Agentic call handling
When software stops suggesting and starts finishing the job
A sourced report on agentic AI for an inbound phone line: what it means, where it helps, where it fails, and the guardrails. It describes the idea in general, not something Inbound CX does today.
Three things that have to be true
Drop any one and you are back to a chatbot with better copy.
It can see the state
Not a transcript window: the actual account, the open order, whether you are open right now. Without state there is no judgement, only pattern matching.
In Inbound CX call flows today. The API / HTTP request, Look up Inbound CX data and Look up in a table steps read your data while the call is on.
It can take the action
A step that writes, not only reads: move the booking, log the callback, tell the system that owns the order. Software that only reads hands the work back to you.
In Inbound CX call flows today. The Webhook step sends a signed notice to a system you run, and the API / HTTP request step can send it a POST.
It knows when to stop
The hardest part. A clean handover at the first sign of doubt is worth more than a heroic attempt that has to be undone.
In Inbound CX call flows today. The Transfer to queue and Transfer to a person steps hand the caller to your team.
The report
Agentic AI on an inbound phone line: what it is, where it helps, where it fails, the guardrails, a readiness checklist and how to judge a vendor. It is written for the owner of a small team that answers its own calls. Every outside figure links to its source and its date, and none of them measures Inbound CX or its customers.
Reviewed with its sources on September 15, 2026.
Four figures worth knowing
Forecast
80%
of common customer service issues resolved by agentic AI without a person, by 2029. That is Gartner’s forecast, published 5 March 2025: a prediction, not a measurement, and about common issues rather than every call.1
Survey
64%
of 5,728 customers surveyed by Gartner in December 2023 would prefer that companies did not use AI for customer service, and 53% would consider switching to a competitor on finding out a company was going to. Published 9 July 2024.2
Forecast
50%
of organizations that expected AI to let them significantly reduce their customer service staff will abandon those plans by 2027, Gartner forecasts. In its March 2025 poll of 163 service leaders, 95% planned to keep people on staff to decide what AI should do. Published 10 June 2025.3
Research
233
AI-related incidents reported in 2024, a record and 56.4% more than in 2023, according to the Stanford AI Index 2025.4
Where it helps
The strongest cases on an inbound line share three traits: the request is common, the answer sits in a system the software can read, and a mistake is easy to undo.
- Questions with one right answer that already lives somewhere: your opening hours, where an order is, whether an appointment is still booked.
- Changes that can be reversed: moving a booking, noting a callback, adding a delivery instruction.
- Gathering the details before a person picks up, so whoever answers does not start from zero.
- After hours, when the choice is between a limited answer and no answer at all.
That is the ground Gartner’s 2029 forecast covers: common issues, not every call.1
Where it fails
Confidently wrong answers
A language model can say something false in the same calm voice it uses for the truth, and the business answers for it. In Moffatt v. Air Canada (14 February 2024), British Columbia’s Civil Resolution Tribunal found it made no difference whether wrong information came from a static web page or a chatbot, held that the airline had not taken reasonable care to make its chatbot accurate, and ordered it to pay $812.02.5
Instructions hidden in what the caller says
OWASP lists prompt injection first among the risks to applications built on language models: input that changes what the model does in ways its owner did not intend. On a phone line, that input is whatever the caller says.6
More power than the job needs
OWASP calls it excessive agency: software given more functions, permissions or autonomy than its task requires. If the job is to read an order, the software should have no way to cancel one.7
No way out
A caller going in circles with software that cannot help, and no route to a person, is the failure people remember. It is part of why customers are wary: in Gartner’s survey, 53% would consider switching to a competitor on learning a company was going to use AI for customer service.2
Guardrails
Say it is software, before anything else
Canada’s Privacy Commissioner asks that people using a generative AI tool be made aware that it is one (principles of 7 December 2023). Canada’s voluntary code for generative AI asks that systems that could be mistaken for humans be clearly identified. Article 50 of the European Union’s AI Act requires providers to design such systems so people are informed they are interacting with AI. Tell callers in the opening words.8910
Always a way to a person
Quebec’s private-sector privacy Act (s. 12.1) requires a business that makes a decision about someone based exclusively on automated processing of their personal information to tell them, to give the reasons and main factors on request, and to let them submit observations to a staff member who can review the decision. Design the handover before the automation: when the caller asks, when the software is unsure, and after a set number of exchanges.11
Emergencies bypass everything
No automated step should stand between a caller and emergency services. A caller who says they need help now reaches a person or is told to hang up and dial 9-1-1, and that path is tested without ever calling 9-1-1. How 9-1-1 works on Inbound CX
Consent and privacy
Before using technology that can identify, locate or profile a caller, the same Quebec Act (s. 8.1) requires telling them, along with the means to turn those functions on, and privacy settings must give the highest level of confidentiality by default (s. 9.1). If the software then sends a promotional email or text, Canada’s anti-spam rules for requesting consent apply: say what the consent is for, who is asking, with a mailing address and a way to reach them, and that it can be withdrawn.111213
Calls the software places
An inbound line often ends in a callback. In the United States, the FCC confirmed on 8 February 2024 that AI-generated voices count as an artificial voice under the Telephone Consumer Protection Act’s restrictions.14
Keep recordings and transcripts only as long as needed
Quebec’s Act (s. 23) requires destroying or anonymizing personal information once the purposes it was collected for are achieved. Decide how long recordings and any written record of a conversation are kept, and who can see them, before the software starts producing them. On Inbound CX, recordings are deleted after 30 days unless an organization sets another period.11
Readiness checklist
Answer these before any software answers your phone.
- You can name the three to five requests behind most of your calls, from your own call records rather than from memory.
- For each one, the answer lives in a system the software could read, and you know who keeps that system up to date.
- Every action the software could take can be undone, and you know how.
- The software gets only the permissions its task needs: reading, where reading is enough.
- The opening words tell the caller they are talking to software.
- A caller can reach a person at any point by asking, and the software hands over on its own when it is unsure or after a set number of exchanges.
- Anything that sounds like an emergency goes straight to a person or to 9-1-1 instructions, and that path is tested without calling 9-1-1.
- You have decided what is recorded or written down, where it is stored, for how long and who can see it, and your privacy policy says so.
- Someone on your team reads a sample of conversations every week, and the software can be switched off in minutes.
- You know what a conversation costs, and a monthly ceiling stops the spending.
How to judge a vendor
Ask for the answers in writing, and ask to see the software handle calls like yours.
- What exactly can the software do in my systems, and can each action be limited or turned off?
- What does a caller hear first, and can anyone remove the part that says it is software?
- How does it hand over to a person, and what does that person see of the conversation so far?
- What happens when it does not know, when the line is noisy, or when the caller changes language?
- Where are recordings, text and what is sent to the model stored, in which country, for how long, and who else handles them?
- Is anything my callers say used to train a model?
- How is it protected against prompt injection, and against doing more than its job?
- What does one conversation cost, is there a cap, and what happens when it is reached?
- Which of the features you are showing me work today, and which are planned?
For a fuller list, NIST’s AI Risk Management Framework (released 26 January 2023) and its Generative AI Profile (26 July 2024) are free and detailed.15
What Inbound CX has today
Inbound CX call flows are built from 28 kinds of step. The ones that matter here read your data while a call is on, send a signed webhook to a system you run, and hand the caller to your team.
One step uses AI. It is built, and it is not switched on for any account. Its limits are settings on the step: at most 12 exchanges, and a reply slower than 10 seconds goes to a person. The AI step, and what is announced
Glossary
- Agentic AI
- Software that uses a language model to decide on and carry out steps toward a goal, such as reading an account and moving a booking, rather than only producing text.
- Language model
- Software trained on large amounts of text to produce likely next words. It can sound certain while being wrong.
- Hallucination
- The usual name for a model stating something false as if it were fact.
- Prompt injection
- Input written to make a model ignore its instructions or do something its owner did not intend.6
- Excessive agency
- Giving software more functions, permissions or autonomy than its task requires.7
- Handover
- Passing the caller to a person, with what was already said, so nobody starts again.
- Disclosure
- Telling the caller, at the start, that they are speaking with software.
- Decision based exclusively on automated processing
- Quebec’s term for a decision about a person made by software with nobody reviewing it. It brings duties to inform the person and to let them ask for a review.11
- Express consent
- Consent a person gives by an action of their own after being told what it is for, who is asking and that it can be withdrawn.13
- Retention period
- How long a recording or a record is kept before it is deleted or anonymized.11
Sources
- Gartner Predicts Agentic AI Will Autonomously Resolve 80% of Common Customer Service Issues Without Human Intervention by 2029 Gartner · Published March 5, 2025 · Read on September 15, 2026
- Gartner Survey Finds 64% of Customers Would Prefer That Companies Didn't Use AI For Customer Service Gartner · Published July 9, 2024 · Read on September 15, 2026
- Gartner Predicts 50% of Organizations Will Abandon Plans to Reduce Customer Service Workforce Due to AI Gartner · Published June 10, 2025 · Read on September 15, 2026
- The 2025 AI Index Report: Responsible AI Stanford Institute for Human-Centered Artificial Intelligence (HAI) · 2025 edition · Read on September 15, 2026
- Moffatt v. Air Canada, 2024 BCCRT 149 Civil Resolution Tribunal (British Columbia) · Published February 14, 2024 · Read on September 15, 2026
- LLM01:2025 Prompt Injection OWASP Gen AI Security Project · 2025 edition · Read on September 15, 2026
- LLM06:2025 Excessive Agency OWASP Gen AI Security Project · 2025 edition · Read on September 15, 2026
- Principles for responsible, trustworthy and privacy-protective generative AI technologies Office of the Privacy Commissioner of Canada · Published December 7, 2023 · Read on September 15, 2026
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems Innovation, Science and Economic Development Canada · Published September 2023 · Read on September 15, 2026
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 50 European Union (EUR-Lex) · Adopted June 13, 2024 · Read on September 15, 2026
- Act respecting the protection of personal information in the private sector (CQLR c P-39.1) LégisQuébec (Gouvernement du Québec) · Text as it stood on April 7, 2026 · Read on September 15, 2026
- An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (S.C. 2010, c. 23), sections 10 and 11 Justice Laws Website (Government of Canada) · Text as it stood on September 15, 2026 · Read on September 15, 2026
- Electronic Commerce Protection Regulations (CRTC), SOR/2012-36 Justice Laws Website (Government of Canada) · Text as it stood on September 15, 2026 · Read on September 15, 2026
- Declaratory Ruling FCC 24-17: Implications of Artificial Intelligence Technologies on Protecting Consumers from Unwanted Robocalls and Robotexts Federal Communications Commission · Released February 8, 2024 · Read on September 15, 2026
- AI Risk Management Framework National Institute of Standards and Technology · Released January 26, 2023 · Read on September 15, 2026
Go deeper
Live sessions
No session is scheduled
When one is, it is listed here with its date, its time zone, who is speaking and a link to register. Nothing is announced before it is booked.
Product
The one AI step in a call flow
What it does, the limits you set on it, and everything announced beside it that is not built yet.
AI, on the platform pages
Free tool
Your first phone menu, drawn in your browser
Draw the phone menu a caller hears, find the dead ends before they do, and act as the caller yourself. Runs in your browser, with nothing to sign up for.
Phone menu builder · nothing to sign up for
28
kinds of step in the Inbound CX call flow builder. Among them are the steps that let a menu reach your data: an API / HTTP request, a webhook, a lookup in your Inbound CX data and a lookup in a table you keep.
Counted from the product's own step catalogue, and checked against it on every build.