AI Caller: Who Owns the Number, and Who Signs the Call

An AI caller is software that places or answers telephone calls on a company's behalf, holding a live spoken conversation instead of a person. Whether it reaches anyone depends less on the model than on one thing most buyers never ask about: who owns the phone number it dials from, and who cryptographically signs the call as it enters the network.

Our position is that the model is the cheap half. The expensive half is the telecom identity layer underneath it, and it is governed by a framework that decides, before the first ring, whether your call arrives as your company name, as a bare number, as "Spam Likely", or not at all. Someone has already hit the wall from the inside: scaling outbound on a voice platform in February 2026, one operator posted that the day's "dial_failed rate was 57%, which is incredibly disruptive" (rayr, Retell AI community, 26 February 2026). The thread that followed spent two days establishing which layer had actually failed. It turned out to be the platform's own infrastructure rather than a carrier block, and that is exactly the point: from the dashboard, the operator had no way to tell a vendor bug from a reputation problem.

The short answer: An AI caller's reach is set by its attestation level, not its voice quality, and attestation is a claim your carrier makes about a number you probably do not hold, so settle the number and the signer before you tune a single prompt.

Last updated: July 31, 2026.

The Caller Provenance Chain: four links, and what breaks when any one of them is missing.

We have not run a production outbound AI calling campaign ourselves, and nothing below is offered as our operating experience. What we did do is read the rule text and the current Federal Communications Commission proceedings at source rather than in summary, and separately check what a sample of AI voice platforms publish about attestation in their own documentation. Both exercises are reported in full below, including the parts that produced nothing. This is a description of how the United States caller identity framework works, not legal advice; the rules cited are under active amendment and telecom counsel should read them with you.

What an AI caller is, and why the number outranks the model

An AI caller is a system that conducts a telephone conversation on behalf of an organisation without a person on its side of the line. It converts speech to text, decides what to do, and speaks back. Vendors sell it as a model problem. It is, first, a numbering problem, because a phone call is the only channel where a third party you did not choose gets to rewrite your identity in transit and drop your message before it is heard.

The scale of that filtering is now the dominant fact about outbound voice. Hiya's State of the Call 2026, drawn from a survey of more than 12,000 consumers across six countries, reports that 86% of unknown calls go unanswered. One in three respondents said they had received a deepfake call. That number matters here for an unwelcome reason: consumer defences hardened in the same eighteen months that AI calling became cheap, and the defences do not distinguish between your appointment reminder and a cloned voice.

So the useful question about an AI caller is not "how natural does it sound". It is: when this thing dials, whose identity does the network think is calling, and how much confidence does the network attach to that belief? Everything downstream, including whether your brand name renders on the handset, is a consequence of the answer.

Three things about the channel make this different from email or chat:

The Caller Provenance Chain: four links between your brand and a handset

Every AI-placed call carries a chain of four claims, and the weakest link sets the ceiling for all of them. We call this the Caller Provenance Chain, and it is the diagnostic worth running before any voice pilot: who holds the number, who signs the call, what the signature attests, and who inside your company answers for it.

The first three links are telecom facts. The fourth is an internal governance fact, and it is the one nobody assigns, which is why abandoned campaign numbers keep dialing long after the person who launched them has left. We have argued the same structure for software agents in our earlier analysis of non-human identity: an agent with no owner, no scope and no expiry is not a capability, it is a liability with a login. A phone number handed to an AI caller is exactly that, with the added feature that regulators can trace it.

What a call actually carries: an annotated signalling trace

Here is what the identity layer looks like on the wire. When a signed call is placed over SIP, the originating provider adds an Identity header containing a signed token called a PASSporT. Below is a simplified, annotated version of the claims that token carries, followed by the response that comes back when a terminating carrier declines the call. This is the demo that matters for an AI caller, and it is not a conversation transcript.

INVITE sip:[email protected] SIP/2.0
From:  "ACME SUPPORT" <sip:[email protected]>
To:    <sip:[email protected]>

Identity: <base64 header>.<base64 payload>.<signature>;
          info=<https://cert.originator.example/acme.crt>;alg=ES256;ppt=shaken

  --- decoded payload (the claims that travel with your call) ---
  "attest": "B"                         <-- the confidence claim. A, B or C.
  "orig":   { "tn": "18005550142" }     <-- the number you are calling FROM
  "dest":   { "tn": ["15551234567"] }   <-- the number you are calling
  "origid": "d5f3...c81a"               <-- an opaque origination identifier
  "iat":    1785000000                  <-- issued-at timestamp, replay control

Four things in that block decide the fate of the call, and only one of them is under your direct control.

The orig number is the identity your recipient sees. The attest value is your provider's confidence in it. The certificate URL in info names the provider making the claim, which is how a terminating carrier and, later, a traceback investigator work out who vouched for you. And origid is the opaque handle that lets a provider group traffic from one customer without publishing who that customer is, which is precisely how an AI calling platform's traffic gets scored as one blob.

When the receiving side declines, the return leg is machine-readable. Commission rules require that a terminating provider blocking calls through an analytics program "must immediately return, and all voice service providers in the call path must transmit, an appropriate response code to the origination point of the call", specifically SIP code 603+ as defined in ATIS-1000099 for calls terminating on an IP network, or ISUP code 21 on non-IP networks.

SIP/2.0 603+ Decline
   --- meaning: blocked by analytics, not "user busy", not "number invalid"

That distinction is the single most useful piece of instrumentation an AI calling stack can expose, and in the incident that opens this article it was exactly what the operator lacked. A generic failure counter cannot tell you whether you have a routing bug or a reputation problem. A 603+ counter can. Ask your vendor whether it surfaces the code, and treat a shrug as an answer.

Attestation A, B and C: what your provider is really claiming

Attestation is a voice service provider's assertion about how well it knows you and your right to the number you are calling from. The Commission set out the three levels precisely in its May 2026 Further Notice of Proposed Rulemaking: a provider "may assert A-level (or 'full') attestation when it (1) is responsible for the origination of the call onto the IP network, (2) has a direct authenticated relationship with its customer and can identify the customer, and (3) has established a verified association between its customer and the telephone number used for the call" (FCC 26-32, adopted 20 May 2026, para. 54).

The Commission is blunt about what B and C mean in practice. Calls at those levels "are not necessarily spoofed, but they indicate that the voice service provider lacks sufficient knowledge to conclusively determine that fact." That is not an accusation. It is an absence of evidence, and analytics engines treat absence of evidence as a risk input.

Two clarifications that save arguments with vendors. First, attestation is not a score you earn by behaving well; it is a factual statement about paperwork and number records. Second, it is not delegable in the loose sense. Where a provider uses a third-party authentication service, the rules require that the provider itself "[m]akes all attestation-level decisions regarding the caller identification information of each SIP call it originates" and that the arrangement be memorialised in writing (47 CFR 64.6301(b)). A calling platform cannot simply decide it deserves an A.

The framework also carries real enforcement weight. In August 2024 the Commission settled with Lingo Telecom for a $1 million civil penalty after the provider applied A-level attestation to spoofed robocalls carrying a generative-AI clone of President Biden's voice ahead of the New Hampshire primary. The FNPRM records the count as 3,978 calls. The lesson generalises beyond election interference: the attestation stamp is a legal assertion, and a provider that hands them out to keep a customer happy is the provider most likely to lose its ability to sign anything.

Why AI callers land in bucket B: the knowledge gap the FCC just named

AI calling platforms sit almost perfectly inside a structural gap the Commission has now written down and proposed to close. In the same FNPRM it describes two scenarios in which the signing provider cannot honestly reach A. Scenario 1 is where "the originating provider that is authenticating the call is a separate entity from the telephone number service provider that provisioned the telephone numbers to the customer initiating the call". Scenario 2 is where the end user obtained service through a reseller, possibly several layers removed. An AI calling stack frequently produces both at once.

A practitioner described the mechanics before the Commission did. An engineer who says they worked on the framework for the two largest United States operators wrote on Hacker News in July 2026 that carriers "also sell blocks of phone numbers without the corresponding access network", which "is what allows you to pick, say, a Twilio number with a local area code", and that in those cases "the best that can be hoped for is a lesser attestation" (kjellsbells, Hacker News, July 2026).

The consequence is that a reputable enterprise using an AI caller and an offshore fraud operation can arrive at a terminating carrier carrying identical identity evidence, which is to say almost none. That is the deliverability problem in one sentence, and no amount of prompt engineering touches it.

It is worth being precise about what is broken, because the popular version is wrong. The framework is not failing because A-level attestation is hard to get. It is failing in both directions at once. The Commission cites an analysis by Numeracle finding that "93.4% of robocall traffic from the most prolific robocall signers now carry A-level attestations" and that "48 percent of illegal calls are A-attested". It cites the American Bankers Association's study of 12,900 calls that illegally spoofed numbers belonging to 47 large banks, retailers and healthcare providers, in which more than half of the calls received an A-level or B-level attestation. And it cites Transaction Network Services reporting that in the first half of 2025, "certain top tier carriers had marked around 8% of their invalid number calls with A-level attestation, and non-top tier carriers had marked 57% of their invalid number calls with A-level attestation."

Read those together and a strategic picture appears. Bad actors are already getting A. Legitimate enterprises running new AI calling stacks are frequently stuck at B. Attestation alone therefore does a poor job of separating them today, which is exactly why the Commission's May 2026 proposals move in two directions: tightening what providers must verify before claiming A, and proposing to "require all voice service providers that serve end users directly to make attestation-level decisions for their end users' SIP calls" so that the entity closest to the caller is the one making the claim.

For a company deploying an AI caller in the next year, the planning assumption should be that the level of documentation required to hold an A gets stricter, not looser, and that the identity evidence you assemble now is the thing that will still be valid afterwards.

What travels with a signed call, and what comes back when analytics decline it.

Three ways to get a number, and the attestation ceiling each one buys

There are exactly three sourcing routes, they are not equivalent, and most teams pick one by accident during a trial and then discover the ceiling in month four. Here they are with the trade-offs stated plainly.

Route 1: numbers rented from the AI calling platform or its carrier.

Best for: pilots, low volume, teams with no telecom function. How attestation works: the provider that assigned you the number is also the provider signing the call, so all three A-level criteria can be satisfied in one place. Twilio's documentation states that only "[p]hone number(s) assigned to both the Business Profile & SHAKEN/STIR Trust Product" will be signed A (Twilio SHAKEN/STIR onboarding docs). Pros: the shortest path to A; nothing to integrate; the vendor absorbs the certificate machinery. Cons: the number is not yours in any durable sense. Your reputation is built on an asset you rent, and it does not port cleanly to another vendor. If the platform pools numbers across customers, your traffic is scored alongside strangers. Bottom line: fine to start, wrong to standardise on if voice becomes a channel you depend on.

Route 2: bring your own existing business numbers.

Best for: organisations whose customers already recognise the number. How attestation works: the calling platform can identify you but cannot verify your right to a number it did not assign. Twilio states this outright: B "would also be the highest level of attestation possible if a customer is using non-Twilio phone numbers... because Twilio can't attest to a customer's right to use a phone number if it is not a Twilio phone number." Pros: continuity of a recognised identity; no dependence on rented assets; callbacks land in the right place. Cons: a hard B ceiling unless you add a mechanism to bridge the gap, and B disqualifies you from branded display. Bottom line: the right long-term identity, but only once you have closed the verification gap below.

Route 3: your own carrier relationship, with delegate certificates bridging the gap.

Best for: regulated industries, high volume, anyone for whom a mislabelled call is a customer-service incident. How attestation works: the number holder issues a cryptographic delegate certificate proving your authority to use the number, which you present to whichever provider originates the call. The Commission describes these as defined in ATIS-1000092 and proposes to find that they "are a viable method for originating providers to establish a verified association between a customer that is an initiating provider and the number being used to initiate the call." Pros: portability. The identity evidence belongs to you, not to a vendor, and it survives changing platforms. Cons: it is a telecom project, not a procurement decision. Delegate certificates sit outside the three ATIS standards providers are actually required to implement, so support is uneven and you will need to ask specifically. Bottom line: the only route where the identity asset is genuinely yours. Budget quarters, not sprints.

How "Spam Likely" is actually decided

A "Spam Likely" label is not a punishment issued by a regulator. It is a commercial decision by a terminating carrier or its analytics vendor, taken under a permission the Commission grants. A terminating provider may block calls without liability where blocking is "based on the use of reasonable analytics designed to identify unwanted calls" and "those analytics include consideration of caller ID authentication information where available" (47 CFR 64.1200(k)(3)). Attestation is an input to the model, not the model.

The rest of the model is behavioural, and one vendor now publishes its factors. Hiya grades caller reputation on four axes, each scored A to D: Maturity ("Do you use established numbers, without rotating?"), Connection ("Do recipients choose to answer your calls?"), Engagement ("Are recipients staying on the line after answering your calls"), and Sentiment ("Do recipients rarely complain about or block your calls?") (Hiya, caller reputation).

Look at those four through the lens of an AI caller and the risk profile is obvious. Automation raises volume per number, which stresses Maturity. It often shortens calls, which hurts Engagement. It removes the human judgement that used to stop a rep from dialing an obviously wrong-fit contact, which hurts Sentiment. An AI caller does not fail these tests because it is artificial; it fails them because it does at scale exactly the things the model is built to detect.

Vendors on the AI side confirm the pattern from their own support queues. Retell AI's guidance states that "[t]elecom providers use AI powered call analytics to block numbers that show patterns of mass calling, regardless of whether those calls are legitimate", and that "[b]usinesses that rely on multiple phone numbers for outreach often trigger spam filters, leading to automatic call rejection" (Retell AI).

There is one more escalation to know about. Where a provider reasonably determines that calls "are part of a particular call pattern that is highly likely to be illegal", it may block them with no consumer opt-out at all, provided it maintains "human oversight and network monitoring" and stops as soon as it has actual knowledge that the blocked calls are likely lawful (47 CFR 64.1200(k)(11)). A pattern, not a caller. An automated campaign that looks structurally like an illegal one can be caught by a rule written for someone else.

Branded calling: what A-level attestation unlocks

Branded calling is the thing every executive who has funded an AI caller actually wants: the company name, the logo and the reason for the call rendered on the handset instead of a bare number. It is real, it is standards-based, and it is gated on the attestation level.

The mechanism is Rich Call Data carried inside the same signed token. According to TransNexus's technical description of Branded Calling ID, the payload adds a caller name (nam), a logo URL (icn) and a call reason (crn), and the ecosystem is operated by "BCID, LLC, a subsidiary of CTIA". The gate is stated plainly: branded calls must "qualify for A attestation" to receive signed tokens carrying branded calling data.

That single sentence is why this article puts attestation first. Every other conversation about voice branding is downstream of it. A team that has settled for a B-attested platform number has, without knowing it, opted out of brand display for the life of that configuration.

Regulation is moving the same way. In its October 2025 Call Branding proposals the Commission set out plans to "require terminating voice service providers to transmit verified caller name information to the called party whenever they transmit call authentication information indicating that the originating number is unlikely to be spoofed" (FCC Call Branding FNPRM fact sheet, 7 October 2025). In plain terms: A-level attestation and a verified name are being welded together, so that showing the top level of trust without a verified identity behind it stops being an option.

Two honest cautions. Enrolment is not instant, and it is not free of vetting: only approved Vetting Agents may provision data into the BCID platform, and they are required to perform "rigorous vetting and validation of all enterprise information, including confirmation of identity and telephone numbers". And branded display is a trust amplifier, not an override. If your Sentiment grade is poor because the campaign is annoying people, putting your logo on it makes the complaint easier to file.

When you are blocked: the response code, the redress path, the 28-day list

Most teams running an AI caller treat a blocked number as weather. It is not; there is a defined redress path, and the obligations sit on the carrier.

Every terminating provider that blocks calls or uses caller ID authentication information in delivery decisions "must provide a single point of contact, readily available on the terminating provider's public-facing website, for receiving call blocking error complaints and verifying the authenticity of the calls of a calling party that is adversely affected by information provided by caller ID authentication". It must resolve authentication disputes "within a reasonable time and, at a minimum, provide a status update within 24 hours", and where a caller makes a credible claim of erroneous blocking and the provider agrees, it "must promptly cease the call treatment for that number". It may not charge you for any of this, provided the complaint is in good faith (47 CFR 64.1200(k)(8)).

There is also a discovery right most callers never use, though it is narrower than it first looks. Where a terminating provider blocks calls under an opt-out or opt-in analytics program, the subscriber to a number may request from that provider, at no charge and within three business days, "a list of calls to that number, including the date and time of the call and the calling number, that the terminating provider or its designee blocked pursuant to such analytics program" in the previous 28 days. It is a right attached to the number you subscribe to, not to numbers you dial.

The last row is the one people skip, and it is the cheapest to check.

The number hygiene an AI caller breaks first

Three habits that were harmless at human calling volumes become expensive once software is dialing.

Rotation. Cycling numbers to escape a bad label is the reflex, and it is precisely inverted. Maturity is a scored factor, so a fresh number starts with no history at all, which reads as risk rather than innocence. Hiya's own guidance to businesses is to avoid rotating phone numbers, because rotation undermines the reputation you are trying to build. Rotation buys days and costs quarters.

Reassignment. Phone numbers are recycled. Reporting carriers subject to section 52.15(f) of the Commission's rules must maintain records of "the most recent date each North American Numbering Plan (NANP) telephone number allocated or ported to the reporting carrier was permanently disconnected" (47 CFR 64.1200(l)), which is the foundation of the Reassigned Numbers Database. A contact list that has aged in a CRM will contain numbers now belonging to somebody else. A human rep hears the confusion in the first two seconds and hangs up. An automated caller works through its script, and every one of those calls is a Sentiment event against your number.

Orphaned numbers. The third failure is not technical at all. A campaign number is provisioned by whoever ran the pilot, billed to a team budget, and never assigned an owner. Six months later nobody can say what it is used for, whether it is still dialing, or who may retire it. This is the same pattern we described in our earlier analysis of shared AI agents: the asset outlives the person, and without a named owner the offboarding step never happens.

Reputation compounds on a number. Rotation resets the clock; reassignment and orphaned numbers poison it.

A dialing-reputation runbook you can run this week

None of this requires a telecom team to begin. Five steps for anyone already running or about to run an AI caller, in order, each answerable in an afternoon.

1. Find out what level your calls are signed at, and by whom. Place a test call to a line you control on a major mobile carrier and ask your provider for the attestation applied. If your provider cannot tell you the level and the signing entity, that is the finding.
2. Walk the Caller Provenance Chain for every number in production. For each: who holds it, who signs, what it attests, who owns it internally. Any row with a blank is a live risk, and the fourth column is usually the emptiest.
3. Instrument 603+ separately from every other failure. Count blocked-by-analytics per number and per terminating carrier. Without this split you cannot distinguish a reputation problem from a routing bug, which is how the operator in the opening problem lost two days.
4. Register your numbers, then stop moving them. Free registration with the major analytics vendors is the cheapest available signal, and it only pays off if the numbers stay put long enough to mature.
5. Set a scope and an expiry per number before the campaign launches. Which agent may use it, for what, and on what date it is reviewed or retired. Retrofitting this after a team reorganisation is far harder than doing it on day one.

The order matters. Steps 1 and 2 are diagnosis, step 3 is instrumentation, and steps 4 and 5 are the only two that compound. Teams that start at step 4 with numbers they cannot describe end up registering assets they will abandon.

What we checked ourselves, and what we could not

Two things we did directly, reported with the results as we found them.

We read the rules at source. Every rule citation above comes from the current Code of Federal Regulations text or from the Commission's own released documents, not from a summary. That matters more than usual on this topic, because the framework changed materially in the last twelve months: subpart HH carries amendments dated August 2025, and the attestation proposals discussed here were adopted on 20 May 2026 and are open for comment, which means the operating picture in a 2024 buyer's guide is now wrong in specifics.

We checked what AI calling vendors publish about attestation. We looked at the public documentation of a small sample of voice platforms to see whether a buyer can learn, without a sales call, who signs their calls and at what level. The results were uneven. Vapi's outbound calling documentation defines all three attestation levels and names the reputation services that score calls, including First Orion, Hiya and Nomorobo (Vapi outbound calling docs). Retell AI's verified phone number page, by contrast, documents the outcome without the mechanism: it offers a verified number to "remove 'Spam Likely' labels, increase trust with carriers, and improve outbound call pickup rates" and tells applicants to "[a]llow 1-2 weeks for your application to be processed", but does not state who signs the calls, at what attestation level, or under whose certificate (Retell AI verified phone documentation).

Neither approach is dishonest. But the second one leaves the buyer unable to answer the only question that determines whether branded calling will ever be available to them. If a vendor's documentation cannot tell you the attestation level, ask in procurement and get the answer in writing.

What we could not do. We have not run an outbound AI calling campaign, so we report no answer rates, no lift figures and no cost-per-connection of our own. We also could not query the FCC Robocall Mitigation Database programmatically to check the filings of named AI calling vendors; its public portal requires an interactive session and its API rejected unauthenticated requests, so a claim we would have liked to make about vendor filings is absent rather than estimated. Vendor-published answer-rate improvements from branded calling are widely quoted, and we have excluded them because none we found disclosed a methodology.

What an AI caller is not

An AI caller is not an auto-dialer with better speech. An auto-dialer plays a recording; an AI caller holds a conversation, and the difference matters legally because the identity and consent obligations attach to the organisation behind the call rather than to the technology.

It is not a telephony provider. The platform runs the conversation; a carrier still originates, signs and terminates the call. Every identity guarantee you care about is made by an entity whose name is probably not on your invoice.

It is not a way to escape number reputation. There is no configuration in which automated dialing is invisible to analytics engines, and the vendors who imply otherwise are selling you a claim they do not control.

And it is not a channel that behaves like email. There is no equivalent of a spam folder the recipient can rummage through. A blocked call leaves the recipient with no artefact at all, which is why the 603+ response code and the 28-day blocked-call list are the only visibility you get.

Where LeapForce fits, and where it does not

LeapForce does not place phone calls, sell numbers, or sign SIP traffic. Nothing in this article is a description of our product, and if you need attestation work done you need a carrier and possibly a vetting agent, not us.

What we do build is the layer the fourth link of the Caller Provenance Chain requires. LeapForce is one controlled layer for every AI tool, connector, model and agent, and it treats non-human identities as first-class: every agent has a named owner, an explicit scope and an expiry, with one-step offboarding when the owner leaves. An AI caller is a non-human identity with a phone number attached. It should be registered, scoped to the numbers and contact lists it may touch, and retired on a date, in the same register as every other agent in your company. Our observability and audit approach records what an agent was refused as well as what it did, which is the record you want when a regulator asks who authorised a campaign. And our rollout guidance is deliberately unexciting: Observe first. Enforce second. Optimize third. Watch what the agents are actually doing before writing policy about it.

Honest limits and open questions

Several things in this article are genuinely unsettled, and treating them as settled would be the easiest way to mislead someone.

The attestation rules are mid-amendment. The proposals to codify the attestation levels, define improper attestation and require providers serving end users directly to make attestation decisions are proposals. They were adopted as a Further Notice on 20 May 2026 with comment periods running from Federal Register publication. They may change or fail. Design for the direction of travel; do not assume the wording.

Attestation is a weak discriminator right now. On the Commission's own cited evidence, a large share of illegal traffic already carries A-level attestation. A reader should not conclude that reaching A makes their calls trusted, only that failing to reach A rules out branded display and removes a positive input from analytics models.

We have no independent measurement of label impact. The relationship between attestation level and answer rate is asserted by vendors with a commercial interest in it, and we found no independent study with a disclosed methodology. The mechanism is documented; the magnitude is not, and we have not published a number we cannot stand behind.

Everything here is United States framing. STIR/SHAKEN as described is a North American regime. The United Kingdom, the European Union and India are each pursuing different calling-line-identity and branded-calling approaches on different timetables, and none of the rule citations here transfer.

One structural bias in our sourcing. Reddit was not reachable during this research, so the practitioner voices here come from Hacker News and a vendor community forum, both of which skew technical. Buyers in marketing and customer-service functions, who are frequently the ones choosing AI calling tools, are under-represented in what we could gather.

Ready to Govern Your AI?

Talk to LeapForce — one controlled layer for every AI tool, connector, model, and agent.