AI Collections Automation in the US: Reg F & TCPA Rules 2026

Published 16 October 2026 · 10 min read

How to automate US accounts receivable and collections with AI without breaking Regulation F, the TCPA or Regulation B. Architecture and checklist.

AI Collections Automation in the US: Reg F & TCPA Rules 2026

Short answer

You can automate most of a US accounts receivable and collections workflow with AI, but the rules that bite are not AI rules. They are the Fair Debt Collection Practices Act and its implementing regulation, Regulation F (12 CFR Part 1006), the Telephone Consumer Protection Act and the FCC's rules under it, and the general prohibitions on unfair, deceptive or abusive acts and practices. Regulation F's call-frequency presumptions, its 8:00 a.m. to 9:00 p.m. local-time window, its opt-out requirements for electronic messages, and the FCC's position that AI-generated voices count as "artificial" voices under the TCPA are the four constraints that decide what your automation is allowed to do.

So the technical work is less about the model than the control layer: a system of record for consent and contact attempts, hard stops enforced in code rather than in a script a human is meant to follow, and an audit trail that can reconstruct any single contact months later. That is an architecture problem, which is how we treat it in our AI operations automation work and across our United States engagements. Stratgik is a technology company, not a law firm, and nothing here is legal advice: the citations are included so your counsel can check our reading against the source.

Why AR and collections is the function teams try to automate first

Receivables work has the shape automation suits: high volume, repetitive decisions, data spread across two or three systems, and a cost of failure measurable in days sales outstanding. A lender, a healthcare revenue cycle team or a subscription business typically has a few people making the same four or five judgments thousands of times a month. The opportunities split cleanly by regulatory exposure:

Layer	What AI does well today	Regulatory exposure
Data and matching	Cash application, remittance parsing, invoice-to-payment matching, dispute classification	Low — no consumer contact
Prioritization	Propensity-to-pay scoring, channel and timing selection, segmentation	Medium — fair lending and UDAAP risk if outcomes differ by protected class
Outbound contact	SMS, email and voice outreach; payment-plan negotiation within fixed bands	High — FDCPA/Reg F, TCPA, state mini-FDCPA statutes
Inbound handling	Payment portals, balance questions, promise-to-pay capture	Medium — accuracy and disclosure obligations
Credit and account decisions	Underwriting, limit changes, account closures	High — ECOA/Regulation B adverse action notices

Most of the return sits in the low-risk layers. Cash application and dispute routing are the quiet wins and rarely need a lawyer in the room. The temptation is to jump to the outbound contact layer because that is where the collections lift appears — and where unexamined automation becomes expensive. Our manual process cost calculator gives a rough baseline from headcount and volume.

Regulation F: the four constraints that shape your system design

Regulation F took effect in November 2021 and modernized the FDCPA for email, text and voicemail. Collecting debts owed to another party makes you a debt collector and Part 1006 applies directly. Collecting your own debts generally falls outside it, but state statutes often extend similar duties to first-party creditors and UDAAP applies regardless. Build to the stricter standard; it costs very little extra.

1. Call frequency presumptions (12 CFR 1006.14(b))

There is no hard cap on calls — there are presumptions. Under 12 CFR 1006.14(b)(2)(i) a collector is presumed to comply if it places no more than seven calls about a particular debt within seven consecutive days, and does not call within seven consecutive days after a telephone conversation with the person about that debt. Exceed either and the presumption flips. The CFPB's Debt Collection Rule FAQs confirm the presumptions apply per person and per debt, that calls which do not connect still count, and that limited-content voicemails are not excluded from the count.

For an engineer this is a counter with two independent windows, keyed on person and debt, read before a dialer fires and written after. Two failures recur: the counter is keyed on phone number instead of person, so a consumer with three numbers gets three times the calls; and the conversation window lives in the agent CRM while the dialer runs off a separate table. Both are architecture mistakes, not policy mistakes.

2. Time and place (12 CFR 1006.6(b)(1))

A time before 8:00 a.m. or after 9:00 p.m. local time at the consumer's location is inconvenient by default, and "local time at the consumer's location" is the trap for automated systems. Area code is a poor proxy for where somebody lives, and a scheduler running in one server timezone will eventually send an 8:30 p.m. Pacific message at 11:30 p.m. Eastern. The commentary is also narrow on inference: "busy" or "cannot talk right now" applies only to that communication, whereas calling a time or place "inconvenient" creates ongoing knowledge you must store and honor.

3. Electronic opt-out (12 CFR 1006.6(e) and 1006.14(h))

Every electronic communication or attempt to communicate must carry a clear and conspicuous notice of a reasonable and simple method to opt out of further electronic communications through that medium — and the consumer does not have to use your stated method. Per the FAQs, words such as "stop," "unsubscribe," "end," "quit" and "cancel" are opt-out requests. Any AI handling inbound SMS or email must therefore classify intent rather than match keywords, and must fail safe: ambiguity resolves to an opt-out. You may send exactly one confirmation message containing nothing but the confirmation.

4. Accuracy (12 CFR 1006.18)

A debt collector must not use any false, deceptive or misleading representation in connection with collecting a debt. A generative model that improvises a balance, invents settlement authority it does not have, implies litigation nobody is contemplating, or mis-states the consequences of non-payment produces a potential violation on every turn. That is the strongest argument for constraining AI in the outbound layer to retrieved facts and pre-approved language — comprehension and routing, not free-form generation of consequential statements.

Separately, under 12 CFR 1006.34(a)(1)(i) the validation notice must go out in the initial communication or within five days of it, with a 30-day validation period defined in 1006.34(b)(5). A cadence that starts before the validation notice has demonstrably been sent is a sequencing defect built into the funnel.

TCPA and the FCC: where AI voice agents sit in 2026

On February 8, 2024 the FCC adopted a Declaratory Ruling holding that AI-generated voices are "artificial" voices under the TCPA. So an AI voice agent calling a consumer's cell phone generally needs the same prior express consent an artificial or prerecorded voice call needs — and the TCPA carries a private right of action with statutory damages, which is what turns a configuration mistake into class-action exposure.

Consent revocation is the other moving piece, and it has moved more than once. The FCC's revocation rules took effect April 11, 2025, including the duty to honor revocation made through any reasonable means. The part repeatedly deferred is the "stop one means stop all" element, under which revocation on one channel or for one purpose would apply across all of a sender's calls and texts. It was extended again in January 2026, now effective January 31, 2027, after an earlier deferral to April 11, 2026. These dates have slipped before and may slip again, so verify the current position with counsel.

Our advice is to build to "stop one means stop all" now regardless of the deadline. One suppression table shared across every channel and purpose is simpler than per-channel suppression, it is what consumers expect, and it avoids re-engineering on a date that keeps moving. We take the same position in the AI voice agent deployments we run.

If AI touches a credit decision, Regulation B enters

Receivables automation drifts easily into account decisions: reducing a limit, declining a payment plan, closing an account. When an adverse action is taken on credit, the Equal Credit Opportunity Act and Regulation B require specific and accurate reasons. CFPB Circular 2023-03 addressed this for complex and AI-driven models: creditors cannot fall back on the sample reason checklists in Regulation B's model forms where those do not reflect the actual reason, and a model whose reasons cannot be stated specifically does not relieve the creditor of the obligation. So any model that can contribute to an adverse action needs per-decision reason attribution captured at inference time and stored with the decision. Retrofitting explainability is far harder than logging it when the decision is made.

A reference architecture that holds up

The pattern we keep arriving at separates the model from the rules, and puts the rules where they cannot be bypassed:

Consent and suppression service. One authoritative store for consent, revocation, channel preferences, inconvenient times and places, and disputes. Every outbound path queries it; nothing keeps a local copy.
Contact ledger. Append-only log of every attempt and connected communication, keyed on person and debt, with channel, local-time timestamp, template or transcript identifier and outcome. This is what the frequency presumptions compute from and what an examiner asks for.
Policy engine. Deterministic rules evaluated before any send — frequency windows, time of day, suppression, validation-notice status, state overlays — expressed as code with tests, not as prompt instructions. A model should never be the thing standing between you and a violation.
Model layer, deliberately narrowed. AI for classification, retrieval, summarization, intent detection and language handling; consequential statements, amounts and authority bounded by retrieval and templates.
Human escalation. Explicit triggers: dispute language, bankruptcy or attorney representation, hardship signals, cease-communication requests, and anything the classifier is unsure about.
Evidence layer. Immutable retention of transcripts, templates and the policy decision for each contact, aligned to the longest applicable limitations period.

Note what is load-bearing. Points one to three are ordinary software engineering with no AI in them at all, and they are where almost all the compliance value sits. Teams that build the model first and the ledger later rebuild both.

Implementation checklist

Confirm with counsel whether you are a third-party debt collector, a first-party creditor, or both across portfolios.
Map every state you contact consumers in; several impose licensing and stricter limits than the federal floor.
Establish local time from a reliable field, not area code, and store the source.
Key frequency counters on person and debt, not phone number; count non-connecting calls and limited-content voicemails.
Implement opt-out as intent classification with a fail-safe default, not keyword matching.
Gate every cadence on confirmed delivery of the validation notice.
Treat AI voice as artificial voice for consent; record the consent basis per phone number.
Build one cross-channel suppression table now, ahead of the deferred FCC element.
Capture per-decision reason codes wherever a model can contribute to an adverse action.
Run a pre-launch review: sample contacts for accuracy and for any statement readable as false or misleading.
Give compliance a read-only console over the contact ledger, and review quarterly against rule changes.

Sequencing and cost

We will not quote figures for a portfolio we have not seen, but the shape is predictable. The consent service, contact ledger and policy engine are a well-defined build measured in weeks rather than quarters. The model layer is cheap by comparison and belongs after the control layer is tested. The expensive version of this project starts with a vendor demo and discovers six months later that suppression logic lives in three places. For a structured view of your own stack first, the AI automation opportunity scanner and build vs buy tool are free.

Frequently asked questions

Can an AI agent legally call US consumers about a debt?

Generally yes, subject to consent and conduct rules. Because the FCC treats AI-generated voices as artificial voices under the TCPA, calls to cell phones generally require prior express consent of the kind an artificial or prerecorded voice call needs, and the call must still respect Regulation F's frequency presumptions, the 8:00 a.m. to 9:00 p.m. local-time window, and the prohibition on false or misleading statements. Confirm the analysis for your portfolio and states with counsel.

Does Regulation F cap collection calls at seven per week?

Not exactly. 12 CFR 1006.14(b)(2) creates presumptions rather than a cap: staying within seven calls per seven days per person per debt, and not calling within seven days of a telephone conversation about that debt, gives you a presumption of compliance. Going beyond either creates a presumption of violation that you would have to rebut.

What counts as a valid opt-out from an AI text or email?

Any reasonable expression of intent. The CFPB's FAQs confirm the consumer need not use the method you specified, and that terms such as "stop," "unsubscribe," "end," "quit" and "cancel" are opt-out requests. Keyword matching alone is insufficient; classify intent and default to suppression when uncertain.

How do we handle AI involvement in account or credit decisions?

Capture reason attribution at the moment of inference. CFPB Circular 2023-03 makes clear that using a complex or AI-driven model does not reduce the ECOA and Regulation B obligation to give specific and accurate reasons for an adverse action, and that the sample reason checklists cannot be used where they do not reflect the real reason.