Part of the AI Regulation News hub.
Slovenia's Information Commissioner says, in a non-binding reply to one inquirer, that every use of personal data in an AI tool falls under the full GDPR rules and sends the calling-rule question to AKOS
This is a reply to a single letter, not general guidance. What it offers is a map of who answers what: GDPR questions stay with the Information Commissioner, while supervision of the calling rule in ZEKom-2 and of the AI Act disclosure duty is pointed to AKOS.
Bottom line: Non-binding, and addressed to one inquirer. The Commissioner calls it a "neobvezujoče mnenje" (non-binding opinion) and says that outside a concrete supervisory or other administrative procedure it cannot check lawfulness or AI Act compliance in a specific case. It creates no new duty for anyone.
Who this affects: Marketing and sales leads planning outbound calls with AI voice agents, vendors of those agents, data protection officers, and telecom compliance counsel working on Slovenian business-to-business outreach.
Issue date: 4 November 2026. The Commissioner's page carries the date 04.11.2026 and the number 07121-1/2026/1121. The opinion states no deadline.
What changed: No law changed. The Commissioner states three points: every processing of personal data in an AI tool (entry, storage, transfer) is subject to the full data protection rules, and most commercially available AI tools are currently problematic at least for protecting individuals' rights under the GDPR; the controller has to show a lawful basis; and the controller owes Article 13 information. It adds that a data protection impact assessment is likely at least when AI systems are developed, and it declines the calling-rule question under Article 226 ZEKom-2 as AKOS territory.
Analysis: Our reading, marked as inference: the opinion is more useful as a division of labour than as a ruling. On the Commissioner's account, a team planning AI voice calls in Slovenia would deal with at least two regulators, and the one that polices automated calling for marketing is not the one that wrote this opinion. A second point sits in the phone-number passage: the Commissioner names s.p. (sole trader) next to d.o.o. as forms of business whose number is not personal data, as long as no identifiable individual is tied to it.
Primary sources: Informacijski pooblaščenec, opinion 07121-1/2026/1121, 04.11.2026
- Instrument (EN)
- Non-binding opinion no. 07121-1/2026/1121 on AI voice-agent direct-marketing calls to business numbers. Native title: Vprašanje glede klicev AI glasovnega asistenta samostojnim podjetnikom (ZEKom-2). English rendering is ours
- Authority
- Informacijski pooblaščenec (Information Commissioner), Republic of Slovenia. Signed by dr. Jelena Virant Burnik, Informacijska pooblaščenka
- Jurisdiction
- Slovenia
- Status
- Published opinion, written in reply to a letter from an inquirer whom the page does not name
- Bindingness
- Non-binding. The Commissioner describes it as a "neobvezujoče mnenje" and reserves any final assessment to a concrete supervisory or administrative procedure
- Issue date / next deadline
- 4 November 2026. No deadline stated
- Legal bases cited
- Art. 70(8) AI Act; Art. 10(1) ZIUDHPUI (Uradni list RS, no. 85/25); Art. 55(1) point 5 ZVOP-2 (Uradni list RS, no. 163/22); Art. 58 GDPR; Art. 2 ZInfP
- Earlier opinions cited
- No. 07121-1/2026/581 of 15.6.2026 and no. 07121-1/2026/946 of 05.10.2026. We did not open either
- Primary source
- https://www.ip-rs.si/mnenja-zvop-2/vpra%C5%A1anje-glede-klicev-ai-glasovnega-asistenta-samostojnim-podjetnikom-zekom-2-1793785360
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
The question and how the Commissioner framed its answer
The Commissioner says it received a letter about introducing an AI-based voice agent that would call, for direct marketing, the business numbers that companies publish in business registers. The page prints no name for the inquirer and addresses the reply to "vaš dopis" (your letter), so this is correspondence made public, not a circular.
The Commissioner then fixes the limits of its own role. It says it may give non-binding opinions and explanations, but that outside concrete supervisory or other administrative procedures it may not verify lawfulness of processing in a specific case or compliance with the AI Act. A final view, it says, can come only in such a procedure.
That framing matters for anyone quoting the opinion to a client or a board. It is a position statement from the data protection authority, issued under a list of provisions that includes Article 70(8) of the AI Act, and it binds neither the inquirer nor anyone else.
The three points, as the Commissioner states them
First: every processing of personal data, with entry into an AI tool, storage and transfer as the examples, has to meet all the data protection rules, and most commercially available AI tools are currently problematic at least as regards protecting individuals' rights under the GDPR. The Commissioner uses the phrase "na zalogo" (roughly, in reserve) for collecting and keeping data without a clearly defined purpose, and says that is not permitted.
Second: under the accountability principle it is the controller's task to show a suitable lawful basis and suitable mechanisms to protect the data. Third: where the controller collects data from the individual, Article 13 GDPR information is owed, with the identity of the controller, the purpose, the retention period and the individual's rights as examples.
On foreign tools, the Commissioner asks whether personal data move to third countries outside the EU, and says that needs a "ločena pravna podlaga" (a separate legal basis). On impact assessments it recalls Article 35 GDPR and says there is a high likelihood that at least processing during development of AI systems will need one. The text speaks of development, so we do not read it as settling the position of a business that only buys and runs a finished tool.
Phone numbers: when they are personal data
The Commissioner starts from the GDPR definition: a phone number is personal data when an individual can be identified through it, for example because a specific person uses it as their own. It is not personal data when it is the number of a legal person. The page names s.p. and d.o.o. in that passage, though we have not independently checked how Slovenian law classifies an s.p., and the test it gives is that no identifiable individual is linked to the number.
The title of the opinion refers to sole traders (samostojni podjetniki), so a reader may expect the opposite conclusion. The text does not say that a sole trader's number is personal data. We have not checked how Slovenian law classes an s.p., and the opinion does not say which side of the line any particular number falls.
After this passage the Commissioner limits itself to the processing of phone numbers and call content where that processing involves personal data.
What the Commissioner sends to AKOS
On automated calling and communication systems for direct marketing the Commissioner points to Article 226 of the Zakon o elektronskih komunikacijah (ZEKom-2) and says it is not competent to supervise that article or to give opinions on it. Under Article 229 ZEKom-2 the competent body is AKOS, the Agency for Communication Networks and Services, and the Commissioner suggests the inquirer ask AKOS.
The Commissioner also draws attention to the AI Act. On its account, providers of AI systems intended to interact directly with natural persons have to design them so those persons are told they are dealing with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person given the circumstances. It says AKOS is likewise competent to supervise that obligation, which it ties to Article 50(1) of the AI Act.
For a voice agent that calls strangers, those two sentences cover the two questions a compliance lead would ask first: may we call at all, and do we have to say it is an AI. The Commissioner declines to interpret the calling rule, but it states the general AI-interaction disclosure duty and its exception for what is obvious to a reasonably well-informed, observant and circumspect person; AKOS supervises both provisions.
Reading it as a working team
Our reading, marked as inference. A team that wants to pilot AI voice calls into Slovenia can use the opinion as a checklist of questions to settle before launch, without treating it as a clearance.
Write down who the controller is and what lawful basis is claimed, since the Commissioner puts the burden of showing it on the controller. Draft the Article 13 information the call would carry. Find out whether call audio or transcripts leave the EU. Decide whether an impact assessment is needed, bearing in mind the Commissioner's remark is about development. Then put the calling-rule question to AKOS, because the Commissioner has said it will not give an opinion on it, and confirm with AKOS how it supervises the AI-disclosure duty, which the Commissioner says AKOS oversees.
None of this turns on a phone number belonging to a company. The opinion's own caveat is that the position changes if an identifiable individual is behind the number.
What we did not verify
We opened the Commissioner's page for opinion 07121-1/2026/1121 in full, in Slovenian, and checked each quotation and fact against the Slovenian text. We read the full text twice: once as extracted by a scraping tool and once as raw page HTML.
We did not open the earlier opinions 07121-1/2026/581 and 07121-1/2026/946, the Commissioner's AI and data protection page, ZEKom-2 (so we cannot say what Article 226 requires or what AKOS enforces), the AI Act text of Article 50, or any AKOS statement. We do not know who the inquirer is, whether AKOS has answered, or whether the Commissioner has issued a general position on AI voice agents elsewhere.
We do not claim that AI voice calls to business numbers are lawful or unlawful in Slovenia, that any commercial AI tool breaches the GDPR, or that the Commissioner's remark on impact assessments applies to a deployer. The sentence about the s.p. form is our reading of one parenthetical, not a statement of how Slovenian law classifies sole traders.
Treat this as a non-binding reply to one letter that tells you where the questions go. GDPR questions about the AI tool sit with the Information Commissioner, and the Commissioner expects the controller to show its lawful basis, give Article 13 information, and watch transfers to third countries. The Commissioner declines to interpret the rule on automated marketing calls, and on its account AKOS supervises both that rule and the AI Act duty to disclose an AI interaction. This is informational analysis for working professionals, not legal advice.
Source File
Open the Commissioner's page and confirm the date 04.11.2026, the number 07121-1/2026/1121, the phrase neobvezujoče mnenje, the three bold numbered points at the top, the passage on telephone numbers of legal persons (s.p. and d.o.o.), the references to Article 226 and Article 229 ZEKom-2, and the closing paragraph on Article 50(1) of the AI Act. Then confirm the signature block reads dr. Jelena Virant Burnik, Informacijska pooblaščenka.
Večina komercialno dostopnih orodij UI je trenutno problematičnih najmanj iz vidika zagotavljanja varstva pravic posameznikov skladno s Splošno uredbo. · Informacijski pooblaščenec, opinion 07121-1/2026/1121, 4 November 2026 (original Slovenian)
FAQ
Is the Slovenian Information Commissioner's opinion on AI voice agents binding?
No. The Commissioner calls it a non-binding opinion and says it cannot, outside a concrete supervisory or administrative procedure, check lawfulness or AI Act compliance in a specific case. It was written in reply to one inquirer's letter.
Does the opinion say AI voice agents may call business numbers?
It does not. It addresses the data protection side only: lawful basis, Article 13 information, transfers to third countries and impact assessments. The question whether automated calling for direct marketing is allowed under Article 226 ZEKom-2 is sent to AKOS.
When is a phone number personal data under the opinion?
When an individual can be identified through it, for example because a specific person uses it as their own. The Commissioner says it is not personal data when it is a legal person's number, naming s.p. and d.o.o. forms as examples, provided no identifiable individual is linked to it.
Who supervises the AI Act duty to tell people they are talking to an AI?
On the Commissioner's account, AKOS. The opinion says providers of AI systems meant to interact directly with people have to design them so people are informed unless the interaction is obvious to a reasonably well-informed, observant and circumspect person in the circumstances, citing Article 50(1) of the AI Act, and that AKOS supervises that obligation.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.