ACMA rules for AI outbound calls: hours, identification, DNCR and consent

An AI caller doesn't get a lighter rulebook. The Do Not Call Register Act 2006 defines a voice call to include "a call that involves a recorded or synthetic voice", and ACMA's telemarketing standard uses that definition, so a call placed by an AI agent is regulated exactly like one placed by a person. What changes is scale: an AI can make the same mistake a thousand times before lunch.

This article sets out the rules that matter for outbound AI calling, translated into settings and checks you can build into the dialler. It sits within our guide to AI voice agents in Australia, which covers the wider picture.

Does your AI call count as telemarketing?

Start here, because it decides which rules apply. Broadly, a telemarketing call is one whose purpose, judged from its content and presentation, is to offer, advertise or promote goods, services, land or business opportunities, or to solicit donations. A call that only confirms an appointment the customer already booked is a different thing from a call that also pitches an upgrade. If a call has a commercial purpose, even a secondary one, treat it as telemarketing; the DNCR industry FAQs make the same point about research calls with a commercial angle.

Our practical rule: design every outbound call type on paper first, write down its purpose in one sentence, and if the sentence contains "offer", "promote", "upgrade" or "special", apply the full telemarketing rules.

Calling hours, in whose time zone

Section 8 of the Telemarketing and Research Calls Industry Standard 2017 sets the windows. For telemarketing calls:

The listed holidays are New Year's Day, Australia Day, Good Friday, Easter Monday, Anzac Day, Christmas Day and Boxing Day, plus a weekday substitute for any of them. Two details trip up automated diallers:

• Time zone is the recipient's, not yours. The times are measured at the account-holder's usual residential address. A Sydney business calling a Perth number at 9.05am Sydney time is calling at 6.05am or 7.05am in Perth, depending on daylight saving. A mobile number doesn't tell you where someone lives, so use the address you hold and default to the most conservative zone when unsure.
• Calling outside the window needs express consent to a particular call at that time. A form that says "call me any time" is weaker than a customer asking "can you ring me back at 8.30 tonight?". If the agent books an out-of-hours call-back, record who asked, when, and the exact time agreed.
• State and territory rules can sit on top. The standard says it doesn't exclude concurrent state or territory restrictions, so check any industry-specific rules in your state.

The standard also requires a call to end immediately if the caller learns the recipient is somewhere it is a prohibited time, unless the recipient expressly asks to continue.

What the agent has to say, and when

At the start of a telemarketing call, section 9 requires the caller to give their given name, the name of their employer or business, the name of the business the call is for (if different), and the purpose of the call. The given-name requirement doesn't apply where the call uses only a recorded or synthetic voice, but section 12 then requires a mechanism for the recipient to request the contact details they're entitled to.

On request, the caller must provide contact details for the business and for complaints, which under section 11 include an Australian number that can take calls in normal business hours and a current street, postal, email or web address. Our recommended opening for an AI caller covers all of that and adds two things we think every AI call should include, even where the standard doesn't spell them out:

Saying it's an AI avoids misleading anyone. Saying the call is recorded deals with recording and interception laws, which we cover in call recording laws in Australia. Offering to text the details gives you a ready mechanism for the contact-details requirement.

Ending the call and keeping caller ID on

Section 13 requires the caller to end the call immediately if the recipient asks, or otherwise indicates they don't want it to continue. For an AI this is a design requirement, not a script line. "Not interested", "stop calling me", "take me off your list" and a plain hang-up attempt should all end the call politely within a sentence, and the agent should set a do-not-call flag in the CRM so no other workflow rings that number again.

Section 14 requires calling line identification to be enabled for every call, and the number shown must be one the recipient can ring to get the business details within a reasonable time, staying able to receive calls for at least 30 days. Don't let an AI dial from a pool of random numbers that ring out. Use a stable Australian number that someone, or an inbound agent, actually answers.

The Do Not Call Register and how washing protects you

Section 11 of the Do Not Call Register Act 2006 says you must not make, or cause to be made, a telemarketing call to a registered number unless the call is a designated (exempt) call or the account-holder consented. Exempt categories cover bodies such as registered charities, government bodies, registered political parties and educational institutions calling current or former students; commercial businesses generally can't rely on them.

The protection that matters to a business is washing. If you submitted the number to the register and, within the 30 days ending on the day of the call, the register didn't report it as registered, the prohibition doesn't apply to that call. In practice that means re-washing outbound lists at least every 30 days and never calling from a list whose wash date you can't prove. Numbers stay on the register indefinitely, and ACMA notes that business numbers can't be registered, though mixed-use phones can be if personal use is more than half.

Consent expires sooner than most CRMs assume

Schedule 2 of the Act says express consent that isn't given for a specified or indefinite period is taken to be withdrawn three months after it was given. An enquiry from last year is not consent to a telemarketing call today unless the consent wording covered a longer period. Consent can also be withdrawn at any time. And consent can't be inferred just because a number was published, so scraping a website for phone numbers gives you nothing to rely on.

Bought lists and outsourced calling

ACMA is blunt that you cannot outsource your obligations by using a third party or a purchased list; the business is responsible. That applies equally to an AI vendor. Software can enforce the checks, but the business that causes the call remains accountable.

What enforcement looks like

ACMA does act on this. In July 2026 it announced that TAB paid more than $2.7 million in penalties after findings that included 351 calls to Do Not Call numbers without consent, 82 calls outside permitted hours and nearly 4,000 calls without properly identifying the caller or purpose, alongside marketing messages sent to people who had unsubscribed. Those are exactly the failure modes an automated dialler can multiply.

A compliance checklist to build into the dialler

Treat these as hard rules in the system, not reminders in a training document:

1. Every outbound call type has a written purpose, and a flag for whether it is telemarketing.
2. Calling windows are enforced per contact, using the contact's residential time zone and the national holiday list; unknown location defaults to the most restrictive zone.
3. Out-of-hours calls only happen against a recorded, specific request for that time.
4. Outbound telemarketing lists carry a wash date; the dialler refuses numbers with no wash in the past 30 days.
5. Consent records hold who, when, how and for how long; consent with no stated period is treated as lapsing after three months.
6. The opening names the business, the purpose, that it's an AI and that the call is recorded.
7. Any request to stop ends the call and sets a do-not-contact flag shared across calls and SMS.
8. Calls go out from a stable Australian number with CLI on that can take return calls for at least 30 days.
9. A human reviews a sample of outbound calls every week.

Fulcrum Lyre is designed around ACMA calling windows and DNCR washing, and it logs every outcome to the CRM so you have a record of what was said and when. Your business is still responsible for its own compliance, which is why we recommend keeping consent records in a CRM your agents and people both read; see keeping the CRM up to date automatically.

The 2027 sunset and what to watch

Legislative instruments generally sunset after ten years, and the Federal Register lists the 2017 standard as due to sunset on 1 April 2027. We haven't seen a published replacement as of November 2026, so expect ACMA to consult on a remade standard. Build your rules as configuration rather than hard-coding them, so a change to the hours or opening requirements is a settings update.

The safest outbound AI programme is one where most calls go to people who asked to be called, which is the model we describe in speed to lead with AI calls. Pair each call with the right text afterwards, following the Spam Act rules in SMS follow-up after a call.