Outbound AI call campaigns in the EU: GDPR, hours, retries

Outbound AI call campaigns let an AI voice agent call a list of people with one clear purpose, such as confirming orders, reminding appointments or collecting missing documents, within calling hours you set, with automatic retries and full records. In the EU they are subject to the GDPR, to national rules on marketing calls and to transparency about the use of AI. Responsible campaigns call only people they have a reason to call, at reasonable hours, a limited number of times, and stop immediately when someone says no.

This guide covers the practical rules for running automated outbound calls in Romania and across the EU. It is not legal advice; for your specific case, talk to a lawyer or your data protection officer.

What is an outbound AI calling campaign?

A campaign is a set of initiated calls with one purpose. It has five parts:

1. A list of people to call, each with the context the call needs (order, case, appointment).
2. A purpose and a script outline with the possible outcomes.
3. Calling hours and a retry cadence: when the agent may call and how many times it tries.
4. Rules: what the agent must say, what it must never say, when it hands over to a person.
5. Follow-up: what happens after each outcome, such as a WhatsApp message, an email, a note in the CRM or ERP.

The AI voice agent then works through the list on its own. Your team sees each call, with a transcript, summary and outcome, and handles only the exceptions.

Which outbound calls are easiest to justify?

Not all outbound calls are equal, legally or in how people receive them.

The first four have a clear link to something the person started. The last one is where most complaints and legal risk come from. Many countries regulate marketing calls through national rules and opt-out registers, and in some cases require prior consent. If your campaign is marketing, check the rules of each country you call before you start.

What does the GDPR mean for automated outbound calls?

The core ideas, in plain terms:

• A lawful basis. You need a valid reason to process the person’s data for this call. For service calls about an existing order or case, this is often the contract or a legitimate interest. For marketing, consent may be required depending on the country and channel.
• Data minimisation. The list should contain only what the call needs: usually name, phone and the order or case reference. Special category data, such as health data, should not be uploaded or requested unless specifically agreed and assessed.
• Transparency. The person should know who is calling, why, and that the call is recorded if it is.
• Rights. People can object, ask for access or erasure. “Do not call me again” is the most common form of objection on the phone.
• Clear roles. Your company is the controller: you decide whom to call and why. The platform is the processor, acting on your instructions under a data processing agreement.

With AgentVocal AI, data is hosted in Romania, and the roles and measures are described on the security and GDPR page.

Do you have to say it is an AI?

Yes. Beyond honesty, the EU’s AI rules include transparency obligations for systems that interact with people, so they know they are dealing with an AI. The simplest practice, whatever the exact deadlines in your situation: the agent introduces itself as your company’s virtual assistant at the start of the call. It is also better for trust: people who find out halfway through that they were talking to an AI tend to feel misled.

How should you set calling hours?

Calling hours protect people’s evenings and weekends, and also your reputation. Some practical guidelines:

• call during normal daytime hours on working days, unless the person asked to be called at another time;
• respect the time zone of the person called, not your own, when you call across Europe;
• avoid public holidays in the country you are calling;
• for reminders, choose a time close enough to be useful, far enough to let people reschedule.

Calling hours are set per campaign, and the agent does not call outside them.

What is a good retry cadence?

Cadence is the rule for retries when nobody answers: how many attempts, at what times, over how many days. A few principles:

1. Count from the first call. A cadence of “three attempts in two days” means two days from the first call, not a period that restarts after every attempt.
2. Vary the time of day. If nobody answered in the morning, try in the afternoon, and on a different day.
3. Keep it short. A few attempts are enough. Calling the same person many times turns a service call into a nuisance.
4. Stop on any clear outcome. Confirmed, refused, wrong number, “do not call me again”: the cadence ends.
5. Never duplicate. The agent must not call twice about the same case. Note that uniqueness is per case and phone number: if the same phone appears in several separate cases, each case can need its own call.
6. Use written follow-up. After the last unanswered attempt, an SMS or WhatsApp message often works better than another call.

Voicemail deserves a decision too. If voicemail picks up, the agent made the call and spoke, so that call is charged as a normal minute. Only calls nobody answers are not charged. Decide whether your agent leaves a message, and keep it short.

How do you handle “do not call me again”?

This request must win over every other rule:

• the agent accepts it immediately, without trying to convince the person;
• the number goes onto a restriction list;
• the restriction list is checked before every call, SMS or WhatsApp message sent automatically;
• requests received through other channels (email, phone calls to your office) should be added to the same list.

Test this before launch: add your own number to the list and check that the agent no longer calls it.

What should an outbound AI agent NOT do?

• pretend to be a person, or hide who is calling;
• call outside the calling hours you set or after a refusal;
• pressure, argue or use urgency that is not real;
• read out personal data before confirming it is talking to the right person;
• ask for data the call does not need;
• negotiate payments, grant exceptions or handle disputes on its own; those go to people.

What should you check before launching a campaign?

• The purpose and lawful basis are written down.
• The list contains only the fields the call needs.
• Calling hours and retry cadence are set and counted from the first call.
• The agent introduces itself as a virtual assistant and announces recording if on.
• The restriction list is in place and tested.
• Handover rules to people are defined.
• Follow-up messages (SMS, WhatsApp, email) are written and approved.
• A test call to your own phone has been made, and a small first batch is planned.

The setup steps are described on the how it works page; for a campaign example from start to finish, see the cash-on-delivery order confirmation scenario. If you are still deciding which calls to automate, start with the guide on AI phone call automation.