Emergency & Urgent Calls

Step 1Two obligations you already have, and who they attach to.

Start here because it is the only part of this page with a rulebook, and because teams routinely assume it is somebody else's problem. In the United States, a multi-line telephone system — which is what your PBX, your cloud contact-centre tenant and the SIP trunk your agent sits on collectively are — carries two federal requirements, and neither mentions who or what answers inbound calls.

• Kari's Law: direct dialing and on-site notification. A user must be able to reach 911 by dialing 911, with no prefix and no access code, and the system must notify someone on-site — a front desk, a security office, a designated contact — when that happens. The FCC adopted the implementing rules in August 2019; they apply to MLTS manufactured, imported, offered for first sale or lease, first sold or leased, or installed after 16 February 2020, which covers essentially any voice stack built since.
• RAY BAUM's Act section 506: dispatchable location. A 911 call must convey the caller's dispatchable location — defined as the street address plus additional information such as room number or floor number sufficient to identify where the caller is. The deadlines have long passed: on-premises fixed devices from 6 January 2021, on-premises non-fixed devices from 6 January 2022 where technically feasible.

Read the implication rather than the text. These rules are about the system, so adding an agent does not create a new obligation and does not discharge an existing one — but an agent changes the failure modes dramatically. A caller who dials your main line and gets an agent is not making a 911 call, so the rules above are not directly in play; the moment your flow offers to connect anyone to emergency services, or your deployment is on-premises where a handset shares the trunk, you are inside them. And a stack that routes outbound calls through a model-driven orchestrator can silently break direct dialing, because an orchestrator that normalises dialled strings is exactly the kind of component that eats a three-digit number.

Step 2The detector belongs below the model, not inside it.

This is the architectural decision that determines whether the rest works, and most designs get it wrong by putting emergency handling in the prompt or in a tool the model may choose to call.

Consider the actual timing. The agent is three seconds into reading a menu or a confirmation. The caller interrupts: "there's smoke coming from the back room". In a cascade stack the partial transcript exists in the ASR stream immediately; in a speech-to-speech stack the audio is already in the model's input. In both cases the model is mid-generation and will finish its turn before it reasons about anything, and if barge-in is tuned conservatively to avoid false interruptions, it may not even register the utterance as a turn. Every millisecond of that is a millisecond where a deterministic matcher on the partial transcript could already have torn down the agent and dialled out.

# two places the detector can live

  model-owned                  pipeline-owned
  ------------                 --------------
  prompt says "if emergency,   matcher runs on every partial
  call transfer_urgent()"      ASR hypothesis, always

  fires: after the turn        fires: mid-utterance, <300 ms
  depends on: model available  depends on: ASR available
  fails when: context is full, fails when: ASR is down
    tool list changed, model     (and then the call is dead
    is mid-generation, the       anyway, so the dependency
    router picked a smaller      is one you already have)
    model, a guardrail ate it

# the right answer is BOTH, with the pipeline one load-bearing.

So: run a deterministic classifier over every partial ASR hypothesis, in the media path, with authority to pre-empt the agent. Keep the model-side tool as well — it catches the paraphrases a matcher misses — but never let it be the only route. A tool call is a request the model makes when it is healthy and attentive; an emergency is the case where you cannot assume either. This is the same reasoning that makes a kill switch something outside the thing it stops.

A speech-to-speech deployment needs a second ASR stream for exactly this reason, and teams resist the cost. It is the cheapest insurance on the page: a small streaming recogniser whose only job is to watch for a short list of phrase patterns, never used for the conversation itself.

Step 3What "deterministic route" actually means, end to end.

Deterministic does not mean keyword-only. It means every link in the chain behaves the same way on every invocation, and no link asks a model for permission.

• Trigger set, versioned and reviewed like code. Explicit phrases ("call 911", "ambulance", "I'm having a heart attack"), indirect ones ("I can't breathe", "he's not waking up", "there's a fire"), and the caller's own request to stop talking to a machine. Keep it in a reviewed file with owners, not in a prompt. Expect it to be imperfect — its job is coverage of the common cases at a threshold you deliberately set too low.
• A DTMF escape that works before and during any prompt. One key, announced early, documented, and handled in the telephony layer so it works even if the agent process has stopped responding. This is also the only path available to a caller who cannot speak, which is a population that overlaps heavily with emergencies.
• Pre-empt, do not negotiate. On trigger, stop TTS immediately, stop generation, and move. Do not confirm ("just to check, is this an emergency?"), do not summarise, do not ask for an account number. Confirmation costs seconds and risks a caller who has put the phone down to deal with the thing they called about.
• No queue, ever. The emergency route must terminate at something that answers: a dedicated DID, an on-call group with a cascade, or the PSTN. If your only human path is a queue with a wait, the emergency route is not a route.
• A terminal announcement if everything else fails. If no human and no transfer is available, the agent's last act is a fixed recorded line — "please hang up and dial 911" — and then it stays on the line rather than dropping. Silence followed by a dropped call is the worst outcome available, and it is the default one when an orchestrator crashes. Make the failure direction an explicit choice rather than an accident of which process died.

Write the whole chain down as a sequence with a timing budget, the way you would a latency budget, and then test it by triggering it rather than by reading it. A route nobody has fired is a route that does not exist.

Step 4The transfer, and the three ways it fails.

Normal escalation design favours a warm transfer: the agent summarises, the human arrives briefed, the caller does not repeat themselves. That is correct for a billing dispute and wrong here, and the reason is worth stating precisely — a warm transfer adds a consult leg, a hold, and a dependency on the receiving party answering before the caller is connected to anything.

• It fails slowly. A warm transfer that takes eight seconds to broker is eight seconds of a caller hearing hold treatment during an emergency. Use a blind transfer and push the context out of band — a webhook, a screen pop, an SMS to the on-call phone — so the human gets the summary without the caller waiting for it. Warm transfer is the default for everything else and the exception here.
• It fails on the receiving end. Nobody picks up; the group's phones are in do-not-disturb; the shift changed. The emergency route needs a cascade with a timeout measured in a few rings, and a final fallback that is not another human.
• It fails by losing the caller. A transfer that drops the leg, or that hands over without media, ends the call. Instrument the transfer itself: attempted, connected, dropped — and alert on any drop in this class immediately rather than in a daily report.

Attach whatever location and identity you already hold, and resist the urge to collect more. If the caller is an authenticated account holder, the service address you have on file is more reliable than anything you will extract from a frightened person in ten seconds, and it is already structured. If they are not authenticated, do not run caller authentication first — an identity check in front of an emergency route is a gate on the one call that must not have one.

Step 5Evaluate it asymmetrically, because the costs are asymmetric.

Every other intent in your agent is scored on a balance of precision and recall. This one is not, and treating it like the rest is how a threshold tuned for a clean dashboard silently raises the miss rate.

A false positive costs one unnecessary transfer and a mildly confused human. A false negative costs an unbounded amount and is the only outcome in your whole system that cannot be retried. So fix the miss rate first and accept whatever precision falls out.

• Build a labelled set from real audio, not from generated phrases. A hundred emergency and near-emergency utterances pulled from recordings, labelled by a human, plus two hundred hard negatives — the angry caller, the hypothetical ("what if there was a fire?"), the idiom ("I'm dying to get this sorted"). Generated test phrases over-represent explicit wording and will flatter your detector badly.
• Report recall at a fixed operating point, with the false-positive rate as the consequence. "Recall 0.97 at 4% false positives on hard negatives" is a decision. "F1 of 0.91" is a number that hides which error you chose.
• Include the populations that break detectors. Non-native and accented speech, code-switching, the caller who is whispering, the caller who is crying, the caller who says nothing at all. If your service is multilingual, the trigger set and its evaluation are per-language work, not a translation of an English list.
• Test the route, not just the classifier. Once a week, fire a synthetic emergency call end to end in production and assert that a human answered within your budget. A detector with perfect recall into a broken transfer scores zero, and only an end-to-end probe catches that. This belongs with your other fault-injection drills.
• Review every miss by hand, forever. There will be few enough of them that a human can read all of them, which is not true of any other failure class you have. Each one either extends the trigger set or exposes a route defect.

Step 6What to refuse to build, and what to watch once it is live.

The strongest thing on this page is a boundary. Several features that sound responsible are worse than the gap they claim to fill, and a design review is the cheapest place to kill them.

• Refuse triage. An agent that assesses severity — "is this a 911 situation or can it wait?" — is doing clinical or safety judgement with a language model, on the one call where being wrong is unrecoverable. Recognise and route; do not grade. The same logic applies to anything that reads like dispatch advice.
• Refuse instructions. No CPR guidance, no "stay calm and check whether he is breathing", no first aid. A trained dispatcher does this with protocol cards and a recorded line; your agent has neither, and the liability is not theoretical. Say the one fixed sentence and get out of the way.
• Refuse to be the crisis line. If a caller discloses self-harm risk, the route is a human and, where relevant, the established crisis service — in the US, 988, which carriers are separately required to georoute by geographic area rather than by area code, nationwide wireless providers since January 2025 and the remainder by December 2026. Note what that rule is and is not: it governs how a carrier routes a call to 988, and says nothing about your agent's obligations. Your obligation is to not be in the middle of it.
• Refuse to let the agent hang up on this class of call. Whatever your normal end-of-call logic is, exclude the emergency path from it. A hangup here is indistinguishable from an abandonment and is the thing that will appear in a transcript read aloud to a regulator.
• Refuse to let the recording policy be an afterthought. These calls contain health and safety disclosures from people who had no time to consider a consent notice. Shorten retention for this class, restrict access, and redact aggressively — recording, consent and redaction covers the mechanics; what changes here is that the default should be the tightest setting you have, not the one that helps your eval set.

Operationally, four numbers belong on a dashboard someone actually looks at, and they are all about the route rather than the conversation: emergency-route triggers per thousand calls, time from trigger to a human answering (p50 and p95), transfer failures in this class as an absolute count, and misses found in review. Watch the first for a step change after any prompt or model change, and treat a sustained zero as a broken detector rather than as a quiet month.