Two federal rules govern how your office phone system handles 911. Most business owners have never heard of either one. Both put the duty on the company operating the phone system, not only on the phone company.
That surprises people. Your provider has its own obligations, and it meets them. They do not cover yours.
Key Takeaways
- Kari’s Law requires that anyone can dial 911 directly, with no 9 or other prefix first, and that someone at your business is notified when a 911 call is made (47 CFR 9.16).
- The FCC’s rules implementing RAY BAUM’S Act require a “dispatchable location” — a validated street address plus the suite or floor — to reach the 911 center. Deadlines were January 6, 2021 for fixed desk phones and January 6, 2022 for softphones and remote devices. For fixed phones this must be automated; for softphones and off-premises devices the rule requires automation only where technically feasible, and allows manual or alternative location otherwise (47 CFR 9.16(b)(3)).
- There is no small business exemption. The FCC considered one and declined to adopt it.
- Both rules cover hosted and cloud VoIP. The FCC’s definition of a multi-line telephone system names VoIP explicitly (47 CFR 9.3).
- Your provider’s compliance does not discharge yours. They supply the capability. You have to configure it.
Does this apply to my business?
Almost certainly yes, if you have more than one phone line and you installed or changed your system after February 2020.
The rules cover a “multi-line telephone system,” or MLTS. The FCC defines that term to include “network and premises based systems, such as Centrex and VoIP, as well as PBX, Hybrid, and Key Telephone Systems” (47 CFR 9.3). Cloud phone systems are named in the rule. So are older PBXs.
Most American business phone lines are now VoIP. As of June 30, 2025, VoIP from competitive carriers made up 81.5% of business wireline voice connections, against 11.8% still on traditional switched access lines from incumbent local phone companies, the old Bell operators the FCC calls ILECs (FCC, Voice Telephone Services: Status as of June 30, 2025, released May 2026).
Four out of five business lines run on the technology these rules were written for.
There is no small business exemption. The FCC considered one and turned it down. In its order it declined to adopt a small business exemption on the reasoning that “small businesses should receive notice of 911 calls,” and it rejected proposed cut-offs based on square footage and line count (FCC 19-76, adopted August 1, 2019).
One real limit exists, and it applies to only one of the two rules. Kari’s Law applies to systems manufactured, imported, first sold or leased, or installed after February 16, 2020 (47 U.S.C. § 623). A system installed before that date sits outside that statute.
That date does not carry over to the dispatchable location rules. Those run on their own compliance dates of January 6, 2021 and January 6, 2022, which are set out below. So an older system may still owe a dispatchable location even where the Kari’s Law duties do not reach it. Do not treat a pre-2020 install date as a clean exemption from everything.
Read that limit carefully before relying on it. If you moved to a hosted platform in the last few years, that was an installation. The FCC has not published a bright-line test for when changes to an existing system count as a new installation, so if your setup predates 2020 and has since been modified, confirm your position rather than assume it.
This is the most common mistake in the field. Analyst firm Metrigy surveyed 400 organizations and found the main reason for non-compliance was that companies “interpret compliance requirement dates as applying only to new multi-line telephone systems, believing older systems are exempt” (Metrigy, Key Trends in Enterprise 911, March 24, 2025).
What Kari’s Law requires
Two things: direct dialing, and notification.
Direct dialing. Anyone must be able to reach 911 by dialing those three digits alone. No 9 first, no access code, no prefix of any kind (47 CFR 9.16).
You do not have to remove 9-911. That is worth stating clearly, because plenty of write-ups get it backwards. The FCC’s order says additional dialing patterns are not ruled out, but “if the system is configured with these additional dialing patterns, they must be in addition to the default direct dialing pattern” (FCC 19-76). Keep 9-911 if your staff are used to it. Just make sure bare 911 works too.
Notification. When someone dials 911, your system must tell a central point at the site, or a person or organization somewhere else. The alert has to carry three things: that a 911 call happened, a callback number, and the location the system sent to the 911 center. It has to go out at the same time as the call, must not delay the call, and must land somewhere a person is likely to see or hear it.
Two conditions soften this, and both come straight from the FCC order. The notification duty applies only where the system can be configured to do it “without an improvement to the hardware or software of the system.” And the callback number and location can be left out where providing them is not technically feasible.
So the notification requirement is real, but it is not absolute. Vendors selling notification products sometimes describe it as though it were.
What RAY BAUM’S Act adds
A location precise enough to find someone.
The FCC’s rules implementing Section 506 require a “dispatchable location,” which the FCC defines as “the validated street address of the calling party, plus additional information such as suite, apartment or similar information necessary to adequately identify the location of the calling party” (47 CFR 9.3).
The street address alone is not enough. In a medical office building with forty suites, or a law firm across three floors, the suite and floor are the part that matters.
Two deadlines have already passed:
| Device | Deadline | What is required |
|---|---|---|
| Fixed desk phone on your premises | January 6, 2021 | Automated dispatchable location |
| Softphone or wireless handset on premises | January 6, 2022 | Automated where technically feasible, otherwise manual update or alternative location information |
| Any device used off premises | January 6, 2022 | Automated where feasible, otherwise manual update, alternative, or enhanced location information |
Source: 47 CFR 9.16(b)(3).
A note for anyone checking this against other articles: the MLTS dispatchable location rule sits at 9.16(b)(3). Some write-ups cite 9.16(d) instead. Go to the eCFR text of the section and read the paragraph you are relying on.
Who is responsible, you or your provider?
Both. On different pieces. And you cannot contract your way out of your half.
| Duty | Rule | Who is on the hook |
|---|---|---|
| Configure direct 911 dialing | 47 CFR 9.16(b)(1) | Your business |
| Set up 911 notification | 47 CFR 9.16(b)(2) | Your business |
| Dispatchable location from your phones | 47 CFR 9.16(b)(3) | Your business |
| Sell a system already capable of both | 47 CFR 9.16(a) | Manufacturer or seller |
| Registered Location collection and update tools | 47 CFR 9.11 | Your VoIP provider |
| Tell subscribers about E911 limits, in writing | 47 CFR 9.11 | Your VoIP provider |
The rules attach to whoever is “installing, managing, or operating” the system. The FCC defines an MLTS manager as the party responsible for “determining how lines should be distributed (including the adding or moving of lines), assigning and reassigning telephone numbers, and ongoing network configuration” (47 CFR 9.3).
Read that description again. If the person who moves a phone to a different office is on your staff, that duty is yours.
One honest gap: the FCC’s order does not say how responsibility splits between a business and an outside IT provider or integrator. The rules follow operational control, and they contain no express safe harbor for “our IT company handles it.” Some vendors state otherwise. That is their reading, not the FCC’s text.
If your provider manages your system, put the specific duties in writing with them. Related reading: our checklist for HIPAA-compliant phone systems covers the same principle for patient data, and call recording compliance covers consent.
Remote staff change your exposure
A softphone on a laptop at somebody’s kitchen table is still your MLTS.
The FCC was asked to exempt remote and satellite locations and refused. Notification has to reach a person “regardless of location.” Off-premises devices got their own compliance tier rather than an exemption, and that tier is the only place the rules allow coordinate-based location as a fallback (FCC 19-76).
How much of your workforce this touches depends on your industry. On 2025 annual averages, 53.3% of finance workers teleworked, 44.9% in professional services, 22.4% across all workers, and 17.8% in health care (BLS, CPS Table 62). BLS calculated these as an eleven-month average excluding October, because of the federal government shutdown.
A law firm has roughly two and a half times the remote exposure of a medical practice. But the medical practice usually carries the bigger risk on the other side: getting the suite number right inside a large multi-tenant building.
For non-fixed service, your provider must identify whether a 911 call is being made from somewhere other than the Registered Location, and then either prompt the customer for a new one or update it without the customer doing anything (47 CFR 9.11(b)(4)(ii)(B)(3)). That prompt your remote staff keep dismissing is the mechanism. Dismissed, a home worker’s 911 call can route to the 911 center covering your head office.
If your team works from anywhere, see how mobile business numbers and multi-location setups handle this.
What enforcement actually looks like
Here is the straight answer: as of September 2026 we could find no public FCC enforcement action against a business under Kari’s Law.
To be specific about what that claim rests on: we searched FCC Enforcement Bureau releases and the Commission’s document archive for Notices of Apparent Liability, forfeiture orders and consent decrees citing 47 U.S.C. § 623 or 47 CFR 9.16, from January 2020 to August 2026, and found none. That is a statement about our search, not proof that nothing exists.
There is also a structural reason enforcement is rare against ordinary businesses. Most companies hold no FCC license or authorization, and for a non-licensee the Commission cannot simply impose a forfeiture. It must first send a citation and give the recipient a chance to respond, and only continued conduct of the same kind after that can support a penalty (47 U.S.C. § 503(b)(5)). In practice that means a first contact from the FCC is far more likely to be a citation than a fine.
What does exist is the penalty framework. Violations are enforced through monetary forfeitures, not criminal charges (47 U.S.C. § 623(e)). For a business that is not a common carrier, the current maximums are $25,132 per violation or per day, capped at $188,491 for a single act or failure to act (47 CFR 1.80(b)(10)). Those figures come from the FCC’s January 2025 inflation adjustment and still stand, because the FCC cancelled the 2026 adjustment (Federal Register, FR Doc. 2026-13163, June 30, 2026).
Ignore the “$10,000 plus $500 a day” figure circulating on vendor sites. It traces back to posts that cite no statute or rule, and it does not match the penalty schedule.
The FCC does enforce 911 rules against carriers. In July 2024 it settled an investigation with Charter Communications for $15 million over failures to report network outages affecting 911 (FCC Enforcement Bureau). Those are carrier outage cases, not MLTS cases. They show the agency takes 911 seriously; they are not evidence of business-level enforcement.
There is also a second layer. Federal rules are a floor, not a ceiling. Kari’s Law expressly preserves state authority over emergency communications, and the FCC noted that more than twenty states had passed their own MLTS 911 laws with varying requirements (47 U.S.C. § 623(d); FCC 19-76). Check your state as well as the federal rules.
One claim to discard while you are at it: some sites say a state that passed its own version of Kari’s Law before the federal one is exempt. No such provision exists in the statute.
A practical check you can run this week
- Pick up a desk phone and dial 911 without a prefix. Tell your local dispatch center first that you are testing, or use your provider’s test number. If bare 911 fails, that is a direct dialing problem.
- Find out who gets notified. Name the person or the inbox. If nobody can answer, you have no notification in place.
- Check what address each phone reports. Not the company address. The address for that handset, including suite and floor. Our guide to checking and updating your VoIP 911 address walks through the mechanics.
- Ask your remote staff what address is registered to their softphone. This is where most gaps turn up.
- Find your install date, then check both rules against it. A system installed after February 16, 2020, or migrated since, is in scope for Kari’s Law. An older system may sit outside Kari’s Law and still owe a dispatchable location, because those rules run on their own dates.
- Get the split in writing. Ask your provider which duties they hold under 47 CFR 9.11 and which stay with you under 9.16.
Steps one through four take an afternoon. They are also the ones that matter if somebody in your office ever needs an ambulance.
Frequently asked questions
Does this apply if I only have a few phones?
Yes. The rules cover multi-line telephone systems with no minimum. The FCC specifically declined to exempt small businesses or to set a threshold based on line count or floor space.
We use a cloud phone system. Isn’t that our provider’s job?
Partly. Your provider must give you a way to register and update locations, and must warn you about E911 limits. Configuring direct dialing, setting up notification, and keeping each phone’s address accurate are yours under 47 CFR 9.16.
Our phone system is from 2017. Are we exempt?
Not entirely, and this is where most people go wrong. Kari’s Law applies to systems installed after February 16, 2020, so a genuinely untouched 2017 system sits outside that statute. The dispatchable location rules run on their own dates and are not limited by your install date. And if you have migrated to a hosted platform since, that counts as an installation. The FCC has not set a clear test for smaller changes, so confirm your position rather than assume it.
Do we have to stop using 9 for an outside line?
No. You must make bare 911 work. You may keep 9-911 alongside it.
What counts as a dispatchable location?
A validated street address plus whatever identifies the caller within the building, such as suite, floor, or apartment.
Where to start
The rules are less complicated than they sound. Direct dialing, a notification that reaches a real person, and an address precise enough to find someone in your building.
The gap in most offices is not the technology. It is that nobody ever checked, because everyone assumed the phone company had it covered.
Run the six checks above. If any of them come back wrong, fix the address records first. That is the one that decides whether help arrives at the right door.
If you want a second pair of eyes on how your system is configured, talk to us about your phone setup.
This article explains federal rules in general terms. It is not legal advice. Requirements vary by state, and the FCC has not addressed every situation described here.
