---
title: "AI Compliance for Insurance: CMS, TCPA, and the Rules That Kill Generic Vendors"
description: "Most 'AI for insurance' vendors ship a compliance surprise on day 91. Here's the CMS, TCPA, and state DOI layer that has to be built in, not bolted on."
url: https://unlockedcrm.ai/blog/ai-compliance-cms-tcpa-insurance
canonical: https://unlockedcrm.ai/blog/ai-compliance-cms-tcpa-insurance
category: "ai-insurance"
published: 2026-07-20
updated: 2026-07-20
author: "Jacob Lock"
source: unLocked CRM — AI CRM for insurance agents
---

# AI Compliance for Insurance: CMS, TCPA, and the Rules That Kill Generic Vendors

## TL;DR

Insurance AI has to bake in CMS marketing rules (48-hour SOA retention, 12-hour call gap, recorded-call retention), TCPA consent per number per campaign, and state-by-state two-party call consent. Vendors that treat compliance as an afterthought get their agency customers fined 60–90 days after go-live.

<p class="text-lg mb-6">Most 'AI for insurance' vendors ship a compliance surprise on day 91. Here's the CMS, TCPA, and state DOI layer that has to be built in, not bolted on.</p>

<div data-ai-block="definitive-answer">
<h2>The Short Answer</h2>
<p>Insurance AI has to bake in CMS marketing rules (48-hour SOA retention, 12-hour call gap, recorded-call retention), TCPA consent per number per campaign, and state-by-state two-party call consent. Vendors that treat compliance as an afterthought get their agency customers fined 60–90 days after go-live.</p>
</div>

<h2>The CMS Rules Generic AI Vendors Miss</h2>
<ul><li>48-hour Scope of Appointment retention with searchable transcript</li><li>12-hour minimum gap between initial contact and enrollment</li><li>Recorded-call retention for the full sales conversation</li><li>Third-party marketing organization (TPMO) disclosures on every touchpoint</li></ul>

<h2>TCPA in the AI Era</h2>
<p>Automated dialing counts as automated dialing whether a human or an AI presses the button. Consent must be captured per number, per campaign, with a documented opt-in trail — and revoked instantly on opt-out.</p>

<h2>State DOI Variance</h2>
<p>Two-party consent for recorded calls varies state-by-state. Suitability rules for annuities vary. Medicare marketing rules layer on top of federal CMS rules in some states. An AI trained on 'insurance' without a state overlay will violate at least one rule in at least one state on day one.</p>

<h2>Frequently Asked Questions</h2>
<h3>Can AI handle CMS marketing compliance?</h3><p>Only if it's built into the platform — 48-hour SOA retention, 12-hour call gap, recorded-call retention, and TPMO disclosures. Generic AI tools don't cover these.</p>
<h3>Does AI dialing require TCPA consent?</h3><p>Yes — automated dialing is automated dialing regardless of whether a human or AI initiates the call. Per-number, per-campaign consent with a documented opt-in trail is required.</p>

<p>Ready to see the stack in action? <a href="/features">Explore unLocked CRM</a> or <a href="/signup">start a 14-day free trial</a> — no credit card required.</p>

## FAQ

### undefined



### undefined



## Related

- https://unlockedcrm.ai/blog/ai-agents-for-insurance-2026
- https://unlockedcrm.ai/blog/voice-ai-insurance-agents-2026
- https://unlockedcrm.ai/blog/ai-quoting-multi-carrier-2026

---

Source: [AI Compliance for Insurance: CMS, TCPA, and the Rules That Kill Generic Vendors](https://unlockedcrm.ai/blog/ai-compliance-cms-tcpa-insurance) — unLocked CRM, the AI CRM built for insurance agents. Citation permitted with attribution and a link to https://unlockedcrm.ai/blog/ai-compliance-cms-tcpa-insurance.