# Review voice agent risk and compliance before launch

A buyer's review of the documents and rules around an AI voice agent: the BAA, SOC 2 report, GDPR data processing agreement, card data, call recording and the US rule on AI voices in calls.

- Level: Specialist
- Length: 70 minutes
- Exam questions: 11, pass mark 80%, up to 3 attempts
- Certificate: valid for 12 months

## What you will learn

- Explain when a business associate agreement is needed and the terms that 45 CFR 164.504(e) requires.
- Ask for a SOC 2 report and a GDPR Article 28 data processing agreement, and read what each one covers.
- Decide whether an agent should take card numbers and ask for the PCI DSS evidence and the redaction details if it does.
- State what FCC ruling 24-17 says about AI voices in calls and what a caller must do before an outbound campaign.

## Lessons

1. [Health data and the BAA](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review/health-data-and-the-baa.md) (15 minutes)
2. [Security reports and data processing](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review/security-reports-and-data-processing.md) (15 minutes)
3. [Card data, call recording and disclosure](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review/cards-recording-and-disclosure.md) (15 minutes)
4. [Outbound calls and the TCPA](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review/outbound-calls-and-the-tcpa.md) (15 minutes)

## Questions

### Is this course legal advice?

No. It lists the questions to ask and the documents to request. Ask your lawyer how each rule applies to your calls and your locations.

### Does the certificate of completion show that I can approve a vendor?

No. It records that you passed this site's exam. It is not a licence, an accreditation or a review of any vendor. Approval is your organisation's decision.

### Which rules does the course cover?

The BAA terms in 45 CFR 164.504(e), SOC 2 reports, GDPR Article 28, PCI DSS, US federal call recording law at 18 U.S.C. 2511 and FCC ruling 24-17 on AI voices. Rules change, so check the current text.

Also on the [web page](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review).