Compliance

TDRA-compliant AI calling in the UAE.

AI calling is legal in the UAE — when it follows TDRA rules. Here's what the regulations require, and how Nicole stays inside them.

Since 27 August 2024, UAE Cabinet Resolutions No. 56 and 57 of 2024 govern all marketing calls — including those made by AI voice agents. The rules apply to every licensed company, free zones included.

Done right, automated calling is fully compliant. Done carelessly, penalties reach AED 150,000. LeadPilot is built so your outreach stays inside the lines from day one.

What the TDRA regulations require

01Prior approval — businesses must register telemarketing activity with the TDRA before calling.
02Calling hours — marketing calls are permitted only between 9:00 AM and 6:00 PM local time.
03Local numbers — calls must use UAE numbers registered under your commercial licence, never personal numbers.
04Do Not Call Registry (DNCR) — consumers can opt out; companies must not call registered numbers, and must stop after a rejection.
05Consent & data (PDPL) — explicit opt-in consent is required to use customer data under the Personal Data Protection Law.
06Records & reporting — every call must be logged and reportable to the authorities on request.

How Nicole keeps your AI calling compliant

→Calling windows are enforced automatically — Nicole never dials outside 9:00 AM–6:00 PM.
→Outreach runs on your registered UAE numbers, tied to your commercial licence.
→DNCR and opt-out logic is built in — rejected and registered contacts are suppressed automatically.
→Every conversation is recorded, transcribed and logged, giving you the audit trail the regulations expect.
→Consent capture and language are configured into the scripts, with PDPL-aligned data handling.
Note: this page is general information, not legal advice. Final compliance sign-off should be confirmed with the TDRA or your legal advisor.

What counts as a marketing call

The regulations cover any call whose purpose is to promote, sell or advertise a product or service — regardless of who or what places the call. A human agent working from a list, a dialler, and an AI voice agent are treated the same way. The technology is not the regulated object; the intent of the call is.

This distinction matters in practice, because most LeadPilot calls are not cold outreach at all. A call placed to somebody who has just submitted a form on your website, replied to your advertisement, or messaged your WhatsApp number is a response to an enquiry, not a marketing call to a stranger. Response calls carry a materially lower risk profile, and they are the bulk of what Nicole does.

Where genuine cold outreach is involved — an old customer database, a purchased list, a campaign to numbers that never contacted you — the full weight of the rules applies: prior registration, approved local numbers, calling windows, DNCR screening and a retrievable record of every attempt.

What non-compliance costs

Penalties under the 2024 framework escalate with repetition. First violations attract warnings and lower-band fines; repeat offences carry fines reported up to AED 150,000, and persistent breach can lead to suspension of telemarketing permissions or referral of the licence to the regulator.

The commercial risk is usually larger than the fine. A company that has its calling permissions suspended loses its outbound channel entirely, often at the point where a campaign is already funded. Complaints also travel: a number that generates repeated DNCR complaints can end up flagged across carriers, which degrades answer rates long before any formal penalty lands.

The practical conclusion is that compliance is not a legal formality bolted onto a campaign. It is what keeps the channel usable.

Consent, opt-out and suppression in practice

Under the Personal Data Protection Law, personal data may only be processed on a lawful basis, and marketing contact generally requires consent that was freely given and specific. In an operational sense this means you should be able to answer one question for any number you dial: where did this contact come from, and what did they agree to?

Three suppression layers should exist before a campaign starts:

01Registry suppression. Numbers on the national Do Not Call Registry are removed from the calling list before dialling, not skipped at call time.
02Your own opt-out list. Anyone who has previously asked not to be contacted — by call, WhatsApp, email or in person — must be permanently suppressed across every future campaign.
03In-conversation rejection. If a person declines during the call, the number is suppressed immediately and no follow-up sequence is triggered.

Suppression has to be permanent and account-wide. A contact who opted out of a real-estate campaign should not resurface six months later in a different list under a different campaign name. LeadPilot holds suppression at the contact level, not the campaign level, precisely to prevent that.

A compliant opener, line by line

Most compliance failures happen in the first fifteen seconds — an unclear identity, no stated reason for the call, no easy exit. A safe opener resolves all three before asking anything.

IdentityGood morning, this is Nicole calling on behalf of [Company Name] in Dubai.

ReasonYou enquired about [service] on [channel] earlier today — I'm following up on that.

PermissionIs now a good moment, or would you prefer I call back later?

ExitIf you'd rather we didn't contact you again, just say so and I'll remove your number.

Four elements: who is calling, why, whether the moment is convenient, and how to stop. Each is short, and each is stated before any qualification question. Where a call is being recorded, disclosure of the recording belongs in the same opening block.

Nicole's scripts are configured to your business, but this structure is fixed. It cannot be edited out of a campaign.

The audit trail regulators expect

If a complaint is raised, the question is rarely whether you intended to comply. It is whether you can show what happened. That requires a per-call record which survives staff turnover and campaign changes.

→Timestamp, duration and outcome of every attempt, including unanswered calls.
→The number dialled, the registered line used, and the campaign it belonged to.
→Source of the contact — form, advertisement, WhatsApp enquiry, existing customer record.
→Recording and transcript, where recording is used and disclosed.
→Any opt-out request, the moment it was received, and confirmation of suppression.

LeadPilot produces this record automatically for every call. Nothing depends on an agent remembering to log an outcome.

Before your first campaign

01Telemarketing activity registered with the regulator under your commercial licence.
02Calling numbers registered to the company, never to an individual.
03Calling window restricted to 9:00 AM–6:00 PM, enforced by the system rather than by policy.
04List screened against the DNCR and your own suppression list.
05Consent basis documented for every contact source in the campaign.
06Opener includes identity, reason, permission and exit; recording disclosed if used.
07Logging and retention configured, with a named owner for complaint response.
08Escalation path defined for anything a person should handle.

Frequently asked questions

Is AI calling legal in the UAE?
Yes. There is no prohibition on using an AI voice agent. The call must follow the same rules as any marketing call: registered activity, approved local numbers, 9:00 AM–6:00 PM window, DNCR screening, a lawful basis for the data, and a retrievable record.
Does Nicole have to say she is an AI?
The regulations focus on identifying the company on whose behalf the call is made rather than mandating a specific AI disclosure. LeadPilot's default is to identify the company clearly and to answer honestly if the person asks whether they are speaking to a person. We recommend keeping that default.
Do the rules apply to free zone companies?
Yes. The 2024 resolutions apply to companies licensed across the UAE, free zones included.
Do the rules apply to WhatsApp follow-up as well as calls?
Marketing messages are subject to consent and opt-out expectations under the data protection framework. In practice, treat WhatsApp outreach with the same discipline as calling: lawful basis, honest identification, and immediate suppression on request.
Can we call a customer who contacted us at 8 PM?
Responding to an active enquiry is different from cold marketing outreach, but the conservative approach — and LeadPilot's default — is to keep voice calls inside the permitted window and to reply on the channel the customer used until the window opens.
How long should call records be kept?
Long enough to answer a complaint or regulator request, and no longer than your data policy allows. Retention is configurable per client; agree the period with your legal advisor before launch.
Who is responsible if a call breaches the rules — us or LeadPilot?
Regulatory responsibility sits with the licensed company on whose behalf the call is placed. LeadPilot's role is to make compliant operation the default and to give you the evidence trail; the registration and the consent basis remain yours.

Get started

Ready to see Nicole work your leads?

Send us your current lead sources. We'll show where conversations are being lost and how Nicole would handle them.

Book a demo → See Nicole in action

Designed & automated by

automa