On 6 August 2026, after a viral post forced the issue, New Orleans officials confirmed what the city had never announced: an automated AI voice agent has answered a category of incoming 911 calls since 2023, and callers were never told.

Three months earlier, in late May 2026, the Seattle Fire Department confirmed that since December 2023 it had run an AI system from the Danish company Corti across its 911 medical calls — listening to live audio and prompting dispatchers, via on-screen alerts, to route certain callers to a nurse-staffed call centre in Texas instead of dispatching an ambulance. No disclosure to callers, no public review, no proceeding under the city’s own surveillance ordinance.

The story underneath: two cities deployed consequential AI on a population that structurally cannot consent, cannot opt out and cannot go elsewhere — and in both cases the deliberative and procurement instruments that would have caught it already existed and went unused. But first the facts have to be right, because several outlets got them badly wrong.

What Actually Happened in New Orleans

The headlines said New Orleans had replaced its 911 operators with AI. That framing is wrong, and the degree of wrongness matters. The system is Carbyne’s AI Emergency Call Triage, operated by the Orleans Parish Communication District (OPCD). Per OPCD, it engages only when all of the following hold: a vehicle crash has already been reported; the caller is within roughly 200 metres of it; and no human call-taker is free. The agent says the caller has reached New Orleans 911 and asks a single question — whether they are calling about that accident. Any answer other than “yes” returns the caller to the queue for a human. OPCD’s figure is that for every 20 calls generated by one crash, the AI handles 15 to 18. That is not automated emergency triage; it is duplicate-call suppression on one incident type under load.

Axios New Orleans published a corrective piece on 13 August 2026 — “No, AI isn’t answering all of New Orleans’ 911 calls” — precisely because the accurate description had been overwritten by the sensational one. A Northeastern University analysis reached the same conclusion, quoting OPCD that the tool covers “a very narrow category of incoming 911 calls.”

Two points of care. The timeline is muddled in the public record: OPCD’s Carbyne relationship and its statements about the capability trace to 2023, while some August 2026 coverage described the tool as newly rolled out “last week.” And a smaller footprint is not a governed one — the narrow version is still an AI system interposed between a person dialling 911 and a human being for three years without public notice. The gap between the two versions is itself part of the failure: an entity that does not disclose a deployment forfeits control of the narrative when it surfaces, and the city spent a week correcting a story a two-paragraph notice in 2023 would have prevented.

Seattle: More Consequential, Less Covered

The Seattle facts are the more serious set and received a fraction of the attention. Corti’s model listened to all 911 medical calls routed through the Seattle Fire Department, analysing caller speech in real time and prompting dispatchers when it judged a call suitable for the Texas-staffed nurse navigation line rather than an ambulance. SFD’s position is that “the dispatcher still has the ultimate authority.” The programme costs roughly $260,000 per year.

The department did not measure whether it works. Reporting indicates SFD lacks outcome metrics showing the AI improves patient results. A 2024 Corti press release quoted its medical director saying nurse-line routing had risen 50 percent since deployment; a spokesperson later corrected that to 32 percent. Note what both numbers are: diversion volume, not diversion accuracy. A system that steers more callers away from ambulances is not one that steers away the right callers.

Seattle has a surveillance ordinance and did not use it. The 2017 Surveillance Ordinance (SMC Ch. 14.18) requires Council approval before a department acquires or uses technology meeting its definition of surveillance technology. The Fire Department self-determined that Corti did not qualify, reportedly because the system does not store audio or identify callers — a determination never externally tested. University of Washington law professor Ryan Calo put the counterpoint plainly: a person erroneously routed out of the 911 environment has a right to know how it happened.

Do not attach the wrong death to this system. Coverage frequently references Pamela Hogan, 71, who called 911 five times in April 2022, was routed to the nurse line, waited more than ten hours and was later found dead; her estate’s wrongful-death action settled with the city’s ambulance contractor after Seattle was dismissed. Hogan’s death predates Corti’s live prompting by more than eighteen months, and the nurse line existed independently of the AI. It shows nurse-line diversion carries real downside risk — why a system built to increase diversion warranted public review — not that AI caused a death.

The practice is spreading: Kitsap 911 launched an AI-answered non-emergency line in May 2026 using Aurelian’s “Ava,” and Snohomish County 911, running Ava since 2024, is piloting “Cora,” an AI co-pilot alongside dispatchers on live 911 emergency calls.

Every US privacy regime resting on choice assumes the person can attend to a disclosure, has a meaningful alternative, and can decline without forfeiting what they came for. A 911 call satisfies none of the three. The caller is in crisis, there is one number, and declining is a choice between emergency assistance and none. Consent obtained in that posture would be worthless, and notice delivered in it — “this call may be handled by an automated system, press 1 to continue” — is affirmatively harmful, spending seconds a caller reporting a cardiac arrest does not have.

That is not an argument that disclosure is pointless. It is an argument about where the obligation lives. If notice-and-choice cannot operate at the moment of the call, legitimacy shifts entirely upstream — to procurement, published policy, council deliberation, impact assessment and the pre-deployment public record. The caller’s consent is replaced by the community’s prior, collective, informed decision. That substitution is the whole justification for the deployment, and it is exactly what did not happen: New Orleans never publicly noticed the capability, and Seattle routed around the one ordinance designed to force the conversation.

The pattern is familiar from municipal surveillance procurement: the Ring–Flock Safety partnership collapsed under public backlash not because the technology was novel but because the decision was made where the public could not see it until it was done. The same defect, applied to a system influencing whether an ambulance is dispatched, is a larger problem.

Wiretap Law: An Open Question, Not a Settled Violation

Washington is a two-party (all-party) consent jurisdiction: RCW 9.73.030 makes it unlawful to intercept or record a private communication without the consent of all participants. If the analysis stopped there, Seattle’s programme would be plainly unlawful. It does not. RCW 9.73.090 exempts “police, fire, emergency medical service, emergency communication center, and poison center personnel” from RCW 9.73.030 through 9.73.080 in specified circumstances, including “[r]ecording incoming telephone calls to police and fire stations, licensed emergency medical service providers, emergency communication centers, and poison centers.” PSAP recording of 911 calls is squarely lawful in Washington, and comparable carve-outs appear in the two-party regimes of California, Illinois, Pennsylvania, Florida and Massachusetts. The unresolved question is narrower: does an exemption permitting an emergency communications centre to record incoming calls also permit routing that live audio to a commercial third party’s model for inference? Neither answer is frivolous. For coverage: the exemption is not limited by purpose or downstream processing, and the vendor acts as the agency’s contracted processor. Against: its evident purpose is preserving an official record of the emergency, which does not obviously stretch to real-time transmission of caller speech into a vendor’s inference pipeline — and Washington courts have generally construed Chapter 9.73 exemptions narrowly against the recorder.

No court has decided this. Nothing in the public record establishes that Seattle violated RCW 9.73, and this article does not assert that it did. What the record establishes is that an all-party consent state’s PSAP made a novel processing decision resting on a decades-old exemption without an Attorney General opinion, an ordinance determination or a published legal analysis. That is a documented governance gap; whether it is also a violation is genuinely open. Compliance teams in all-party states should treat “our recording exemption covers it” as a hypothesis requiring counsel’s written sign-off — noting that when the FTC pursued Cox Media Group over its “Active Listening” product, liability attached to claims about audio processing independent of whether it worked.

Health Data Outside the Regime Everyone Assumes Covers It

A 911 medical call is health information by any ordinary meaning: symptoms, medications, mental health crises, overdoses, obstetric emergencies, injuries with a domestic-violence context. It is very likely not protected health information under HIPAA. HIPAA obligations attach to covered entities — health plans, clearinghouses, and providers transmitting health information electronically in connection with a covered transaction (45 CFR 160.103). A PSAP is generally not a covered entity: it does not bill for healthcare services and does not conduct HIPAA standard transactions. Where a fire department also bills as an EMS provider, portions may be covered under 45 CFR 164.105’s hybrid-entity rules — but call-taking typically sits outside.

The consequence follows mechanically: if the PSAP is not a covered entity, the AI vendor is not a business associate, no agreement under 45 CFR 164.504(e) is required, and no Security Rule safeguard applies as a matter of federal law. The Texas nurse centre may itself be a covered provider and the audio it receives PHI in its hands — but that does not regulate the upstream leg where the inference happened.

Washington’s state law does not fill the gap, for a counterintuitive reason. The My Health My Data Act (Chapter 19.373 RCW) is the country’s most aggressive consumer health privacy statute and carries a private right of action through the Consumer Protection Act — but RCW 19.373.010’s definition of “regulated entity” expressly excludes “government agencies, tribal nations, or contracted service providers when processing consumer health data on behalf of the government agency.” A city fire department is a government agency; a vendor processing its 911 audio is a contracted service provider. MHMD, on its face, does not reach this deployment — the sharpest structural limit of a statute covered in our review of Washington’s privacy and cybersecurity landscape.

So the most sensitive category of health data in civic life — spoken under duress, unredactable, tied to a verified location — is processed under no federal health privacy statute, no state consumer health statute and no sector-specific vendor rule. No federal law requires a 911 AI vendor to meet particular retention, security, deletion or disclosure obligations beyond what already binds the PSAP. The floor is the contract; if the contract is silent, there is no floor.

Algorithmic Triage Is a Safety-Critical Decision

The Seattle system’s function is to increase the rate at which callers are diverted from ambulance dispatch. Its primary failure mode is the false negative: a caller who needed an ambulance and did not get one. Those failures are latent — no error message, only an outcome days later rarely traced back to the routing decision. Governing them requires four things, none publicly evidenced in either deployment.

Published validation, including subgroup performance. Speech models degrade measurably across accent, dialect, non-native fluency, age and — critically — acute emotional distress, which alters prosody, pace and coherence in exactly the ways that confound speech recognition and downstream classification. Northeastern’s analysis raised the concrete versions: regional idiom (“the sugar” for diabetes), coded speech such as the caller who orders a pizza because an abuser is in the room, and a model that parses words rather than fear. Subgroup performance here is not a fairness nicety; it is the core safety metric, and no validation study appears to have been published for either deployment.

Adverse-event reporting. Aviation, medical devices and pharmaceuticals all have mandatory pathways for reporting safety-system failures. There is no equivalent for algorithmic emergency triage: no agency collects these events, no vendor must disclose them, no PSAP must look for them. If Seattle’s system mis-routed a caller last year, no mechanism exists by which anyone would systematically know.

A meaningful human-in-the-loop definition. “The dispatcher retains ultimate authority” is a claim requiring evidence. Automation bias is well documented, and a dispatcher under load receiving a confident prompt from a system bought precisely to increase diversion is not in a neutral decision posture. The auditable version of the claim is a measured override rate.

Civil rights obligations that already attach. Both cities are public entities receiving federal financial assistance. Title VI (42 U.S.C. § 2000d) and its implementing regulations prohibit intentional discrimination and, by regulation, unjustified disparate impact on the basis of national origin — which DOJ’s LEP guidance and Executive Order 13166 apply to language access. Title II of the ADA (42 U.S.C. § 12132) with 28 CFR 35.160 imposes effective-communication duties, and 28 CFR 35.162 addresses telephone emergency services specifically, requiring direct access for individuals using TTY and comparable technologies. A speech-driven AI front door raises unavoidable questions about callers with speech disabilities or assistive devices — obligations that attached the day the systems went live.

The Instruments That Already Existed

Neither deployment required new law to be caught. Seattle’s SMC Ch. 14.18 is one of roughly two dozen CCOPS-style surveillance ordinances nationally, built to force exactly this conversation before deployment. Its defect is that the initial scope determination is made by the deploying department itself — self-certification with no independent review trigger and no penalty for getting it wrong. Sub-state jurisdictions are increasingly willing to legislate here directly: Erie County’s Biometrics Transparency and Privacy Act shows a county imposing binding technology rules ahead of its state.

NIST AI RMF 100-1 is free and already the default reference in US public-sector AI procurement. Its GOVERN function alone — documented roles, risk tolerance, third-party risk processes, inventory — would have produced the internal record neither city can, and MEASURE requires precisely the missing validation evidence. Algorithmic impact assessments, already mandated for state agency AI in a growing number of jurisdictions, cover the same ground. Either, adopted as a contractual baseline, would have made both stories unremarkable, and a documented ordinance scope determination reviewed outside the deploying department would have closed the last gap.

Public records law is a live and underappreciated exposure. Washington’s Public Records Act (Chapter 42.56 RCW) and Louisiana’s Public Records Law (La. R.S. 44:1 et seq.) reach records made or maintained by public agencies in the conduct of public business. When a vendor holds call audio, transcripts, prompt logs or inference outputs on the agency’s behalf, the obligation does not evaporate because the bytes sit on someone else’s infrastructure. Agencies need contractual assurance that vendor-held records can be produced, retained on schedule and placed under litigation hold — and “our system does not store audio” is a claim a contract will be read against.

A Procurement Checklist for AI Touching Emergency Services

These belong in the solicitation, not a post-incident remediation plan:

  • Public notice before deployment — a published description of what the system does, when it engages and what it cannot do, issued before go-live. This is the substitute for caller consent, and the only one available.
  • Caller-facing disclosure built for crisis conditions — not an IVR consent prompt, but a published policy and, where the AI speaks, unambiguous self-identification as an automated system in its first utterance.
  • Explicit retention and deletion terms covering audio, transcripts, embeddings, inference logs and derived analytics, with maximum retention periods and certified deletion.
  • A flat prohibition on training — call audio and derivatives may not train, fine-tune or improve any model beyond the contracted deployment, including de-identified use. It is the highest-value clause in the agreement.
  • Validation evidence as a condition of award, disaggregated by accent, language, dialect, age and distress presentation, with disclosed methodology and a refresh cadence.
  • A measurable human-in-the-loop definition naming which decisions require human confirmation, with vendor-reported override rates.
  • Adverse-event logging and reporting with a defined event taxonomy and a vendor duty to report within a fixed window.
  • Audit rights — third-party assessment, access to logs and configuration, the right to test with agency scenarios — plus subcontractor and data-location transparency, with notice before change.
  • Sunset and mandatory review — a fixed term expiring absent affirmative renewal, plus a scheduled public review presenting outcome data. A system nobody must re-justify is one nobody will re-examine.

Conclusion

Anyone who told you New Orleans replaced its dispatchers was wrong. Seattle’s deployment was materially more consequential — a live model shaping whether an ambulance was sent — and received far less scrutiny, close to the inverse of what the risk warranted.

The corrected facts do not dissolve the governance problem; they sharpen it. In both cities a public entity decided about a system mediating access to emergency services on behalf of a population that could not be asked, and skipped the deliberation that the impossibility of asking makes mandatory. Seattle had an ordinance built for the purpose and self-certified around it; New Orleans had three years in which a paragraph of public notice would have made August’s coverage a non-event.

PSAP understaffing is real, and AI will keep arriving on emergency lines because the alternative — the hold queue — has its own body count. That is an argument for deployment, not against governance. But when the people affected cannot consent, cannot opt out and cannot go elsewhere, the legitimacy of the deployment rests entirely on a public decision made before it goes live. An agency that skips that step has not saved itself a process; it has postponed it to the moment it has least control over how it goes.

Sources: Axios New Orleans — No, AI isn’t answering all of New Orleans’ 911 calls, Northeastern Global News — AI is now answering some 911 calls. Is that a good idea?, GovTech — Questions Arise as AI Analyzes, Redirects Seattle 911 Calls, GeekWire — Seattle using AI to route certain 911 calls without caller knowledge or public review, EMS1 — Seattle Fire Department used AI to analyze 911 medical calls without public disclosure, EMS1 — AMR settles wrongful death lawsuit over Seattle woman’s 10-hour ambulance wait, Kitsap 911 — Dedicated non-emergency line with Aurelian’s AI platform, FOX 13 Seattle — Snohomish County 911 among the first in the nation to use AI to field calls, RCW 9.73.090 — Certain emergency response personnel exempted, Chapter 19.373 RCW — Washington My Health My Data Act, City of Seattle — The Surveillance Ordinance

This article is provided for informational purposes only and does not constitute legal advice.