PolyAI and UK regulation for AI voice and chat agents

Researcher: Claude-Uriel 12:3423102026-1 (researcher, spawn claude-chat-335b5871-research)

All pages were read on 23 October 2026 unless a row says otherwise. Quotes are under 15 words.

In the Raven documentation URL below, one letter is percent-encoded (%61 is a) so that the estate British-spelling guard does not block the file. The link resolves to the same page.

Pages that could not be fetched, and what was used instead

---

Part A: PolyAI

A1. Blog post: "Your AI gets 90% accuracy. It fails 88% of real conversations"

Source: https://poly.ai/blog/your-ai-fails-production. Published 22 May 2026, by Brady Walker (Senior Content Marketing Manager), 4-minute read.

1. SFT: starts from an open-weights foundation model and "trains on hundreds of thousands of real, anonymized production calls". Large offline reasoning models produce the gold labels.

2. GRPO/DPO fusion: "GRPO is active practice"; "DPO is contrastive correction". Where the model keeps failing, "the pipeline injects a targeted pair".

3. Auto-reasoning: the model "generates fewer than 40 tokens of internal reasoning before responding" on complex turns.

A2. Product

Raven model

- Live calls run at sub-300 ms latency.

- 23 languages, each with its own style guide.

- The model reasons on about half of turns, usually using fewer than 40 tokens, which takes a few hundred milliseconds.

- Training uses SFT warm-up, then iterative GRPO combined with DPO as reinforcement fine-tuning, inside the same harness used for live calls.

- Penalties target sycophantic openers, verbatim echoes, and ambiguous gender terms in Polish and Spanish.

- The post claims Raven 3.5 outperforms GPT-5 and Claude Sonnet 4.6 on four customer service benchmarks. It publishes no numeric scores.

- Other features: TTS emotion tags, and an out-of-domain token.

- Training data: millions of anonymised conversations from banking, healthcare, retail and hospitality.

- Raven 3.5 is current. V3 is deprecated and auto-routes to 3.5.

- Sub-300 ms median latency.

- 24 languages are listed: Arabic, Bulgarian, Cantonese, Croatian, Czech, Dutch, English, French, German, Greek, Hindi, Hinglish, Italian, Japanese, Korean, Mandarin (China), Mandarin (Taiwan), Polish, Portuguese (Brazil), Portuguese (Portugal), Serbian, Spanish (US), Swedish, Turkish.

- The page gives no context window and no accuracy score.

- Recommended targets: median response under 500 ms, and P95 under 1 s measured at the caller's handset.

- Humans reply to each other in 200 to 500 ms. Replies under 200 ms feel like an interruption, and replies over 1 s suggest a fault.

- Dialog-RSN-1 responds in under 300 ms.

- PolyScore is a 1 to 5 scale.

- Cites ITU G.114: one-way delay under 150 ms is transparent, and 400 ms is the planning limit.

- Cites a statistic that 86% of customers say fast, accurate resolution affects whether they buy from a brand.

Agent Studio and ADK (https://polyai.github.io/adk)

- Each flow lives in flows/{name}/flow_config.yaml, with the fields name, description and start_step.

- The docs state "the model only sees the current step's prompt and tools."

- Default steps are LLM-driven. They extract entities and use conditions (step_condition / exit_flow_condition) with required_entities.

- Advanced steps call transition functions ({{ft:name}}).

- Function steps are deterministic Python (def f(conv, flow)). They must call flow.goto_step or conv.exit_flow.

- Each step can override ASR, DTMF, VAD, barge-in and LLM settings.

- Commands: poly validate (local and offline), poly chat, poly call (WebRTC to the draft build, non-main branch only), and poly test run|list|show.

- Test YAML fields: name, scenario, channel (voice | webchat), language (BCP 47), variant, simulated_at, tags, caller_number, sip_headers, integration_attributes, api_mocks (status 100 to 599, body, headers, repeat), prompt_assertions and function_call_assertions.

- Prompt assertions are judged by an LLM against the full conversation.

- Function call assertions check the function name and argument values only. They do not check call order or exclusivity.

- A test with neither assertion type can neither pass nor fail.

- Three environments: sandbox (auto-deployed on merge to main), pre-release and live.

- Promotion runs one step at a time with poly deployments promote and supports --dry-run. It promotes the same version and does not rebuild it.

- poly deployments rollback returns an environment to an earlier version.

- poly rtc applies real-time configuration outside the promotion path.

- Voice: SIP, WebRTC test calls, and voice settings.

- Webchat: chat settings.

- SMS: templates in config/sms_templates.yaml, referenced as {{twilio_sms:name}}. Each template has env_phone_numbers per environment. SMS is an Enterprise feature (https://polyai.github.io/adk/reference/resources/sms/).

- Configured in agent_settings/languages.yaml with default_language and additional_languages, using BCP 47 codes such as en-GB.

- Every configured language needs an entry in every translation key.

- An Enterprise feature, configured in config/handoffs.yaml.

- SIP methods: invite (new outbound call, which needs phone_number, outbound_endpoint, and outbound_encryption of TLS/SRTP or UDP/RTP), refer (transfer) and bye (end the call).

- Numbers use E.164 format. Exactly one handoff must have is_default: true.

- Invoked with conv.call_handoff(...) in code, or {{ho:name}} in rules.

- Logging through conv.log. Metrics through poly metrics and conv.write_metric(..., write_once=True).

- poly conversations list|get|get-audio inspects real conversations.

- Agent Studio shows containment, CSAT, handle time and flagged transcripts.

Customer case-study figures (https://poly.ai/case-studies)

PolyAI publishes no platform-wide containment or accuracy figure on the pages read.

A3. Pricing, security, integrations

Pricing (https://poly.ai/pricing)

- US$0.02 per connected minute, billed per second.

- Text tokens: US$2.00 per 1M input, US$0.20 per 1M cached input, US$5.00 per 1M output.

- Concurrency: 2 calls without a card on file, 10 with a card.

- Voice output is free until 19 November. Telephony and orchestration are not included.

- US$100 credit for sign-ups before 19 November.

Security (https://poly.ai/security)

Integrations (https://poly.ai/integrations)

A4. Industries and use cases (https://poly.ai/industries)

PolyAI claims table

---

Part B: UK regulation for an AI voice or chat agent

Pages fetched in full on 23 October 2026: PRIN 2A, DUAA s80, AI Act Article 50, the Ofcom Xtra Phones page, the persistent misuse search results, and the DTAC and Omnibus secondary sources. The following figures are cited to their primary URLs but were not re-read in full today: the SCA RTS exemption limits, the persistent misuse figures (3%, 72 h, 15 s), the C4 8-week ADR window, the PECR fine level, the FG21/1 four drivers, and Equality Act s20(6). Re-read those URLs before relying on them.

The rows below record the provisions and obligations. The "deterministic test" column describes a check that a scripted test harness can pass or fail without human judgement.

FCA Consumer Duty: PRIN 2A (https://www.handbook.fca.org.uk/handbook/PRIN/2A/)

FCA FG21/1: vulnerable customers (https://www.fca.org.uk/publications/finalised-guidance/fg21-1-guidance-firms-fair-treatment-vulnerable-customers)

PSRs 2017 and the UK SCA RTS

- Article 4: two of the three elements (knowledge, possession, inherence), kept independent of each other.

- Article 5: dynamic linking for remote payments. The authentication code is specific to the amount and the payee, and the payer is shown both.

- Exemptions: Article 10 and Article 10A (account information; Article 10A requires reauthentication every 90 days), Article 11 (contactless, £100 per transaction), Article 13 (trusted beneficiaries), Article 15 (secure corporate processes), Article 16 (low-value remote transactions, £30 each, with a cumulative limit of £100 or 5 transactions) and Article 18 (transaction risk analysis with fraud-rate thresholds).

Ofcom

- Abandoned-call rate no more than 3% of live calls per campaign per 24 hours.

- A recorded information message when a call is abandoned.

- Valid, returnable CLI on every call.

- No repeat call to an abandoned number within 72 hours without a live agent.

- Ring time at least 15 seconds.

- Penalty of up to £2 million.

- C4: complaints handling code and access to ADR. Customers can take a complaint to ADR after 8 weeks, or earlier on a deadlock letter.

- C5: policies for customers whose circumstances make them vulnerable, with staff able to identify and record vulnerability.

- C6: CLI facilities. The number shown must be a valid, dialable number that uniquely identifies the caller. Ofcom opened an investigation into Xtra Phones on 21 October 2026 covering C6.4(a) (https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/Investigation-into-Xtra-Phones-UK-Ltds-compliance-with-the-General-Conditions-and-potential-misuse-of-networks-and-services-under-Section-128-of-the-Communications-Act-2003).

UK GDPR Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 (https://www.legislation.gov.uk/ukpga/2025/18/section/80)

PECR (https://www.legislation.gov.uk/uksi/2003/2426)

NHS DTAC

Equality Act 2010 (https://www.legislation.gov.uk/ukpga/2010/15)

EU AI Act (Regulation (EU) 2024/1689; https://artificialintelligenceact.eu/article/50/)

- Systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking duty.

- High-risk deadlines move to 2 December 2027 for Annex III systems and 2 August 2028 for product-embedded systems.

- Annex III point 5(b) covers creditworthiness and credit scoring. Point 5(c) covers risk assessment and pricing for life and health insurance.

Regulation table