By Sagar Shankaran, Founder of CallSphere
How Anatel's General Numbering Regulation, the DDD area-code system, Resolution 777/2025's call-authentication requirement, and the GT-AUTENTICA working group shape AI voice agents in Brazil.
Key takeaways
Brazil's Anatel is in the middle of a regulatory consolidation: 34 prior resolutions were merged into the General Telecommunications Services Regulation (Resolution 777/2025), and a new call-authentication mandate enters force in 2028. AI voice agents launching in 2026 should architect for 2028 today.
Brazilian numbering uses two-digit DDD codes (Discagem Direta a Distancia) such as 11 São Paulo, 21 Rio de Janeiro, 31 Belo Horizonte, 51 Porto Alegre, 71 Salvador. Long-distance calls require a Carrier Selection Code (CSP) — 0 + CSP + DDD + number — picking a specific long-distance carrier (15 Telefônica, 21 Claro, 41 TIM Brasil, 31 Oi). Mobile numbers are 9 digits starting with 9. Toll-free is 0800 + 7 digits.
Anatel allocates numbering ranges through the General Numbering Regulation (PGNB). Major fixed-line carriers (Vivo/Telefônica, Oi, Claro/Embratel) interconnect with Twilio Brazil through wholesale agreements. The São Paulo media edge gives sub-50 ms RTT to most Brazilian users. Number portability is available within 3 business days. PSTN-IP migration is largely complete in metro areas; rural fixed-line remains.
Resolution 777/2025 (RGST) is the new umbrella regulation. Article 84 mandates call authentication for all telecommunications service providers using public numbering resources from 2028. Anatel has launched the GT-AUTENTICA working group with industry to define the centralised technical solution. In parallel, the LGPD (Lei Geral de Proteção de Dados) and the consumer-protection-focused "Proteja-me" framework constrain telemarketing. Outbound marketing calls cannot be made before 9:00 or after 21:00 weekdays, between 10:00 and 14:00 on Saturdays, or any time on Sundays. CLI must be a real, callable number. The number 0303 is reserved for telemarketing and is being expanded; consumers can opt out via Procon and the "Não Me Perturbe" platform across all major carriers.
For AI voice specifically, there is no dedicated Anatel rule yet, but LGPD Article 11 treats voice as a "particularly sensitive personal data" when it identifies a natural person, requiring specific consent for processing. ANPD (the data-protection authority) has signalled stricter scrutiny of synthetic-voice campaigns in 2026.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
CallSphere uses Twilio across all six verticals (Healthcare AI, Real Estate AI, Sales Calling AI, Salon AI, IT Helpdesk AI, After-Hours AI), with 37 agents, 90+ tools, 115+ DB tables, HIPAA + SOC 2 controls, and pricing at $149 / $499 / $1499 with a 14-day trial and a 22% lifetime affiliate. Brazilian tenants get Twilio BR local DIDs in the right DDD (11, 21, 31, 51 are most common), an 0800 toll-free for inbound, and an 0303-prefix outbound where outbound marketing is the use case. The AI agent opens with "esta é uma ligação automatizada de [marca]" to disclose synthetic voice. The Sales product respects the Anatel time windows by tenant time zone, scrubs against the Não Me Perturbe blocklists nightly, and stores LGPD-grade consent (timestamp, IP, finalidade, base legal) per-customer for at least 5 years. We are already wiring the GT-AUTENTICA call-authentication payload structure into our SIP signalling so that the 2028 deadline is a configuration flip, not a re-architecture.
flowchart LR
A[Twilio BR subaccount + São Paulo edge] --> B[Provision local DDD + 0800 + 0303]
B --> C[LGPD consent at point of capture]
C --> D[Não Me Perturbe nightly scrub]
D --> E[AI synthetic-voice disclosure first sentence]
E --> F[Authentication payload pre-wired for 2028]
Is AI voice marketing legal in Brazil? Yes, with LGPD-grade consent, time-window compliance, CLI in 0303, and the Não Me Perturbe scrub.
What is 0303? A reserved prefix for telemarketing CLIs so consumers can recognise marketing calls; usage is being expanded by Anatel through 2026-2027.
When does call authentication enter force? RGST (Resolution 777/2025) Article 84 mandates authentication from 2028; the GT-AUTENTICA working group is defining the technical solution now.
Does LGPD treat voice as sensitive data? Yes, when the voice identifies a natural person, it falls under Article 11 sensitive data, requiring explicit specific consent.
Start a 14-day trial on a Brazilian DDD, see pricing at $149/$499/$1499, or contact us for Anatel/Twilio BR setup.
AI Voice in Brazil 2026: Anatel, DDD Routing, and Resolution 777 Call Authentication sits on top of a regional VPC and a cold-start problem you only see at 3am. If your voice stack lives in us-east-1 but your customer is calling from a Sydney mobile network, the round-trip time alone wrecks turn-taking. Multi-region routing, GPU residency, and warm pools become the difference between "natural" and "robotic" — and it's all infra, not the model.
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
The big fork is managed (OpenAI Realtime, ElevenLabs Conversational AI) versus self-hosted on GPUs you operate. Managed wins on cold-start, model freshness, and zero-ops; self-hosted wins on unit economics past a certain conversation volume and on data residency for regulated verticals. CallSphere runs hybrid: Realtime for live calls, self-hosted Whisper + a hosted LLM for async, both routed through a Go gateway that enforces per-tenant rate limits.
Latency budgets are non-negotiable on voice. End-to-end target is sub-800ms ASR-to-first-token and sub-1.4s first-audio-out; anything beyond that and turn-taking feels stilted. GPU residency in the same region as your TURN servers matters more than choosing a slightly bigger model.
Observability is the unglamorous backbone — every conversation produces logs, traces, sentiment scoring, and cost attribution piped to a per-tenant dashboard. HIPAA + SOC 2 aligned isolation keeps healthcare traffic separated from salon traffic at the storage layer, not just the API.
Is this realistic for a small business, or is it enterprise-only? The IT Helpdesk product is built on ChromaDB for RAG over runbooks, Supabase for auth and storage, and 40+ data models covering tickets, assets, MSP clients, and escalation chains. For a topic like "AI Voice in Brazil 2026: Anatel, DDD Routing, and Resolution 777 Call Authentication", that means you're not starting from scratch — you're configuring an agent template that's already been hardened across thousands of conversations.
Which integrations have to be in place before launch? Day one is integration mapping (scheduler, CRM, messaging) and prompt tuning against your top 20 real call transcripts. Day two through five is shadow-mode running, where the agent transcribes and recommends but a human still answers, so you can compare side-by-side. Go-live is the moment your eval pass-rate clears your internal bar.
How do we measure whether it's actually working? The honest answer: it scales until your tool catalog gets stale. The agent is only as good as the integrations it can actually call, so the operational discipline is keeping schemas, webhooks, and fallback paths green. The platform handles the rest — observability, retries, multi-region routing — without your team owning the GPU layer.
Want to see how this maps to your stack? Book a live walkthrough at calendly.com/sagar-callsphere/new-meeting, or try the vertical-specific demo at sales.callsphere.tech. 14-day trial, no credit card, pilot live in 3–5 business days.
Written by
Sagar Shankaran· Founder, CallSphere
Sagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
Using GPT-Realtime-2 for healthcare voice agents. BAA scope, PHI handling, retention, logging, and why a managed platform usually wins this build.
AI Control Tower is the governance layer for ServiceNow's Project Arc — policy, monitoring, and audit logs for autonomous agents. Here is how it works.
CAISI announced new agreements with Google DeepMind, Microsoft, and xAI in May 2026. What gets tested, what changes for enterprise AI buyers, what to watch.
The 2024 NPRM proposes mandatory penetration tests every 12 months and vulnerability scans every 6 months. Here is how an AI voice agent should be tested in 2026.
Six-domain AI vendor diligence: financial, security, privacy, operational, legal, ethics. Plus 30+ specific questions, SOC 2 / ISO 27001 baselines, and review cadence.
Enterprise CIO Guide perspective on The first wave of EU AI Act enforcement landed in 2026 — here is the practical impact on agent deployments.
© 2026 CallSphere LLC. All rights reserved.