Compliance-First AI CX: 10DLC, TCPA, HIPAA, and Licensed-Advice Boundaries

Most teams treat compliance as the last box to tick before launch — a legal review, a disclaimer, a signature. In AI customer experience that order is backwards. The rules governing how you text a customer, what you can say, and who is allowed to say it are not a coat of paint applied at the end. They are the structural constraints that determine whether the thing you build survives its first audit. Every regulated industry has one sentence its AI agent must never say; the job is to design so it can’t.

This is a practitioner’s tour, not legal advice — treat it as a map of the terrain and confirm the specifics with your own counsel. We’ll walk the messaging layer (10DLC), consent and TCPA, STOP handling, HIPAA in a text thread, the insurance licensed-advice line, disclosure obligations, and the auditability that ties it together — ending with a pre-launch checklist you can run by industry.

The messaging layer: 10DLC registration and throughput

Before a single message goes out, the pipe itself has to be compliant. In the US, business texting over standard 10-digit long codes runs through the 10DLC framework: you register your brand and each messaging campaign with The Campaign Registry, and carriers vet them. This is not optional paperwork — it directly affects whether your messages arrive.

Registered, vetted traffic is delivered at meaningfully higher rates than unregistered traffic. Industry figures put deliverability for properly registered brands around 96–97%, versus roughly 92% or lower for non-vetted traffic that carriers filter or throttle. A few points of deliverability sounds small until you multiply it across every appointment reminder and every lead reply — the unregistered shortcut quietly taxes your revenue.

TCPA and consent: express written consent, revocation, quiet hours

The Telephone Consumer Protection Act (TCPA) governs when you may contact a consumer. The core requirements operators trip over:

• Consent must match the message type. Marketing messages generally require prior express writtenconsent; transactional/informational messages have a lower bar. Don’t use a transactional opt-in to justify a promotional blast.
• Consent must be revocable, easily. A customer can opt out at any time, by any reasonable means, and you must honor it promptly. Recent FCC rulemaking has tightened the window for processing revocation.
• Quiet hours apply.Absent an applicable exception, telemarketing calls and texts are restricted to roughly 8 a.m.–9 p.m. in the recipient’s local time. An always-on AI agent must respect the clock even though it never sleeps.

An agent that can text at 3 a.m. is an asset for answering inbound and a liability for sending outbound. Consent and quiet hours are what separate the two.

STOP handling and suppression that holds up

Opt-out handling is where good intentions meet operational reality. When a customer replies STOP (or any recognized variant), the obligation is immediate and durable: acknowledge, stop sending, and keep that number suppressed across every campaign — not just the one they replied to. The common failure is a suppression list that lives in one system while another system keeps messaging.

A defensible opt-out mechanism handles the standard keywords automatically, applies suppression at the account level, and logs the event with a timestamp. If a regulator or a plaintiff’s attorney asks you to prove a number was suppressed the moment it opted out, that log is the answer.

HIPAA: what counts as PHI in a text thread, and BAAs

For anyone in healthcare, the boundary is Protected Health Information. In a text thread, PHI is not just diagnoses — it can be the combination of an identifiable person with the fact that they are your patient, an appointment for a specific service, or a medication name. Treat the thread as capable of holding PHI and design accordingly.

The two practical rules

• A signed BAA is non-negotiable. Any vendor that touches PHI on your behalf must sign a Business Associate Agreement. No BAA, no PHI — full stop.
• Scope the agent to the non-clinical lane. Scheduling, reminders, and administrative intake can be automated within a defined scope; anything clinical escalates to staff. The agent should collect and route, never advise — a pattern that pairs directly with the handoff design this library covers.

Insurance: the licensed-activity boundary

Insurance is the cleanest illustration of the “one sentence” rule. An AI agent can do an enormous amount of useful work in an agency — take a first notice of loss at midnight, collect quote intake, answer billing questions, prep a renewal — but it cannot cross into licensed activity. It must never tell a caller whether they are covered, quote a binding price, or give coverage advice. That is a licensed producer’s sentence to say.

Regulators are formalizing this. The NAIC’s model bulletin on the use of AI by insurers has been adopted by a growing number of states, and several state departments of insurance have issued their own guidance — Colorado’s being among the most aggressive on governance and testing for unfair discrimination. The through-line is accountability: the carrier or agency remains responsible for what its AI does. Designing the licensed-advice boundary in from the start, rather than disclaiming it later, is what our insurance playbook calls compliance by design.

Disclosure: when you must say it’s AI

Whether you must tell a customer they’re talking to AI is increasingly answered by law, not just etiquette. Several states have enacted or proposed bot-disclosure requirements, and sector regulators are moving the same direction. Beyond the legal floor, disclosure is simply good practice: the trust research is unambiguous that concealment backfires the moment it’s discovered. The safe default is to disclose clearly, keep a human exit visible, and treat any jurisdiction-specific rule as a minimum rather than a ceiling.

Auditability: transcripts, retention, explainability

Every layer above shares one requirement: you have to be able to prove what happened. Regulators and litigants don’t accept “the AI decided that” as an answer. Auditability means three things in practice:

The point is that compliance is not a moment; it is a record you can produce on demand months later. If the system can’t reconstruct exactly what a customer was told and when they opted out, you don’t have a compliance story — you have a hope.

A pre-launch compliance checklist by industry

Before you turn anything on, run the layer that applies to you:

• Everyone (messaging): brand and campaign registered under 10DLC; consent captured and matched to message type; STOP handling and account-level suppression live and logged; quiet hours enforced by recipient time zone; disclosure of AI in place.
• Healthcare: signed BAA with every vendor touching PHI; agent scoped to non-clinical tasks; hard escalation rules for anything clinical; retention and access controls documented.
• Insurance:licensed-advice boundary scripted and enforced (no coverage determinations, no binding quotes); producer in the loop for advisory turns; alignment with the NAIC model bulletin and your state DOI’s guidance; testing and governance documented.
• All regulated verticals:the “one sentence” the agent must never say, written down, with a guardrail that prevents it and an escalation path that covers it.