The FCC's February 2024 ruling confirmed that AI-generated and cloned voices count as "artificial or prerecorded voice" calls under the TCPA — which means they need prior express written consent to reach a cell phone or residential line. The damages are per call, and they stack fast. Plug in your numbers to see the order of magnitude, then the controls that bring it to near zero.
TCPA exposure has three properties that make it different from vague "AI risk": it's dated (the FCC ruling is from February 2024), it's quantified (statutory damages are fixed per call, no need to prove harm), and it's exactly what a buyer's security and legal team screens for when an AI-calling vendor shows up in procurement. That combination is why a stalled enterprise deal over AI voice is often resolved not by a new audit but by a documented consent program and a signed attorney attestation the buyer can rely on.