Processes voice recordings, in the European Union

Directive 2002/58/EC, Art. 5(1) and (2) · Read the law's page

• Under the national law that transposes Article 5(1), do not listen to, tap, store, or otherwise intercept or monitor, as a person other than its users, the content or related traffic data of a communication carried over a public electronic communications network without the consent of the users concerned, unless legislation adopted under Article 15(1) authorises it as a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.
• A recording that national law legally authorises and that is made in the course of lawful business practice to provide evidence of a commercial transaction or other business communication is not caught by the consent rule above; check the Member State's own law for whether, and on what further conditions, it authorises such recording.

Directive 2014/65/EU, Art. 16(7); Commission Delegated Regulation (EU) 2017/565, Art. 76 · Read the law's page

• It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Article 4(1), point (1), of the Directive): record the telephone conversations and electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders, including those intended to result in such transactions or services even if they do not (Article 16(7)).when it serves a financial business
• Take all reasonable steps to record the relevant telephone conversations and electronic communications made with, sent from or received by equipment you provide to an employee or contractor, or whose use by an employee or contractor you have accepted or permitted, and all reasonable steps to prevent an employee or contractor from making, sending or receiving relevant conversations and communications on privately-owned equipment you are unable to record or copy (Article 16(7)).when it serves a financial business
• Notify new and existing clients that telephone communications or conversations between you and your clients that result or may result in transactions will be recorded. The notification may be made once, before you provide investment services to the client (Article 16(7)).when it serves a financial business
• Before you provide services relating to the reception, transmission and execution of orders to a new or existing client, inform the client that conversations and communications are being recorded and that a copy of the recording will be available on request for five years and, where the competent authority requests, for up to seven years, in the same language or languages as you use to provide investment services to clients (Article 76(8)).when it serves a financial business
• Do not provide, by telephone, investment services and activities relating to the reception, transmission and execution of client orders to a client who has not been notified in advance about the recording of the client's telephone communications or conversations. A client may place orders through other channels, but those communications must be made in a durable medium such as mails, faxes, emails or documentation of client orders made at meetings (Article 16(7)).when it serves a financial business
• Record in a durable medium all relevant information related to relevant face-to-face conversations with clients, including at least the date and time of the meeting, its location, the identity of the attendees, the initiator of the meeting and relevant information about the client order including the price, volume, type of order and when it is to be transmitted or executed (Article 76(9)).when it serves a financial business
• Provide the records to the client involved upon request and keep them for five years and, where the competent authority requests, for up to seven years, counted from the date the record is created (Article 16(7) of the Directive and Article 76(11)).when it serves a financial business
• Store the records in a durable medium that allows them to be replayed or copied, retain them in a format that does not allow the original record to be altered or deleted, keep them readily accessible and available to clients on request, and ensure the quality, accuracy and completeness of the records of all telephone recordings and electronic communications (Article 76(10)).when it serves a financial business
• Establish, implement and maintain a written policy on recording telephone conversations and electronic communications, appropriate to the size and organization of the firm and the nature, scale and complexity of its business, which identifies the conversations and communications subject to recording and sets out the procedures to follow where exceptional circumstances leave you unable to record on devices you issued, accepted or permitted, with the evidence of those circumstances retained and accessible to competent authorities (Article 76(1)).for a financial business
• Give the management body effective oversight and control over the recording policies and procedures, keep the arrangements technology-neutral and evaluate them periodically (adopting further measures at least when a new medium of communication is accepted or permitted), keep and regularly update a record of the individuals with firm devices or approved privately owned devices, train employees in the procedures, monitor the records of transactions and orders periodically on a risk-based and proportionate basis, and demonstrate the policies, procedures and management oversight to the competent authorities on request (Article 76(2) to (7)).for a financial business
• Directive 2014/65/EU is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034), so you meet its rules through each Member State's transposing law. Commission Delegated Regulation (EU) 2017/565 is directly applicable and applies from the same date (Article 91).

Directive (EU) 2019/1937, Art. 18(2) and (4) · Read the law's page

• Offer the reporting person the opportunity to check, rectify and agree the transcript of the call by signing it (Article 18(2)).
• Where a person requests a meeting with your staff members for reporting purposes, ensure, subject to the consent of the reporting person, that complete and accurate records of the meeting are kept in a durable and retrievable form, either by recording the conversation in a durable and retrievable form or through accurate minutes of the meeting prepared by the staff members responsible for handling the report (Article 18(4)).
• Offer the reporting person the opportunity to check, rectify and agree the minutes of the meeting by signing them (Article 18(4)).
• Directive (EU) 2019/1937 is addressed to the Member States (Article 29), which had to bring into force the measures necessary to comply with it by 17 December 2021, and by 17 December 2023 for the obligation of private-sector legal entities with 50 to 249 workers to establish internal reporting channels (Article 26(1) and (2)), so you meet its rules through each Member State's transposing law.
• It reaches you if you are a legal entity in the private sector with 50 or more workers, a legal entity in the private sector within the scope of the Union acts referred to in Parts I.B and II of the Annex whatever its number of workers, a legal entity in the public sector that your Member State has not exempted, or a competent authority designated to receive reports (Article 8(3), (4) and (9), Article 11(1)): where an oral report is made through a recorded telephone line or another recorded voice messaging system, you may document it, subject to the consent of the reporting person, by making a recording of the conversation in a durable and retrievable form or through a complete and accurate transcript prepared by the staff members responsible for handling the report (Article 18(2)).

Regulation (EU) 2024/1689, Article 4 · Read the law's page

• Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.Makes itRuns itproviderdeployer
• This duty does not require you to guarantee any specific level of AI literacy for any individual.Makes itRuns itproviderdeployer

Commission Delegated Regulation (EU) 2025/1140, Art. 2(2) and Annex, Section 1; Regulation (EU) 2023/1114, Art. 68(9) · Read the law's page

• It reaches you if you are a crypto-asset service provider, meaning a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis and that is allowed to provide crypto-asset services in accordance with Article 59 of Regulation (EU) 2023/1114 (Article 3(1), point (15), of that Regulation): keep records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order (Article 2(2) and Annex, Section 1, communication with clients).when it serves a financial business
• Retain the records in a medium that lets the competent authority access them readily and reconstitute each key stage of the processing of each crypto-asset service, activity, order or transaction, lets any corrections or other amendments and the earlier contents be ascertained, and does not allow the records to be manipulated or altered (Article 2(1)).when it serves a financial business
• Provide the records to clients upon request and keep them for five years and, where the competent authority requests before five years have elapsed, for up to seven years (Article 68(9) of Regulation (EU) 2023/1114).when it serves a financial business
• Delegated Regulation (EU) 2025/1140 is binding in its entirety and directly applicable in all Member States and entered into force on the twentieth day after its publication on 10 June 2025 (Article 18); it specifies the records that Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to keep (Article 68(10) of that Regulation).

Directive 2011/83/EU, Art. 16a(3), second sentence, as inserted by Directive (EU) 2023/2673 · Read the law's page

• It reaches you if you are a trader in a distance contract with a consumer for the supply of financial services (Article 3(1b) of Directive 2011/83/EU) and you communicate with the consumer by voice telephony: when a call is being recorded, or might be recorded, notify the consumer that this is the case (Article 16a(3), second sentence).when it serves a financial business
• This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's transposing law.

Regulation (EU) 2024/1689, Article 50 · Read the law's page

• If you are a provider of an AI system intended to interact directly with natural persons, design and develop it so that the people it interacts with are informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use (Article 50(1)). This does not apply to an AI system authorized by law to detect, prevent, investigate or prosecute criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties, unless the system is available for the public to report a criminal offense.Makes itprovider
• If you are a provider of an AI system, including a general-purpose AI system, that generates synthetic audio, image, video or text content, ensure that its outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, using technical solutions that are effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art (Article 50(2)). This marking duty is the provider's; a deployer's disclosure duties are in Article 50(3) and (4). It does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data the deployer provided or its semantics, or where authorized by law to detect, prevent, investigate or prosecute criminal offenses.Makes itprovider
• If you are a provider of an AI system that generates synthetic audio, image, video or text content and was placed on the market before 2 August 2026, take the necessary steps to comply with the Article 50(2) marking duty by 2 December 2026 (Article 111(4), inserted by Regulation (EU) 2026/1744).Makes itprovider
• If you are a deployer of an emotion recognition system or a biometric categorisation system, inform the natural persons exposed to it of the operation of the system, and process their personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable (Article 50(3)). This does not apply to an AI system used for biometric categorisation and emotion recognition that is permitted by law to detect, prevent or investigate criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties and in accordance with Union law.Runs itdeployer
• If you are a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake, disclose that the content has been artificially generated or manipulated (Article 50(4)). A deep fake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3, point (60)). Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the disclosure is limited to the existence of the generated or manipulated content, in an appropriate manner that does not hamper the display or enjoyment of the work. This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses.Runs itdeployer
• If you are a deployer of an AI system that generates or manipulates text that is published with the purpose of informing the public on matters of public interest, disclose that the text has been artificially generated or manipulated (Article 50(4)). This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses, or where the AI-generated content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication of the content.Runs itdeployer
• If you owe the information required by Article 50(1) to (4), provide it to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, in a form that conforms to the applicable accessibility requirements (Article 50(5)).Makes itRuns itproviderdeployer

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).