AI Voice in Brazil 2026: Anatel, DDD Routing, and Resolution 777 Call Authentication

Brazil's Anatel is in the middle of a regulatory consolidation: 34 prior resolutions were merged into the General Telecommunications Services Regulation (Resolution 777/2025), and a new call-authentication mandate enters force in 2028. AI voice agents launching in 2026 should architect for 2028 today.

How telephony works there

Brazilian numbering uses two-digit DDD codes (Discagem Direta a Distancia) such as 11 São Paulo, 21 Rio de Janeiro, 31 Belo Horizonte, 51 Porto Alegre, 71 Salvador. Long-distance calls require a Carrier Selection Code (CSP) — 0 + CSP + DDD + number — picking a specific long-distance carrier (15 Telefônica, 21 Claro, 41 TIM Brasil, 31 Oi). Mobile numbers are 9 digits starting with 9. Toll-free is 0800 + 7 digits.

Anatel allocates numbering ranges through the General Numbering Regulation (PGNB). Major fixed-line carriers (Vivo/Telefônica, Oi, Claro/Embratel) interconnect with Twilio Brazil through wholesale agreements. The São Paulo media edge gives sub-50 ms RTT to most Brazilian users. Number portability is available within 3 business days. PSTN-IP migration is largely complete in metro areas; rural fixed-line remains.

Regulatory landscape

Resolution 777/2025 (RGST) is the new umbrella regulation. Article 84 mandates call authentication for all telecommunications service providers using public numbering resources from 2028. Anatel has launched the GT-AUTENTICA working group with industry to define the centralised technical solution. In parallel, the LGPD (Lei Geral de Proteção de Dados) and the consumer-protection-focused "Proteja-me" framework constrain telemarketing. Outbound marketing calls cannot be made before 9:00 or after 21:00 weekdays, between 10:00 and 14:00 on Saturdays, or any time on Sundays. CLI must be a real, callable number. The number 0303 is reserved for telemarketing and is being expanded; consumers can opt out via Procon and the "Não Me Perturbe" platform across all major carriers.

For AI voice specifically, there is no dedicated Anatel rule yet, but LGPD Article 11 treats voice as a "particularly sensitive personal data" when it identifies a natural person, requiring specific consent for processing. ANPD (the data-protection authority) has signalled stricter scrutiny of synthetic-voice campaigns in 2026.

CallSphere implementation

Explore a live demo and compare current plans to find the right fit for your business.

Build and launch steps

flowchart LR
 A[Twilio BR subaccount + São Paulo edge] --> B[Provision local DDD + 0800 + 0303]
 B --> C[LGPD consent at point of capture]
 C --> D[Não Me Perturbe nightly scrub]
 D --> E[AI synthetic-voice disclosure first sentence]
 E --> F[Authentication payload pre-wired for 2028]

1. Create a Twilio Brazilian subaccount and pin media to São Paulo.
2. Provision a local DDD DID, 0800 toll-free for inbound, and 0303 for outbound marketing.
3. Configure outbound time windows: 9-21 weekdays, 10-14 Saturdays, no Sundays.
4. Capture LGPD consent at the point of opt-in: timestamp, IP, purpose, legal basis.
5. Scrub against Não Me Perturbe and partner-DNC lists nightly.
6. Pre-wire call-authentication metadata to the SIP signalling so 2028 RGST go-live is configuration only.

FAQ

Is AI voice marketing legal in Brazil? Yes, with LGPD-grade consent, time-window compliance, CLI in 0303, and the Não Me Perturbe scrub.

What is 0303? A reserved prefix for telemarketing CLIs so consumers can recognise marketing calls; usage is being expanded by Anatel through 2026-2027.

When does call authentication enter force? RGST (Resolution 777/2025) Article 84 mandates authentication from 2028; the GT-AUTENTICA working group is defining the technical solution now.

Does LGPD treat voice as sensitive data? Yes, when the voice identifies a natural person, it falls under Article 11 sensitive data, requiring explicit specific consent.

Sources

• Anatel Resolution 777/2025 (RGST)
• Access Partnership: Anatel revising numbering and call ID
• Não Me Perturbe (do not call) platform
• LGPD - Lei nº 13.709/2018

Explore a live demo and compare current plans to find the right fit for your business.

AI Voice in Brazil 2026: Anatel, DDD Routing, and Resolution 777 Call Authentication: production view

AI Voice in Brazil 2026: Anatel, DDD Routing, and Resolution 777 Call Authentication sits on top of a regional VPC and a cold-start problem you only see at 3am. If your voice stack lives in us-east-1 but your customer is calling from a Sydney mobile network, the round-trip time alone wrecks turn-taking. Multi-region routing, GPU residency, and warm pools become the difference between "natural" and "robotic" — and it's all infra, not the model.

Serving stack tradeoffs

The big fork is managed (OpenAI Realtime, ElevenLabs Conversational AI) versus self-hosted on GPUs you operate. Managed wins on cold-start, model freshness, and zero-ops; self-hosted wins on unit economics past a certain conversation volume and on data residency for regulated verticals. CallSphere runs hybrid: Realtime for live calls, self-hosted Whisper + a hosted LLM for async, both routed through a Go gateway that enforces per-tenant rate limits.

Latency budgets are non-negotiable on voice. End-to-end target is sub-800ms ASR-to-first-token and sub-1.4s first-audio-out; anything beyond that and turn-taking feels stilted. GPU residency in the same region as your TURN servers matters more than choosing a slightly bigger model.

Observability is the unglamorous backbone — every conversation produces logs, traces, sentiment scoring, and cost attribution piped to a per-tenant dashboard. HIPAA aligned isolation keeps healthcare traffic separated from salon traffic at the storage layer, not just the API.

FAQ

Is this realistic for a small business, or is it enterprise-only? The IT Helpdesk product is built on ChromaDB for RAG over runbooks, Supabase for auth and storage, and 40+ data models covering tickets, assets, MSP clients, and escalation chains. For a topic like "AI Voice in Brazil 2026: Anatel, DDD Routing, and Resolution 777 Call Authentication", that means you're not starting from scratch — you're configuring an agent template that's already been hardened across thousands of conversations.

Which integrations have to be in place before launch? Day one is integration mapping (scheduler, CRM, messaging) and prompt tuning against your top 20 real call transcripts. Day two through five is shadow-mode running, where the agent transcribes and recommends but a human still answers, so you can compare side-by-side. Go-live is the moment your eval pass-rate clears your internal bar.

How do we measure whether it's actually working? The honest answer: it scales until your tool catalog gets stale. The agent is only as good as the integrations it can actually call, so the operational discipline is keeping schemas, webhooks, and fallback paths green. The platform handles the rest — observability, retries, multi-region routing — without your team owning the GPU layer.

Talk to us

Explore a live demo and compare current plans to find the right fit for your business.