--- title: Regulated Contact Centers in 2026: A Compliance Briefing | CoreCx AI url: https://www.corecx.ai/insights/regulated-contact-centres-2026/ description: Data sovereignty, AI on every call, PCI DSS v4.0, retention and post-quantum security: what banks, insurers and public bodies must plan for in 2026. publisher: CORECXAI PTE. LTD. updated: 2026-11-02 --- Briefing # Regulated contact centres, 2026 Data sovereignty, AI on every call, card data and post-quantum security are changing how banks, insurers and public bodies run their contact centers. A briefing for the teams that answer to a regulator. 31 October 2026 · 7 min read · CoreCx AI **In this briefing**[1\. Sovereignty: know where every conversation lives](#)[2\. AI on every call, inside your controls](#)[3\. Card data stays out of recordings](#)[4\. Retention is getting longer and more precise](#)[5\. Post-quantum security moves onto the risk register](#)[6\. Legacy recorders are reaching end of life](#)[What this means for your next review](#) [All insights](https://www.corecx.ai/insights/) ## 1\. Sovereignty: know where every conversation lives Privacy and technology-risk rules around the world now ask the same questions: where is customer data stored, who can reach it, and can you prove it. Examples include Singapore's Personal Data Protection Act and the MAS Technology Risk Management Guidelines, Indonesia's Personal Data Protection Law (fully in force since October 2024) and OJK rules for financial institutions, Bank Negara Malaysia's Risk Management in Technology policy, and the GDPR in Europe. For a contact center, that means recordings, transcripts, screen captures and their backups. Many regulated organisations now prefer to run contact center and recording platforms on-premise or in a cloud account they own, in a region they choose, rather than in a vendor's shared cloud. ## 2\. AI on every call, inside your controls Speech analytics and automated quality management can now cover every call, not a small sample. Supervisors see call drivers, sentiment and compliance gaps across the whole floor. The catch is that a transcript is as sensitive as the recording. Regulated teams are asking for models that run in their own environment, personal data redacted before anyone reads a transcript, an audit of every unmask, and a person confirming any score that affects an employee. The EU AI Act, in force since August 2024, adds to the expectation that AI decisions about people are explainable and supervised. ## 3\. Card data stays out of recordings PCI DSS v4.0 made a set of future-dated requirements mandatory from 31 March 2025. Any contact center that takes card payments over the phone must show that card numbers and security codes are not stored in recordings or transcripts in a readable form. The usual controls are a pause in recording while the card is read, with the reason audited, plus automatic redaction of card numbers, security codes and one-time passwords in transcripts, search and playback. ## 4\. Retention is getting longer and more precise Rules differ by country and sector, but the pattern is the same: keep each kind of conversation for its own period, freeze recordings under legal hold when a case opens, and delete on time with evidence that it happened. A single retention setting for the whole archive no longer satisfies an auditor. ## 5\. Post-quantum security moves onto the risk register NIST published its first post-quantum standards in August 2024. Because recordings are kept for many years, they are exposed to harvest-now, decrypt-later attacks. Expect auditors to ask how recording keys are protected and when post-quantum protection will be in place. ## 6\. Legacy recorders are reaching end of life Many organisations still run recording platforms bought ten or more years ago. Hardware and operating systems fall out of support, yet the archive must stay searchable until retention ends. Migrating that archive without losing a call has become a planned project rather than an afterthought. ## What this means for your next review - Map every place conversations are stored, including transcripts and backups. - Check that AI tools run inside your environment and redact personal data by default. - Test that card numbers cannot be found in recordings or transcripts. - Set retention per source and per campaign, with legal hold and approved purge. - Ask your vendors how recording keys are protected against quantum attacks. - Plan the retirement of legacy recorders before support ends. This briefing is general information, not legal advice. Your compliance team decides how each rule applies to you. **Key takeaways** - Regulators increasingly expect organisations to know where every conversation is stored and who can reach it. - AI on every call is now practical, but the transcripts and models are personal data too, and must sit inside the same controls. - PCI DSS v4.0 requirements that were future-dated became mandatory in March 2025, which makes card data in recordings a live audit question. - Long retention plus quantum computing turns key management into a board-level topic. **The products behind it**[**iFlux Recorder**Multivendor call recording, compliance-grade and sealed the moment every call is written.](https://www.corecx.ai/products/iflux-recorder/)[**CoreCx AI Hub**Speech analytics, conversation intelligence and autonomous quality management, on-premise or in your own cloud.](https://www.corecx.ai/products/corecx-ai-hub/)[**iFlux Contact Centre**An AI-ready contact centre that runs entirely on your infrastructure.](https://www.corecx.ai/products/iflux-contact-centre/) ## Frequently asked questions about this briefing Which regulations affect contact center call recording? It depends on your country and sector. Common examples are the GDPR, MiFID II and UK FCA rules in Europe, PCI DSS for card payments everywhere, Singapore's PDPA and MAS Technology Risk Management Guidelines, Indonesia's Personal Data Protection Law and OJK rules, and Bank Negara Malaysia's RMiT policy. Can a regulated contact center use AI on every call? Yes, provided the AI runs inside the same controls as the recordings: in your own environment, with personal data redacted by default, every unmask audited and a person confirming scores that affect employees. How do contact centers keep card data out of call recordings? By pausing recording while card details are given, auditing the reason for each pause, and automatically redacting card numbers, security codes and one-time passwords in transcripts, search and playback. ## More insights [All insights](https://www.corecx.ai/insights/) [ Guide ### Why seven-year recordings need post-quantum keys 6 min readRead ](https://www.corecx.ai/insights/post-quantum-keys-for-seven-year-call-recordings/)[ Playbook ### Leaving a legacy recorder without losing a call 6 min readRead ](https://www.corecx.ai/insights/leave-a-legacy-call-recorder-without-losing-a-call/) ## Talk it through with a specialist Bring your phone system, your retention rules and your regulator. We will map every line to a product and a setting. Contact us ## Talk to the right team. Call us, email us, or choose a form. A CoreCx specialist replies within one business day. [**Sales** Pricing, licensing, proposals and a demo on your own phone system. Contact Sales](https://www.corecx.ai/contact/) [**Product** Architecture, sizing, security packs, integrations and proof-of-concept requests. Contact Product](https://www.corecx.ai/contact/#product) [**Partners** Resellers, systems integrators and managed service providers who want to work with us. Become a partner](https://www.corecx.ai/contact/#partner) **Phone**[+65 9653 8072](tel:+6596538072)Monday to Friday, 9:00 to 18:00 Singapore time (UTC+8) **Email**[contact@corecx.ai](mailto:contact@corecx.ai)We reply within one business day **Singapore · HQ**_CORECXAI PTE. LTD._60 Paya Lebar Road #05-09 Paya Lebar Square Singapore 409051[Get directions](https://www.google.com/maps/search/?api=1&query=60+Paya+Lebar+Road+Paya+Lebar+Square+Singapore+409051) **Sydney · Australia**_CORECXAI PTY LTD_Suite 2, Level 3 13–15 Wentworth Avenue Sydney NSW 2000[Get directions](https://www.google.com/maps/search/?api=1&query=13-15+Wentworth+Avenue+Sydney+NSW+2000) **LinkedIn**[Follow us on LinkedIn](https://www.linkedin.com/company/corecx-ai/)News, product updates and careers Contact: contact@corecx.ai · https://www.corecx.ai/contact/