--- title: "CMS 2027 AI Disclosure Requirements for Medicare Agents: What Changes and How to Comply" description: "CMS finalized new AI disclosure and transparency rules for Medicare Advantage and Part D for plan year 2027. Here is what changes for agents, FMOs, and TPMOs — and the exact workflow to comply." url: https://unlockedcrm.ai/blog/cms-2027-ai-disclosure-requirements-for-medicare-agents canonical: https://unlockedcrm.ai/blog/cms-2027-ai-disclosure-requirements-for-medicare-agents category: "Compliance" published: 2026-05-20 updated: 2026-05-20 author: "Jacob Lock" source: unLocked CRM — AI CRM for insurance agents --- # CMS 2027 AI Disclosure Requirements for Medicare Agents: What Changes and How to Comply ## TL;DR CMS finalized 6 changes for plan year 2027: mandatory AI disclosure at first contact, documented human oversight for plan recommendations, SOA destruction blocked for 48 hours, 12-hour gap enforced regardless of channel, 10-year retention on audio/transcript/summary, and TPMO disclaimer in the first 30 seconds of any AI channel. Enforcement begins October 1, 2026. ## Key data points - CMS 2027 rules require AI disclosure at the start of any Medicare Advantage or Part D beneficiary contact involving AI. - Scope of Appointment destruction is prohibited within 48 hours of capture, and AI-captured SOAs carry the same 10-year retention as paper SOAs. - TPMO disclaimer must appear within the first 30 seconds of AI voice contact or the first message of chat contact under the 2027 rules. For plan year 2027, CMS tightened the rules governing how AI can be used in Medicare Advantage and Part D marketing, enrollment, and customer service. The headline: any AI that touches a beneficiary now has disclosure, oversight, and retention obligations. This guide breaks down what agents, FMOs, and Third-Party Marketing Organizations (TPMOs) must do. ## The 6 Changes That Matter Most ### 1. Mandatory AI disclosure at first contact When an AI voice agent, chatbot, or AI-assisted human agent is used to contact a beneficiary about Medicare Advantage or Part D, the beneficiary must be told — at the start of the interaction — that AI is being used and what role it plays. Standard language is acceptable; misleading language is not. ### 2. Documented human oversight for plan recommendations AI may collect intent, narrow options, and surface information. Any specific plan recommendation that leads to enrollment must have documented human licensed-agent oversight before the beneficiary signs. The audit trail must show the human review step. ### 3. SOA retention extended and clarified The Scope of Appointment retention floor stays at 10 years, with an explicit prohibition on destruction within 48 hours of capture. The clarification: AI-captured SOAs (voice or chat) carry the same retention obligation as paper or e-sign SOAs. ### 4. 12-hour gap rule applies to AI-initiated contacts The 12-hour minimum between SOA capture and the sales presentation applies regardless of whether the SOA was captured by a human, voice AI, or chatbot. Documented exceptions (beneficiary-initiated same-day calls) must be logged with the reason. ### 5. Transcript and summary retention parity Audio recordings, AI transcripts, and AI-generated summaries are all considered part of the sales call record. All three must be retained for 10 years. Summary deletion after a shorter window is non-compliant. ### 6. TPMO disclaimer placement for AI-driven channels The "We do not offer every plan available in your area..." TPMO disclaimer must appear in any AI-driven channel within the first 30 seconds of voice contact or in the first message of chat contact. Burying it at the end of a conversation is non-compliant. ## What Counts as "AI" Under the 2027 Rules CMS uses a broad definition. Covered: - Generative voice agents (inbound and outbound) - Chatbots and AI-assisted SMS responders - AI call summarization that generates beneficiary-facing artifacts - AI lead scoring that determines whether a beneficiary is contacted - AI translation in real time during enrollment - AI agents acting on behalf of a licensed human Not covered (but still subject to existing rules): - Spell-check and grammar tools - Search ranking inside a CRM - Pure analytics that never touch the beneficiary ## The Compliance Workflow For every AI-touched Medicare interaction in plan year 2027: 1. **Disclose AI use** at first contact, with logged language 2. **Capture SOA** if discussing MA/PD specifics, with the 48-hour retention lock 3. **Wait 12 hours** before any sales presentation unless an exception is documented 4. **Document human licensed-agent review** before any specific plan recommendation 5. **Play or display the TPMO disclaimer** within 30 seconds (voice) or first message (chat) 6. **Retain audio, transcript, and summary** for 10 years 7. **Log every access** to the retained artifacts ## What Agents Should Change This Quarter - Audit every AI vendor in your stack against the 6 changes above - Update your AI disclosure script for inbound, outbound, and chat - Confirm your SOA workflow blocks destruction within 48 hours - Confirm transcripts and summaries inherit the 10-year retention policy - Update your TPMO disclaimer placement in any AI-driven channel - Train every licensed agent on the human-oversight documentation step - Run a quarterly internal audit pulling 20 random AI-touched records ## What FMOs and TPMOs Should Change This Quarter - Update agent agreements to require AI-disclosure compliance - Provide vendor-vetted AI tools (or an approved list) - Run monthly call-recording audits across the downline - Maintain a centralized AI-vendor register with BAA status - Document the chain of accountability for every AI-initiated enrollment ## Where unLocked CRM Fits unLocked CRM's Medicare workflow ships with the 2027 rules baked in: - AI-disclosure scripts pre-loaded for Arwyn (inbound) and Agent AI (outbound) - SOA capture with the 48-hour destruction lock enforced at the database layer - 12-hour gap timer between SOA and presentation - Human licensed-agent oversight checkpoint before any enrollment task is marked complete - TPMO disclaimer placement enforced in every AI-driven channel - 10-year retention applied to audio, transcript, and summary in one click - Quarterly audit reports generated automatically ## FAQ **When do the 2027 CMS AI rules take effect?** The rules apply to plan year 2027, with marketing-period enforcement beginning October 1, 2026 for AEP-related activity. **Does an AI chatbot need to disclose it is AI?** Yes. Any AI-driven beneficiary contact must disclose AI use at the start of the interaction. **Can AI recommend a specific Medicare plan?** AI can narrow options and surface information. A documented human licensed-agent review must occur before any specific plan recommendation that leads to enrollment. **Are AI transcripts subject to the 10-year retention rule?** Yes. Audio, transcripts, and AI-generated summaries are all part of the sales call record and must be retained for 10 years. **What happens if my AI vendor cannot meet these requirements?** You are responsible for the compliance posture of any AI used in your marketing chain. Vendors that cannot meet the 2027 rules should be replaced before October 1, 2026. ## FAQ ### undefined ### undefined ### undefined ### undefined ### undefined ## Related - https://unlockedcrm.ai/blog/ai-call-summarization-insurance-compliance-guide - https://unlockedcrm.ai/blog/ai-voice-agents-for-insurance-2026-buyers-guide - https://unlockedcrm.ai/blog/chatgpt-for-insurance-agents-prompts-library --- Source: [CMS 2027 AI Disclosure Requirements for Medicare Agents: What Changes and How to Comply](https://unlockedcrm.ai/blog/cms-2027-ai-disclosure-requirements-for-medicare-agents) — unLocked CRM, the AI CRM built for insurance agents. Citation permitted with attribution and a link to https://unlockedcrm.ai/blog/cms-2027-ai-disclosure-requirements-for-medicare-agents.