TCPA and AI patient outreach: what sites need to know in 2026

What did the FCC decide about AI voices?

On February 8, 2024, the FCC issued a declaratory ruling that the TCPA's limits on "artificial or prerecorded voice" calls cover AI technologies that generate human voices. A call that uses one needs the called party's prior express consent unless it is made for an emergency purpose or an exemption applies.^⁠[1]

The trigger is the technology, not the message: an informational, IRB-approved study invitation delivered by AI voice to a mobile number still needs consent. Like any artificial-voice message, the call must also name the organization responsible at the start and give a callback number during or after it.^⁠[5]

Does the healthcare exemption cover recruitment calls?

Not as written. It lets providers call or text a patient's mobile number without prior consent only for listed care messages under tight conditions.^⁠[5] Study recruitment is not on the list, and the other conditions are hard to meet on a pre-screening call.

So for AI calls about a study, plan on prior express consent, not the exemption. Whether consent a site already holds, such as a research-contact preference collected at registration, covers a specific study is a question for counsel to settle before the IRB submission. Our IRB and HIPAA outreach guide covers the separate HIPAA question of who may contact which patients.

What changed about opt-outs in 2025?

Revocation rules the FCC adopted in February 2024 took effect on April 11, 2025. A patient can revoke consent by any reasonable means, and the caller must honor the request within 10 business days.^⁠[3] Text replies of stop, quit, end, revoke, opt out, cancel or unsubscribe count automatically, and other wording counts if a reasonable person would read it as a request to stop.^⁠[5]

That matters for AI agents. "Please don't call me again" mid-call, or "take me off your list" by text, is a revocation, so the agent has to recognize phrasing like this, not only the word STOP.^⁠[3] One text confirming the opt-out is allowed, and one sent within five minutes is presumed to fall within the patient's consent.^⁠[5]

Still pending is the "revoke-all" rule, under which an opt-out from one type of informational message also revokes consent for the same caller's robocalls and robotexts on unrelated matters. As of September 2026 it has been delayed twice and is set to take effect January 31, 2027.^⁠[4] For a site that sends both appointment reminders and study outreach, one opt-out could then cover both.

Do the same rules apply to texts?

Largely. The FCC treats text messages as calls, and the healthcare exemption and opt-out rules above name texts explicitly. Federal rules also bar telephone solicitations before 8 a.m. or after 9 p.m. at the patient's location.^⁠[5] A study invitation may not count as a solicitation, but that window is a sensible outer bound.

Texting adds a second gatekeeper: the carriers. They police business texting using CTIA's voluntary messaging principles, which call for opt-in before any message, a standard STOP opt-out and one final confirmation.^⁠[6] Texts from a standard 10-digit number (10DLC) also need brand and campaign registration with The Campaign Registry before carriers allow them.^⁠[7] Our patient outreach SMS templates include disclosure and opt-out wording.

Do state laws add AI disclosure rules?

• Texas. Since January 1, 2026, a provider that uses AI in relation to health care services must disclose it to the patient in clear, plain language no later than when the service is first provided.^⁠[8]
• California. Since January 1, 2025, clinics and physician offices using generative AI to write patient messages about clinical information must include a disclaimer and instructions for reaching a human (spoken at the start and end of audio), unless a licensed provider reviews the message. Messages about scheduling and billing are excluded.^⁠[9]
• Colorado. A rewritten AI law signed in May 2026 takes effect January 1, 2027 and requires notice at the point of interaction when covered automated tools are used in consequential decisions, which include health care services.^⁠[10]

Whether recruitment calls fall inside each law depends on its definitions; ask counsel. The simpler path is to disclose AI use on every contact. Bond's Engage agents tell each patient that AI assistance is being used, and the patient can reach a person at any time: the agent transfers the call live to a coordinator or books a human callback, whichever the site prefers.^⁠[11],[12]

What should a site do before turning on AI outreach?

• Write down the consent basis for each patient list, have counsel sign off, and do not rely on the healthcare exemption.
• Put the disclosure in the script. Name the site at the start, give a callback number, say that AI is being used and offer a person.
• Send the script to the IRB with the disclosure line, contact window, attempts and opt-out handling. Start from our IRB submission language.
• Test opt-outs in plain language. Try free-text replies and mid-call requests, not only the word STOP.
• Suppress fast. Log each opt-out with its date and remove the number well inside the 10 business day limit.^⁠[3]
• Register before you text. Build 10DLC brand and campaign registration into the launch timeline.^⁠[7]
• Mark January 31, 2027 and decide how one opt-out will apply across reminders and research outreach.^⁠[4]