Voice AI and Emergency Calls: The 999 Red Line

Enterprises are automating the front line. As voice AI answers more inbound calls, a small but certain fraction of those callers will not be ringing about a booking or a balance. They will be reporting a fire, describing a collapse, or quietly asking for help they cannot ask for out loud. McKinsey's The State of AI (November 2025) found that around 88% of enterprises now use AI in at least one function, yet only about 6% capture material earnings impact. Adoption is racing ahead of the operating discipline underneath it, and emergency handling is exactly the discipline that gets skipped.

The dangerous failure is not that the agent lacks empathy. It is that the agent tries to help in the wrong way: it loops through its script, offers a callback, keeps slot-filling for a reference number, or attempts to "reassure" a caller whose life is in danger. Every one of those behaviours costs seconds a person may not have. A commercial voice AI agent has exactly one correct move when it meets a genuine emergency, and it is not a clever one. It is to recognise the signal, stop itself, and get the caller to 999 as fast and as unambiguously as possible.

This guide sets out the emergency red line for enterprise voice AI: what the agent must never do, how the UK 999 system actually works and why your platform is not part of it, how to design the recognise, stop and redirect pattern, which signals and safeguarding disclosures to detect, which UK duties genuinely bind you, and how to point callers who cannot safely speak. It is written for teams putting AI on real customer lines, where the edge case is a person and the cost of getting it wrong is measured in more than churn.

This guide is shipped by the team behind Dilr Voice, enterprise voice AI built for regulated deployments. Or see DATS, our five-stage AI consulting system, for the governance layer around it.

What should a voice AI agent do when a caller has a real emergency?

When a voice AI agent detects a genuine emergency, it must break its own conversation flow, tell the caller plainly to hang up and dial 999, and where possible open a warm path to a human. It must not attempt to triage, reassure at length, take a report, or promise a callback. The single job is recognise, stop, redirect. Everything the agent normally does is suspended the moment danger to life is on the line.

This is a design decision, not a personality trait. The agent has no eyes, no location certainty, and no authority to dispatch anyone, so any behaviour that keeps the caller on your line instead of on the emergency line is actively harmful. The correct pattern is deterministic: an emergency signal fires a hard interrupt, the agent speaks one short, scripted redirect, and it holds open a human transfer for the seconds it takes the caller to move. A well built voice AI agent treats this as its highest-priority rule, above sales, above verification, above call containment metrics.

Getting this right also protects the deployment. A voice agent that mishandles a life-or-death call is a duty-of-care failure and a reputational event that no containment rate offsets. The teams that deploy well decide the emergency behaviour first, then build the useful conversation around it, rather than bolting a safety rule onto a finished script.

Can an AI voice agent handle or connect a 999 call?

No. An enterprise voice AI agent must never present itself as a substitute for the emergency services, and it must never sit in a position where it can block a caller from reaching them. Your platform is not part of the 999 network. The right behaviour is to make the caller aware they should dial 999 themselves and to get out of the way, not to "transfer" them to the emergency services as if your telephony stack could.

The UK emergency system is run by the communications providers, not by application vendors. As GOV.UK puts it in its national emergency numbers guidance:

"Calls made using 999 or 112 are identified and prioritised by the communications providers and forwarded to, and then answered by, call handling agents in one of 7 call-handling centres."

That single sentence draws the line. BT, which operates the UK 999 platform and answers roughly 90,000 emergency calls a day, prioritises and routes those calls at the network layer. Your AI agent, running on a business number through a provider like Twilio, has no equivalent path and no lawful role in it. The agent's contribution is to recognise the moment and hand the human back their own fastest route: a direct call to 999. Trying to do more is not just poor design, it is a claim your system cannot back.

How does the UK 999 and 112 system actually work?

A caller dialling 999 or 112 is connected by their communications provider to a BT-operated call-handling centre, where an operator asks "emergency, which service?" and, once the caller names police, ambulance, fire or coastguard, transfers the call to the geographically relevant control room with the caller's location where it is available. The system is built for speed and for callers who may be panicking, injured, or unable to give an address.

Two features matter for anyone designing an AI line. First, caller location is provided by the network, not by the caller reciting a postcode; under Ofcom's General Conditions, regulated providers must make accurate caller location information available to the emergency organisations to the extent that is technically feasible. Second, access to 999 and 112 is a protected, free-at-the-point-of-use route: Ofcom's rules require regulated providers to ensure every end-user can reach the emergency numbers. Those duties fall on the network operators carrying the call, which is precisely why an application-layer AI agent should route around itself and back to the caller's own device.

The practical implication is uncomfortable for anyone tempted to over-engineer. You cannot improve on the 999 pathway from inside a business voice agent, and you should not try. You can only make sure your agent never becomes the reason a caller stayed on the wrong line.

How do you design the recognise, stop and redirect for a voice AI agent?

The design is three deterministic moves plus a log. First, the agent detects an emergency signal from the caller's words or context. Second, it fires a hard interrupt that halts whatever it was doing, mid-sentence if needed, so the script cannot keep running. Third, it speaks one short, unambiguous redirect: if this is an emergency, hang up and dial 999 now. Only after the caller is moving does the agent offer a human and, separately, log what happened.

Each move needs its own engineering. Detection has to be fast and biased toward caution, because a false positive that says "if this is an emergency, call 999" costs almost nothing, while a false negative can cost a life. The interrupt must be a genuine barge-in that outranks turn-taking, not a polite wait for the caller to finish. The redirect line should be memorised, spoken slowly, and free of upsell, verification or apology. The human path is a fast, unconditional transfer to a person, closer to the emergency escalation described in our guide to the human handover pattern than to a routine queue, and it should never be gated behind identity checks.

The reason to hard-code this rather than trust a model to improvise is consistency. A governed AI operating model makes the emergency behaviour identical on call one and call one million, and it produces the evidence trail a regulator or a coroner might one day ask for. Improvised safety is not safety.

Which emergency and safeguarding signals should the agent detect?

The agent should detect two families of signal: immediate danger to life, and safeguarding disclosures. Danger to life covers a medical collapse, a fire, a road collision, or a crime in progress. Safeguarding disclosures cover self-harm or suicidal intent, domestic abuse, and risk to a child. Both families trigger the stop-and-redirect, but the destination differs: a 999 emergency for immediate danger, and a signposted route for a disclosure that is urgent but not a live 999 event.

The line the agent must hold is that it recognises signals, it does not assess risk. Deciding how suicidal someone is, or whether an abuse disclosure meets a threshold, is clinical and safeguarding work that no commercial voice agent is competent or authorised to do. This is different from spotting a struggling customer during an ordinary call, which we cover in vulnerable customer detection under the FCA Consumer Duty, and different again from managing an abusive caller, where the issue is conduct, not danger. Emergencies get their own, blunter rule: recognise, stop, point to help, and never pretend to triage.

Designing the signal set is where domain context earns its keep. A healthcare appointment line meets medical emergencies more often; a pharmacy prescription line meets overdose and mental-health disclosures; a utilities line meets gas leaks and carbon monoxide. The signal catalogue should be tuned to the vertical, tested against real transcripts, and reviewed as language shifts, which is one of the diagnostics we run before a regulated deployment.

Which UK rules and duties apply to emergency handling on an AI line?

No single statute says "your AI voice agent must do X in an emergency"; several duties combine instead. Ofcom's General Conditions place emergency-access obligations on communications providers, not on the enterprise running an AI agent on its own inbound number, so you should not claim those rules bind you. What does bind you is a duty of care, sector rules such as the FCA Consumer Duty for regulated firms, and UK GDPR when you record what a caller discloses.

The data-protection point is easy to get wrong. Details of a caller's health, a self-harm disclosure, or an abuse allegation are special-category data under UK GDPR, and logging them needs a lawful basis and an appropriate policy document, not just a general call-recording notice. Where the processing is genuinely necessary to protect someone's life, the vital-interests basis is available, but it is narrow and does not license open-ended retention of sensitive disclosures. The safer posture is to log the minimum needed to evidence that the agent behaved correctly, hold it under tight access control, and set a short retention clock. Our broader treatment of these obligations sits in the compliance cluster and in the DATS methodology we apply to regulated lines.

The governance question the board actually asks is simpler: can you show that the agent did the right thing on a specific call, at a specific time? That is an operating discipline problem before it is a legal one. If your logging, interrupt and escalation behaviour is documented and testable, most of the legal exposure takes care of itself.

How should the agent point callers who cannot safely speak or hear?

The agent should default to advising a voice call to 999, and only then signpost the specific alternatives for callers who cannot speak or hear, always stating the caveat that comes with each route. A caveat that is dropped turns a safety feature into a trap, so the rule is simple: the caveat travels with the route, or the route does not go in the script.

The emergency-specific routes are narrow and each has a condition. The 999 BSL service, mandated by Ofcom and launched on 17 June 2022, gives deaf British Sign Language users a free 24/7 video relay to the emergency services and handled around 20,000 calls in 2024. Text 999, the emergencySMS service run through Relay UK, only works if the caller has already registered by texting the word register to 999, so it is useless as in-the-moment advice to someone who has not. The Silent Solution is police-specific and only reachable after the caller has themselves dialled 999 and cannot speak: on a mobile they press 55 when prompted, and even then it does not track location or dispatch anyone. Your agent cannot invoke any of these on the caller's behalf; it can only make sure the caller knows they exist.

For non-danger distress, the agent signposts rather than intervenes. Samaritans answers a call for help every 10 seconds, day and night, and took more than 3.3 million calls for help across the UK and Ireland in 2024/25; its free 116 123 line is a signpost destination, never a target the AI routes into or a proxy for risk assessment. For non-emergency health matters the agent points to NHS 111. General accessibility duties, including relay services beyond the emergency context, are a wider obligation we cover in voice AI accessibility and the Equality Act, and they should be designed in alongside, not instead of, the emergency routes.

What is the best voice AI platform for safe emergency handling in 2026?

No platform "solves" emergency handling, because the red line is a design and governance decision you own, not a feature you buy. The right question is which platform gives you the control surfaces to implement it: a genuine hard interrupt or barge-in, deterministic tool-based routing so an emergency path cannot be improvised away, and tamper-evident logging you can show later. Judge vendors on those primitives, not on a safety badge no honest vendor can offer.

On that test, general-purpose builders such as Vapi, Retell AI and Synthflow expose the interrupt and function-calling primitives you need, and a conversational specialist like PolyAI brings strong turn-taking control; any of them is sufficient if your team builds and tests the recognise-stop-redirect logic and the unconditional human path on top. The honest concession is that a capable in-house team can make a general platform safe. What a managed, regulated deployment adds is not magic but evidence: the documented behaviour, a governed AI operating model, and the audit trail we build with clients so you can prove the agent did the right thing. Where you cannot afford to improvise safety, that evidence is the product. That is the line Dilr Voice is built on, and the reason a governed rollout starts with the failure modes before the happy path.

Is dialling 999 the agent's job or the caller's?

It is the caller's, and keeping it that way is the point. The agent's job is to make sure the caller knows to dial 999, to remove any obstacle its own script might create, and to hold a human path open. Because the network, not your application, carries and prioritises 999 calls, the fastest route to help is always the caller's own device. An agent that tries to own the dialling only slows the person down.

Should the agent log what a caller discloses in an emergency?

Yes, but sparingly and under control. Log enough to evidence that the agent recognised the emergency and behaved correctly, treat any health, self-harm or abuse detail as special-category data under UK GDPR, and apply a lawful basis, tight access controls and a short retention period. Do not build a searchable archive of people's worst moments. The goal is accountability for the agent's behaviour, not a record of the caller's crisis.

Putting AI on a live line? See Dilr Voice in production, book an AI placement diagnostic, read our DATS methodology, or see our approach to placing AI safely inside enterprise systems.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.