Voice AI in dunning — what's lawful, what isn't, and how kvit gets it right
An AI-driven voice agent calling an overdue customer about an unpaid invoice touches four regulatory frameworks at once — UWG §7 (Germany's unfair-competition / cold-calling rules), EU AI Act Art. 50 (transparency obligations), the German TDDDG plus §201 StGB (recording consent), and the GDPR (legal basis for processing). This piece walks through where each framework bites, what differentiations it allows, and how a voice-dunning workflow must be built in 2026 to be both effective and durable.
Where voice AI in dunning stands legally
Outbound calls to overdue customers have existed for decades — what changes in 2026 is that the voice on the other end can be AI-generated. Four frameworks meet at exactly that intersection:
UWG §7 (Germany's Unfair Competition Act): prohibits harassing calls without consent. Often equated with all unsolicited calls in public discourse, but legally only applies to advertising.
EU AI Act, Article 50: transparency obligation when an AI system interacts with natural persons. Fully effective since 1 August 2026, including for GPAI applications.
TDDDG and §201 StGB: recording conversations without consent of the participants is criminal. Applies to anyone recording a dunning call — evidence preservation cannot override this.
GDPR: voice calls process personal data. Legal basis and data residency must be cleanly documented.
UWG §7 — why the cold-calling argument doesn't bite on dunning
The most common reflex on automated dunning calls is: That's cold calling — it needs prior consent. The reflex is legitimate but legally wrong. UWG §7 prohibits harassing advertising — not every unsolicited call.
A call that exclusively concerns an existing contractual obligation of the recipient (an open invoice, a due payment) is contractual communication, not advertising. It falls outside the scope of §7(2) UWG.
The line is drawn sharply once the call moves into advertising territory:
Permitted (contractual communication): notice of the due invoice, follow-up on payment, agreeing on instalments, information about consequences of non-payment.
Not permitted without further basis: upsell on another product, cross-sell, customer-satisfaction surveys outside the specific dunning context.
Stricter for B2C: when the debtor is a consumer, the contractual relationship must be documented. For B2B, the existing business relationship typically suffices.
EU AI Act Article 50 — the transparency duty at first word
EU AI Act Article 50 mandates: anyone who lets a natural person interact with an AI system must inform that person — unless it's obvious from context.
For voice agents in dunning this is straightforward to implement and, frankly, just good practice anyway: the call opens with a clear statement like Good day, my name is [name], I'm calling on behalf of [creditor]. I'm an AI-driven voice assistant supporting [creditor] with receivables management.
Three points for clean implementation:
The disclosure must come before the actual conversation, not in the middle or at the end. Delayed disclosure violates the substance of Art. 50.
It must be understandable, not buried in a legal-disclaimer-style preamble. AI voice assistant beats automated voice-processing system with large-language-model backend.
It must be given in the language of the call. Calling a French debtor in French requires the disclosure in French.
TDDDG and §201 StGB — recording handled cleanly
A dunning sequence without evidence preservation is weak in disputes. At the same time, §201 StGB is harsh: recording another's non-publicly-spoken words without consent is criminal — up to three years' imprisonment or a fine.
The answer isn't no recording, it's recording with proper consent. Three components make it durable:
Notice at the start of the call: This call is being recorded for documentation and quality purposes. If you don't agree, please say so now and I'll end the recording. With this notice and the debtor's continuation of the call, an implied consent is established.
Storage on EU-resident infrastructure with access controls, retention periods (typically three years, parallel to the receivable's statute of limitation), and a deletion workflow.
Transcript alongside audio. For later use as evidence a timestamped transcript with audio backup is more valuable than audio alone — faster to search, easier to cite.
GDPR legal basis for the voice workflow
Voice calls process personal data at several steps: debtor phone number, voice recording, transcript, conversational outcome (payment promised, instalments agreed, dispute raised). The GDPR requires a legal basis for each processing.
For the standard dunning configuration two bases apply in parallel:
Art. 6(1)(b) GDPR (contract performance): the receivable rests on a contract. Communication to perform that contract — including dunning by call — is necessary for contract performance.
Art. 6(1)(f) GDPR (legitimate interest): Recital 47 expressly names debt management as a legitimate interest. A balancing test is required — for overdue receivables the creditor's interest typically prevails.
What additionally needs documentation
Three layers that show up in every GDPR audit of a voice workflow:
Article 13 information notice: the debtor must be informed at the first dunning communication (typically written, before the voice call) that and how voice calls can form part of the dunning process.
Data residency and sub-processors: voice providers (Vapi, ElevenLabs, Twilio) must appear on a sub-processor list, DPA-compliant, with EU data residency or Standard Contractual Clauses.
Deletion and access workflow: debtor requests under Art. 15 (access) or Art. 17 (erasure) must reach the voice material — audio, transcript, metadata.
How kvit implements this in practice
The obligations above combine cleanly — which is what kvit built into the voice architecture from the start:
Script opening: every voice call starts with a standard opening in the debtor's language that covers three things at once: identity (name, instructing creditor), AI disclosure under Art. 50 AI Act, recording notice with opt-out. Four sentences, about twelve seconds.
Conversation: the voice agent stays strictly within the scope of the existing receivable. If the debtor raises topics outside (new products, complaints about other invoices, customer-service requests), the agent declines and refers them to the human service channel.
Storage: audio + transcript land on EU-resident infrastructure (Frankfurt). Retention three years parallel to limitation. Access only for the responsible operator and the creditor organisation; not for kvit personnel without explicit cause and documentation.
Audit log: every call — timestamp, duration, outcome, voice-provider identifier, script version — is written to the hash-chain-secured audit log. In a dispute the call is end-to-end reconstructable.
Language: the voice agent addresses the debtor in their native language (German, English, French, Italian, Spanish, Dutch in the first wave). That isn't just service — it's a precondition for compliant disclosure under Art. 50 AI Act.
What to ask in vendor due diligence
If you're evaluating a voice-capable dunning solution, five targeted questions separate serious vendors from problematic ones:
What is the standard opening of your voice agent? The answer must be a concrete audio sample or transcript. Identity disclosure, AI disclosure, and recording notice must appear in the first 15 seconds.
Which languages does the system support natively? English disclosure to an Italian debtor is an Art. 50 AI Act concern. Native language coverage should include at least DE, EN, FR, IT, ES.
Where are audio and transcripts stored? EU data residency in writing, sub-processor list, DPA template. Processed in the EU is not the same as stored in the EU.
How does the system handle a debtor withdrawing recording consent mid-call? The clean answer is: recording terminates immediately, the call continues without recording, the withdrawal is logged.
How is escalation to a human handled? Voice AI must not be a dead-end. The debtor must be able to reach a human contact at any time — either directly transferred or via a documented callback procedure.
When the regulator shifts the rules
Voice-AI regulation is visibly in motion in 2026. Three developments we track:
Tighter Art. 50 AI Act implementation at national level. Some EU member states are discussing stricter disclosure requirements — e.g. repeated mid-call reminders of the AI nature. Germany's federal government has so far been cautious.
Expanded recording requirements from the BSI and BfDI. A 2025 proposal would have mandated recording for AI-driven calls as a consumer protection — current status: in consultation.
Anti-spam legislation at EU level. An upcoming directive could treat voice AI as a distinct category, tightening opt-in requirements — even for contractual communication. Current status: in trilogue.
kvit responds to this not through lobbying but through architecture: the system is built such that stricter standards translate to software updates rather than business-model changes.
Frequently asked questions
- Do I need the debtor's consent before kvit calls?
For contractual communication — calls strictly concerning the open invoice — no. UWG §7 covers advertising, not contract performance. The legal basis is Art. 6(1)(b) GDPR (contract performance) and/or Art. 6(1)(f) (legitimate interest, Recital 47). What you should do: in the first written dunning communication, note that and how voice calls can form part of the process (GDPR Art. 13).
- Do I have to tell the debtor the voice is AI-generated?
Yes, under EU AI Act Article 50. The disclosure must come before the actual conversation, in the language of the call, in understandable phrasing. kvit handles this in the standard script: identity, AI disclosure, and recording notice fall in the first twelve seconds of the call.
- Can I record a dunning call?
With consent of the participants, yes. Without consent, no — §201 StGB criminalises unauthorised recording of non-publicly-spoken words. The clean approach: recording notice at the start of the call with an opt-out option. If the debtor objects, the recording is terminated, the call continues, and the objection is logged.
- What if the debtor says **I want to speak to a human**?
The request must be honoured. Voice AI must not be a dead-end — otherwise it breaches both good practice and the GDPR requirements on human oversight of automated processing. In such cases kvit either escalates directly to a human operator at the creditor or logs the request and schedules a callback within an agreed window.
- Which languages does kvit support for voice calls?
In the beta release DE, EN, FR, IT, ES, NL are productive. The language palette covers roughly 95 percent of the B2B debtor profile of DACH SME customers. Additional languages are added quarterly; inclusion decisions hinge on voice quality, latency, and legal-cultural auditability — not just raw model availability.
- What happens if the EU tightens voice-AI regulation?
Three movements are foreseeable — tighter Art. 50 AI Act disclosure in national implementation, possible recording mandates for AI calls, anti-spam expansions at EU level. The kvit architecture is built for that kind of tightening: script updates, storage configuration, and language coverage are software-level configurable. A tightening would be a software update, not a business-model rupture.
Read next
- SCHUFA, EU AI Act & invoice-scoringSister piece to this one: the architectural answer on the scoring question. Voice is communication, scoring is evaluation — each needs its own justification.
- Why kvit — a founder letterBackground on the decision to put multilingual voice AI in the product from day one — not as an add-on.
- AI in receivables managementDeeper on the concrete LLM and voice touchpoints in kvit — where we use language models and where we rely on deterministic software.
- Customer not paying — what to do?Operational playbook in which voice is one tool among several — when the call helps, when the letter, when the court Mahnverfahren.
Voice-architecture documentation for your DPO
kvit makes the full voice-workflow documentation available to customers on request — standard scripts in every supported language, sub-processor list, DPA template, deletion workflow. Write to legal@kvit.ai.
Request documentation