Sampling isn’t evidence: what the new compliance rules mean for your contact centre

Compliance used to be something you could, quietly, budget for. A fine here, a sample there, a QA process that reviewed a small slice of calls and hoped the rest looked the same.

That maths no longer works.

In 2026 the cost of getting it wrong has changed by an order of magnitude, and regulators have moved from asking whether you’ve done the work to asking you to prove it. In our recent webinar, Kayleigh Tait and Conor Bowler walked through what’s changed, shared new research from more than 300 UK contact centre leaders, and showed how MaxContact’s Auto-QA closes the gap. Here’s the summary.

‍

The 2026 compliance landscape

Two things have shifted at once.

First, the numbers. PECR - the regulation governing outbound calls, texts and marketing communications - used to cap fines at £500,000. Since the Data (Use and Access) Act came into force in February 2026, that cap has risen to £17.5 million, or 4% of global turnover, whichever is higher. That’s a 35x increase in maximum exposure. And for the first time, company directors can be held personally liable, up to £500,000 each.

Second, the FCA’s stance. Consumer Duty has been law since 2023, but the regulator has moved from “have you put this in place?” to “prove it with evidence.” Of the 180 board reports the FCA reviewed last year, the most common failure wasn’t that firms hadn’t done the work - it was that they couldn’t evidence the outcomes for vulnerable customers.

At these levels, a fine isn’t a line item you plan for. It’s a risk you have to design out.

‍

What the research found

To ground this in reality rather than headline numbers, MaxContact commissioned independent research across 300+ UK contact centre leaders, 285 of them FCA-regulated. A few findings stood out.

Coverage has matured - but gaps remain. Asked how they review calls today:

• 49.5% still sample manually
• 46.7% already use AI to review every call
• 2.8% review nothing systematically

That’s a more mature picture than the “2–3% sampled” figure often quoted in industry research. But it also confirms that a real share of organisations still aren’t solving the problem with technology.

Sampling leaves you exposed. More than half - 54% - said a compliance breach or harm had occurred outside their routine QA process. 16.5% said it had happened more than once. The point is simple: if you only look at a sample, the problems tend to live in the calls you didn’t look at.

And it costs real money. Across everyone surveyed - including firms that paid nothing - the average regulatory fine in the last 12 months was £81,000, with 31% paying £50,000 or more. Fines weren’t the whole story either: the average lost revenue from non-compliant sales (refunds, cancellations, deals that fell through) was £22,000, and 50.2% said they’d lost a sale, contract or customer over a compliance issue.

‍

‍

The confidence gap

One of the more revealing findings came from asking teams two questions. First: how confident are you that you could evidence fair treatment if the FCA came knocking? Confidence was high across the board.

Then we flipped it: have you actually found a breach outside your QA sample? The gap between the two is the interesting bit.

It’s less about how hard a team looks and more about what they’re looking at. Sales and collections calls tend to follow scripts and structured flows, so there are only so many ways a conversation can drift out of compliance. Customer care and technical support calls are far less scripted - troubleshooting, escalations, one-off advice - so there’s more variance per call, and more chance of a breach hiding in the calls that never make it into the sample.

‍

The feedback delay problem

Even when issues are caught, they’re caught slowly. On average, it takes 3.08 days between a call happening and the person who took it getting feedback. Only 10.9% hear back within a day; over a third (37.2%) wait three days or more.

The blocker isn’t attitude. Time, cost and headcount accounted for 37.4% of the reasons given, while only 6% felt there was no genuine need for faster feedback.

That delay matters, because feedback has a shelf life. Third-party research shows employees are 3.6x more likely to say they’re motivated to do outstanding work when feedback comes daily rather than at a quarterly or annual review. Put the two together and the risk is clear: if something’s going wrong on a call and nobody flags it for the best part of a working week, it’s probably happening again and again in the meantime.

‍

AI Call Scoring vs Auto QA at Scale

MaxContact addresses this with two features inside Conversation Analytics. They’re easy to blur together, so it’s worth being precise.

AI Call Scoring is an AI scorecard builder, included in the Conversation Analytics base package. You write the scorecard in plain English, and it scores individual calls — a human still picks which calls to run it against. It cuts review time from 2–3x the length of the call down to around five minutes per call.

Auto QA at Scale takes those same scorecards and runs them on a schedule - historically and as new calls come in - so you get consistent coverage across 100% of eligible calls. Every result is backed by evidence in the transcript, and calls are grouped by outcome (pass, fail, auto-fail, not applicable) so your team can focus human review where it’s needed.

‍

What Auto-QA looks like in practice

In the demo, Conor built an FCA compliance scorecard and showed how it runs at scale. A few things worth knowing:

• Build the scorecard the way that suits you. You can draft it in a tool like Excel first - using comments and track changes to collaborate - then bring it into Conversation Analytics. Each criterion is defined across what to detect, what to listen for, and how to score it, using a decision tree where possible to keep scoring consistent.
• It handles vulnerability. The scorecard can detect drivers of vulnerability across health, life events, resilience and capability, and score whether the agent acknowledged, semi-acknowledged or missed the indicators - directly relevant to the FCA’s focus on vulnerable customers.
• Schedules do the running. Choose an always-on schedule (new calls scored as they come in) or a one-time run (for example, 5% of last quarter’s calls to check historical compliance). Add rules - minimum call length, successful outcomes only - set the sample size, activate, and it runs.
• Filter and report on what matters. Build views by result - passes, fails, auto-fails - and drill into any call to see the evaluation summary and exactly why it failed. Performance reporting breaks results down by campaign, team and user, with more question-level reporting arriving shortly.

‍

Common questions from the session

Isn’t AI scoring just swapping one compliance risk for another? No - because it isn’t a black box. Every score links straight back to the exact part of the transcript it came from, so a QA lead can check any result against the call in seconds. The AI decides what needs looking at; a human still decides what to do about it.

We already run Conversation Analytics with AI Call Scoring - is Auto-QA a big project? No. It sits on infrastructure you already have, so it’s a matter of turning the feature on. Your existing scorecards carry straight over — you’re not rebuilding anything. What changes is that scoring runs on a schedule against every eligible call, rather than a person choosing which calls to score.

Can results be shown to agents, not just QA? This is in development, and it’s permissions-based - you control the level of detail. The plan is three layers of feedback: calls scored in real time as they happen, a daily “top three to improve, top three strengths” summary, and the same across a rolling seven-day view.

‍

The takeaway

The rules have changed, and sampling no longer counts as evidence. When breaches hide in the calls you don’t review, and feedback takes three days to land, the fix is coverage that’s complete, evidenced and fast. That’s exactly the gap Auto-QA is built to close.

‍
About MaxContact

MaxContact is an AI-powered customer engagement platform that helps businesses turn every customer conversation into a revenue-driving outcome. Our platform spans contact centre software, conversation analytics, and AI agents and chatbots - working together as one connected solution. Book a demo.

‍

Auto QA scores 100% of your eligible interactions against your own criteria and links every score back to the exact exchange in the transcript. When a regulator, an ombudsman or the board asks about a specific call, the evidence already exists.

Reviewing every call turns out not to be the finish line

We surveyed 300 UK contact centre managers and directors in August. 285 of them operate under FCA regulation, and among that group, 46.7% already have AI reviewing every single call. For years the case for automating Quality Assurance was that you could only ever listen to a fraction of your conversations. For half this market, that's no longer the problem. So, we asked those same 285 people whether they'd ever found a compliance breach or harm issue outside their routine Quality Assurance sample.

54.0% said yes. 16.5% had found more than one.

Reviewing everything, it turns out, isn't the same as being able to prove anything. Consumer Duty doesn't ask whether a conversation was recorded or even scanned. It asks for an assessment against defined criteria, applied consistently, with an audit trail and a demonstrable link between what you found and what you did about it. Plenty of businesses now have automated review across all their calls. Far fewer could produce that chain for one named customer, on one named call, this week.

The part that costs money is the wait

The other finding that shaped this product was about speed. Only 10.9% of regulated – businesses get feedback to an agent within a day of the call. The mean is 3.08 days. And when we asked what stops teams reviewing more, the answers were about resource rather than capability - time, cost and headcount accounted for 67.4% between them. Three days is a long time on a contact centre floor. A missed disclosure or a mishandled vulnerability marker usually isn't a one-off; it's a habit, and it carries on across conversations nobody has flagged yet.

The end of the Quality Assurance Sample

Every eligible interaction is scored automatically, as soon as the transcript is available. There are no selection step and no queue. Scorecard criteria are written in plain English rather than built from keyword rules or complex logic, so your Quality Assurance team can create and change them quickly and without waiting on us. Every score is evidence-linked, so a result can be defended in a coaching session, an internal audit or a regulatory review.

And because it's one evidence layer rather than three, Operations, Quality Assurance and Compliance are working from the same view of the same conversations instead of separate samples and separate conclusions. Your reviewers keep the final say throughout. They can challenge a score, question an output and recalibrate criteria whenever the operation changes.

If you already use MaxContact’s Conversation Analytics, you already have AI Call Scoring. That lets your team score selected calls against your existing scorecard, taking a review from roughly thirty minutes down to five - around four days a month back for a reviewer. Auto QA is the paid add-on that removes the selection step entirely and turns that output into a complete, auditable record across every call.

Available today

Auto QA is available now as an add-on to Conversation Analytics. Existing customers can speak to their Customer Success contact about switching it on. If you'd like to see it working on your own call volume rather than ours, book a demo and we'll walk you through it.

Sales want to push performance. Compliance want to protect against risk. 77.5% of the managers and directors in our research agreed that pushing performance raises compliance risk - so this isn't a tension anyone needs convincing of. Score every call and both teams are at least arguing from the same evidence.

Let sales win. Let compliance sleep.

The full research is in Confidence Is Not Evidence: The 2026 UK Conduct Risk Report - findings from all 285 regulated respondents, plus five questions we think belong in a Consumer Duty board report this year. For more on how automated Quality Assurance works in practice, see AI Quality Assurance in Contact Centres: Why Reviewing Every Call Isn't Enough.

A major UK utility provider announced this week that it's cutting 1,300 jobs, leaning harder into AI and digital service. It won't be the last business to make this call, and it's not the first either. Across most industries right now, there's a version of the same bet being placed: that customers are ready to swap people for bots.

Our sales team has had some version of this conversation with almost every customer and prospect this week. The question underneath it is always the same - should we be doing this too?

"It's the question everyone's asking right now," says Richard Langham, VP of Sales at MaxContact. "Listening to your customers is exactly the right instinct. The mistake is assuming what worked for one business, in one industry, applies everywhere else. Consumer behaviour isn't uniform, and neither are the moments that matter to people. Before following someone else's playbook, it's worth checking what your own customers think - not what another sector's did."

We put that question to the public directly. Our Voice of the UK Consumer 2026 report surveyed over 1,000 UK consumers on exactly this: where do you want AI, and where do you want a human? The answers are more specific, and more useful, than "customers are moving online."

‍

Consumers draw a hard line on where AI belongs

We asked people which situations they'd want to keep AI out of entirely. They were clear. Over half (54%) don't want AI anywhere near an emergency. Half say the same for complex account problems. Financial discussions (49%) and negotiating terms (46%) aren't far behind.

Flip the question and ask where a human matters most, and you get the same answer from the other direction: emergencies top the list at 41%, then complex account queries (33%), financial discussions (29%), and explaining something personal or sensitive (26%).

These situations are more common than they might sound. A missed bill. A bereavement. A boiler packing in over winter. Someone explaining a difficult situation to a company for the first time. Contact centres deal with moments like these every single day - and our data says people want a person on the other end when it happens.

‍

AI has its place

There's real appetite for automation where it's genuinely useful: answering FAQs, routing calls, pulling up account updates. People are happy to let a bot handle the boring stuff.

There's even one situation where AI wins outright: talking to a lender about financial difficulty. More people choose AI here than a human agent. But when you dig into why, it's not enthusiasm for the technology - it's privacy. People find it easier to admit they're struggling to a screen than to a person. That's not proof consumers prefer bots. It's proof they want to avoid judgement.

‍

Listen to your own customers, not someone else's headline

"A telecoms customer, an insurance customer and an energy customer don't necessarily feel the same way about AI," Langham says. "What one industry can get away with, another can't. What worked for one company's customer base might land completely differently with yours."

‍

Here's what to get right before making any move on the back of someone else's numbers:

• Check your own data before borrowing someone else's conclusion - a drop in call volume tells you what stopped happening, not why, and not whether it's safe to read as "customers don't want people anymore."
• Keep the human path open exactly where our data says it counts - emergencies, complex issues, money problems, anything personal. These are the situations where AI is least welcome, and where getting it wrong does the most damage to trust.
• Tell people when they're talking to AI - 88% of consumers say this matters, half calling it very important. If AI is handling more of your first-line contact, being upfront about it isn't optional. It's what keeps trust intact.
• Moving contact online doesn't close the trust gap on its own. Keeping a human reachable for the moments people care about most does, and knowing which moments those are for your customers - not someone else's - is the bit worth getting right.

If you're weighing up a similar decision, don't do it on assumptions borrowed from a headline. Get the full picture - including sector-by-sector breakdowns for utilities, telecoms, finance/debt and insurance - in our Voice of the UK Consumer 2026 report. Download here.

‍