cell phones without prior express consent, under a three-calls-per-30-days cap and an opt-out rule; the FCC took comment on it September 4, with reply comments due October 19, 2026 (FourWeekMBA, Oct 2026). Whether or not that waiver lands, the direction of travel is visible — the fight over AI calling is a fight over whether consent comes before the call or after it. (Analysis: that is the same fight, in miniature, inside every business that lets an agent touch a phone.)
Governed AI agents: attestation per batch, never standing
Here is the discipline this post is built on, stated as the operating rule Robbie Glover uses in his own CRM at Ronin Inc: the TCPA attestation is signed in his name, by him, never automated — per batch, never standing. No agent sends under a blanket yes granted last quarter. Each batch of outreach carries a named human's attestation, made at the time, for that batch.
That is authorization-before-action as a lived legal discipline, not a feature checkbox. It has three properties worth stealing for any operation where agents touch money, messages, or records:
- Named. A specific human attests — not "the system," not a role account. When the record is read back, there is a person on it.
- Per-batch. The yes covers this batch, this list, this campaign — matching the category-specific shape the FCC's September 30 order now demands (Legal500, Oct 30, 2026). A new batch needs a new yes.
- Revocable and auditable. Consent in, revocation out, attestation on file — the chain can be pulled and read end to end, which is what makes an opt-out dispute a lookup instead of a lawsuit.
The contrast case writes itself: the industry pattern is a standing permission buried in a settings page, an agent dialing under it indefinitely, and a consent record nobody can reconstruct when the complaint arrives. The law just moved toward categories and revocation records. Operations should move first.
Phoenix custom software: what to demand from whoever builds your agents
If you are a Phoenix business owner buying a custom CRM or bespoke software with AI agents doing outreach, you do not need to become a TCPA scholar. You need to ask the builder four questions:
- Where is consent recorded, and can I read it back per person? If the answer is a screenshot or a vendor dashboard you cannot export, you do not own your own defense.
- Who attests before a batch sends? Demand a named human, per batch. "The platform handles compliance" is not a name.
- How does a revocation propagate? The September 30 rules are category-specific (Legal500, Oct 30, 2026) — your system has to honor an opt-out at the right scope, automatically, and log that it did.
- What stops the agent mid-batch when something is wrong? A kill switch tied to the same record, not a support ticket.
A governed system makes these boring questions easy, because the attestation, the consent record, and the audit trail were designed in from the start. An ungoverned one makes them archaeology.
Frequently asked questions
Q: Does the TCPA actually apply to AI voice agents?
A: Yes. The FCC's February 8, 2024 Declaratory Ruling (FCC 24-17) classified AI-generated voices as "artificial voices" under the TCPA, so AI calling agents carry the same consent, identification, calling-window, and opt-out obligations as prerecorded robocalls (TheTechBoss via Medium, Oct 12, 2026).
Q: What did the FCC change about consent revocation in 2026?
A: In a Report and Order approved September 30, 2026, the FCC replaced the "revoke all" rule with category-specific revocations, allowed campaign-level application for informational opt-outs, and kept the automated interactive opt-out requirement for artificial-voice calls, including AI-generated ones; the changes take effect 30 days after Federal Register publication (Legal500, Oct 30, 2026).
Q: Why attest per batch instead of once?
A: Because consent itself is per category and revocable at any time. A standing attestation claims a state of the list that may have changed since it was signed. A per-batch attestation, by a named human, matches the record to the moment of sending — which is the record you would want in your hand if a call is ever questioned. (Analysis.)
Robbie Glover builds governed AI systems at Ronin Inc in Phoenix, Arizona. If you want a custom CRM where AI agents work under a named human's attestation — consent recorded, revocations honored, every batch auditable — talk to us (https://ronininc.org).
