On September 16, 2026, HDFC Life held the third edition of its AI showcase, InsurAI 3.0, themed “Human AI Collaboration.” According to the event coverage, the insurer presented 33 enterprise AI solutions across voice AI, vision AI, agentic AI, sales, complaint analytics and customer service, including GenAI voice bots for service and cross-sell, complaint prediction with AI-drafted responses, and underwriting that combines automation with human oversight. Its COO described collaboration between AI and people as a deliberate theme.
HDFC Life is one example of a wider shift across banks, insurers, lenders and collections teams worldwide. Voice AI is leaving the demo room and entering regulated customer conversations: sales, servicing, renewals, collections and complaints. That raises a question many governance programmes have not yet answered. This article explains why voice is a distinct risk, why governing the bot is only half the job, and a six-step plan to audit calls continuously.
Crest.Digital’s Voice AI agents handle multilingual evidence follow-up and outreach with every conversation recorded, summarised and tied to an audit trail. See the Crest.Digital platform for the wider risk picture.
Explore Voice AIVoice AI Is Moving From Demo to Regulated Customer Interaction
For years, financial services used automation mainly behind the scenes: scoring, fraud rules, document extraction. Customer-facing automation was limited to menus and scripted chatbots. Generative voice changes the profile. A voice agent can hold a natural conversation, switch languages, answer questions about a product and propose a next step, all without a person on the line.
That is valuable for service levels and cost, but every spoken sentence is now a potential regulatory event. Regulators such as the Reserve Bank of India and IRDAI set expectations for fair treatment of customers, disclosures, grievance handling and conduct in sales and recovery, and similar conduct regimes apply in other markets. The firm remains responsible when the voice on the line is an AI. The EU’s AI Act adds transparency duties for AI systems that interact with people; check which obligations apply to your markets and timelines.
Why Voice Carries Different Risk From Text
Text channels leave a readable record and allow pre-approved templates. Voice is faster, less structured and harder to inspect. Four features make it a distinct control problem.
Four Reasons Voice Needs Its Own Controls
- It is real time. There is no draft to review. A missed disclosure or an overstated benefit is said before anyone can intervene.
- It is multilingual. Customers switch between languages and dialects mid-call. Controls tested only in English leave the largest customer groups unchecked.
- It creates spoken commitments. Promises about fees, payment dates, claim outcomes or returns can be treated as binding by customers and regulators.
- It reaches vulnerable customers. Distress, confusion or financial difficulty is often audible before it is written down, and escalation to a human has to be triggered quickly.
Sampling does not scale to this. Traditional quality assurance listens to a small percentage of calls, chosen at random, weeks later. As we argue in AI is quietly moving audit from sampling to continuous assurance, a sample tells you about the calls you heard, not the ones you did not. When an AI agent can handle thousands of calls a day, a one-in-fifty sample is no longer a credible control.
Don’t Just Govern the Bot. Audit the Calls.
Most AI governance work focuses on the system: a model inventory, a risk assessment, approved use cases and testing before launch. These are necessary, and our pieces on registering AI agents as non-human users and governing at machine speed with policy-as-code describe the design-time layer. But a bot that passed testing in August can drift in October after a model update, a prompt change or a new product script.
The second layer is outcome assurance: evidence about what was actually said, to whom and with what result. This is the same logic as an independent assurance layer for AI agents. Design-time governance asks whether the agent is allowed to do this. Call audit asks what it did. Both are needed, and the second is the one regulators and internal auditors will test.
The same applies to human agents. Once you have a pipeline that reads every call, there is no reason to exclude human-handled calls. A single standard across both gives you a fair comparison, and it shows where the AI is better or worse than the baseline.
A Six-Step Plan for Continuous Call Audit
The chain runs from recording to evidence: recording, transcript, script and policy check, prohibited language, disclosures and commitments, exception, supervisor review and retained evidence. Here is how to put it into operation.
Capture Every Call With Consent and Metadata
Record calls under the applicable notice and consent rules, and tag each with channel, product, language, agent type (human or AI) and customer segment. Clean metadata is what makes later analysis and sampling defensible.
Transcribe Accurately, Including in Local Languages
Convert speech to text in the languages customers actually use, with accuracy measured by language and accent. A control that works only in English will miss the calls where conduct risk is highest.
Check Each Call Against Script and Policy
Compare the transcript with approved scripts and policy rules: identity checks, mandatory disclosures, product suitability statements and recording notices. Record pass, fail or partial for every rule.
Detect Prohibited Language and Unapproved Promises
Flag pressure tactics, misleading claims, abusive language, and commitments such as fee waivers or payment dates that exceed what the agent, human or AI, is authorised to offer.
Route Exceptions to a Supervisor With the Evidence
Send each flagged call to a named reviewer with the clip, transcript excerpt and rule breached. Set deadlines, capture the decision and track remediation, retraining or script changes to closure.
Retain Evidence and Report Trends Upward
Keep dated results, reviewer decisions and fixes in an immutable record. Give compliance, internal audit and the risk committee a regular view of coverage, exception rates and repeat issues by product, team and language.
Internal audit can then place reliance on this record, applying the testing principles of the Institute of Internal Auditors. The distinction we draw in evidence is not assurance still applies: the pipeline supplies evidence, and accountable people reach the conclusion.
Crest.Digital’s Agentic GRC links voice interactions to controls, exceptions and remediation, so a flagged call becomes a tracked action rather than an email. Relevant for banking, insurance and other regulated industries.
Where Agentic AI Fits, and Where People Must Stay
Reading every call is exactly the kind of high-volume, rules-plus-judgement work that agentic AI handles well. Agents can transcribe, apply a rule library, score each call, cluster repeat issues, open an exception, notify the reviewer and track the fix to closure. Voice agents can also follow up with customers or process owners to close an issue, in their own language.
What they should not do is decide on their own that a breach occurred or what the penalty or remediation should be. Those decisions stay with compliance, supervisors and, where relevant, legal. Every automated step needs a log of what was reviewed, which rule fired and who approved the outcome, the principle behind why AI agents need audit trails and the broader human-in-control principle now emerging in AI codes of conduct.
There is also a third-party dimension. Voice stacks typically combine a speech model, a language model, telephony and hosting from different suppliers. Banks and insurers should treat the voice agent as a monitored vendor chain, a point developed in our sector guides for banking and insurance third-party risk.
Your Turn: How Much of Your Call Volume Do You Hear?
- Sampled: A small random sample of calls is reviewed manually, weeks later.
- Targeted: Analytics flag high-risk calls, but evidence and follow-up are manual.
- Continuous: Every call is analysed, exceptions are tracked to closure and trends reach the risk committee.
Where does your voice channel sit today? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
Continuous call audit means reviewing every recorded customer call, or a risk-weighted majority of them, using automated transcription and analysis rather than a small manual sample. Each call is checked against scripts, mandatory disclosures, prohibited language and commitments made to the customer, and exceptions are routed to a supervisor with the evidence attached. It applies to calls handled by humans and by voice AI, and it gives compliance and internal audit a complete, dated record instead of a sample.
Voice is real time, spoken and often multilingual, so there is no chance to review a message before the customer hears it. Tone, interruptions and dialect affect what a customer understands, and a spoken promise or missed disclosure can create conduct risk within seconds. The control therefore has to combine design-time safeguards, such as approved scripts and escalation rules, with run-time monitoring and after-call analysis of what was actually said.
At minimum: that the customer was told they were speaking to an AI where required, that mandatory disclosures were read in full, that no prohibited or misleading language was used, that any promise or commitment was within approved limits, that vulnerable-customer and complaint triggers were escalated to a human, and that consent and recording notices were given. Each check should produce a timestamped result linked to the recording and transcript so it can be evidenced later.
No. Automation reads and scores far more calls than any team could, and flags exceptions. Supervisors, compliance officers and quality teams still review the flagged calls, decide whether a breach occurred and agree remediation. Their time moves from random listening to judging the cases that matter. This human-in-the-loop model also supports the oversight expectations regulators are signalling for AI used with customers.
Most voice AI is built on models, telephony and speech services supplied by third parties, so the bank or insurer remains accountable for outcomes it does not fully control. Vendor due diligence should cover model providers, hosting, data handling and subprocessors, and call audit gives ongoing evidence that the supplied service behaves as contracted. Treating the voice agent as a monitored third party, with an owner, risk tier and exception log, joins the two disciplines.