How to get your operation ready for the Ley SAC: operational priorities, channels and the Auditor Test

December 28 is just around the corner, and with it the Ley SAC comes fully into force.

It's easy to see it as a race against the clock or a legal headache. It's also a good reason to rethink how you handle customer service day to day.

To bring the law down to earth, Marta López (founder of Agua de Mayo, with more than 20 years running BPO operations) and Marc Caballé (CEO of Hubtype) sat down for a frank conversation about what teams need to change to be ready in time.

The law's two clocks and the risk of a chain reaction

To understand what changes in day-to-day operations, start with the time limits the law sets.

Marta and Marc framed them as "the two clocks":

• The minutes clock (waiting time): 95% of requests to speak to a person must be answered in under three minutes on average. It's measured as an annual average across all calls, with no breakdown by language or service.
• The days clock (resolution): the general deadline to resolve a case is 15 business days, cut to a maximum of two hours to respond and follow up when an incident affects the continuity of an essential service.

These deadlines rarely get tested on a normal day. The pressure comes with demand peaks like Black Friday or unexpected incidents.

As Marta López explained, a single spike sets off a domino effect that puts both deadlines at risk at the same time:

The effect is far worse than just missing those contacts in the moment. The people who didn't get through usually come back through another channel or call again, so your service metrics get completely distorted and you're still not resolving anything. You lose the first clock, the three-minute wait, and on top of that a resolution queue builds up, so both are at risk.

When things break down, email does the most damage. Missed calls frustrate customers right away, but email builds a huge backlog that drags on for days and drives repeat calls from customers who still haven't heard back. And those repeat contacts tend to end up on the phone, the channel that scales worst.

The phone stays: using WhatsApp to take the pressure off voice

When service gets overwhelmed, the instinctive fix is to put more people on the phones. The problem is that voice attention doesn't scale: it's one-to-one, and few budgets can stretch to doubling headcount every time demand spikes.

So the answer isn't to replace phone support but to move volume onto channels that handle it better.

The phone is also required by law, as Marc Caballé pointed out:

Our starting point is that the phone is mandatory and it stays. The question isn't how to replace it, but how to take load off it.

That's where WhatsApp comes in, with a few structural advantages for hitting the legal deadlines and spreading the workload:

• Several conversations: on the phone, an agent is locked into the call from start to finish. On WhatsApp, customers reply at their own pace, so one agent can handle three to five cases at once. In practice, that means up to 80% more productivity with the same team.
• Everything in one thread: a lot of processes make the customer call to explain the problem and then email the paperwork. That’s two open cases to resolve one thing. On WhatsApp, the customer explains the problem and sends a photo of the meter, a voice note or the PDF in the same conversation, and the case is opened, documented and closed in one place.
• Accessibility by default: the law requires service to be accessible to people with hearing impairments. Adapting a traditional phone system usually means expensive development or third-party relay services. Chat covers it from day one.

That led Marta to the obvious question: if a company already has chat on its website or in its app, why bother with WhatsApp?

Marc answered by comparing how people use each one:

• Web chat ties you to the screen: you have to sit in front of the browser and wait. If you switch tabs, take a call or spend five minutes looking for an invoice, the session times out, the conversation drops and you start over with a different agent.
• WhatsApp lives in your pocket: you ask your question, put your phone away and get on with your day. When the agent replies, you get a notification, answer when you can, and the whole thread is still there. It also asks nothing of the customer: no specific page to find, nothing to log into. It's an app most people already use every day.

Marc also warned against shortcuts: some companies still run support from mobile phones on the regular WhatsApp app, or answer questions from a generic Gmail account.

Apart from the GDPR issues, none of it leaves an audit trail. And under the Ley SAC, if an interaction can't be measured, traced and proven with a date and time in front of an inspector, as far as the law is concerned you never served that customer.

From answering to resolving: where AI fits in

The best way to protect the three-minute clock is to close the request without a human ever getting involved.

In other words, a channel like WhatsApp absorbs volume and protects the three-minute clock once it's automated.

That's why Marc and Marta stressed the difference between a bot that answers and one that resolves:

The ones that only answer are your typical FAQ bots," Caballé explained. "When you talk about resolving, the questions to ask are: can the AI read and write to the system of record, or can it only read? If it can write, it can complete the transaction, like changing a service address or checking an order status without leaving the channel.

To tell whether a conversational design works, the metric they proposed is the share of cases that end with no human involvement and no repeat contact, on any channel, over the next seven days. Counting bot deflections tells you none of that: if the customer has to try again, the case wasn't resolved.

When a request can't be automated and goes to the human team, the AI stays in the conversation as the agent's Copilot.

Instead of making the agent read through the whole chat history, the system gives them an instant summary of the problem and suggests replies in context. Marc also highlighted a feature that matters directly for the Ley SAC: two-way real-time translation.

The law requires service in all of Spain's co-official languages (Basque, Catalan and Galician), and staffing dedicated shifts for each one has always been a hiring headache. With real-time translation, an agent replies in Spanish and the customer gets the message in Basque or Galician instantly, and the same goes for foreign languages. The same team meets the legal requirement without overstaffing.

Marta López brought things back down to earth, though: AI can't fix a business built on shaky foundations.

For a start, there's a big training gap. Marta cited a recent McKinsey figure: 60% of companies say they've rolled out AI tools, but only 13% have trained their teams to use them. If you give an agent a Copilot they don't trust or don't know how to use, it never gets off the ground.

And automating blindly only makes problems happen faster:

If you're automating a badly designed workflow or business rule, all you're doing is taking something you were already getting wrong and multiplying it by a thousand. Auditing and maintaining these flows has to be the operations team's job, because what you're judging there is business knowledge, not technology.

Keeping sales out of support, and dropping the tricks

The Ley SAC doesn't just put pressure on response times. It also looks closely at how you treat customers when something goes wrong, and it explicitly targets the frustrating practices we've all run into as customers:

• No selling during a complaint: the law bans using an incident, a breakdown or a claim to push promotions, plan upgrades or cross-sells. You can only offer a product if the customer explicitly asks for it. Customer service phone lines also have to be physically separate from sales lines, so commercial targets stay out of support.
• The end of "asymmetric friction": the law is watching for double standards that depend on what suits the company. Marta put it bluntly:

If signing up is a breeze but cancelling takes unicorn blood, we've got a problem. The law wants it to be just as easy for customers to deal with you, whatever their reason for getting in touch.

• Transparent escalation (no endless loops): the law also goes after the usual tricks, like making customers hear "Sorry, I didn't get that" three times before passing them to a person, or burying the option in impossible menus. Asked when the three-minute clock starts, Marc didn't hedge:

The trigger is the intention to talk to a human. The way the law is written, the clock starts the moment you detect that intention. The key isn't to hide the option or set traps, but to set expectations in the welcome message: explain that the automated assistant is usually the faster way to get an answer, and make it clear they can ask for an agent at any time.

The Auditor Test: if you can't prove it, it didn't happen

To check whether an operation is ready for the deadline, Marc and Marta proposed a simple thought experiment: the Auditor Test.

Imagine an inspector walks in tomorrow, picks a case closed four months ago at random, and asks you to reconstruct the whole journey in under ten minutes. To pass, your system needs to show:

• The unique ID of the inquiry, complaint or incident.
• The entry channel, the reason for contact and the exact timestamp.
• The exact handoff point, showing clearly which part the AI resolved and the second the case went to a human agent (so you don't end up with "orphan tickets" where the trail goes cold).
• The proof of resolution sent to the customer, with date, time and format.

This is another place where text beats voice. On a call, passing the full context from the IVR to the agent takes summaries or complex middleware. On WhatsApp, the written history is recorded and linked to the case from the start.

Finally, Marta added a warning about who holds the data, especially when you work with outsourced providers:

A lot of companies switch from one BPO to another over the years. Under this law, the history is evidence, and all of that information has to be migratable. If you get inspected and can't prove what happened because the data stayed with your previous provider, you're the one who gets fined. Outsourcing the service doesn't outsource the legal liability.

With December 28 on the horizon, adapting customer service can't wait. Complying with the Ley SAC doesn't mean hiring in a panic to pick up the phones. It takes a few deliberate decisions: getting your business processes in order, moving load off the phone to conversational channels like WhatsApp, and making sure your technology resolves cases and leaves a clean trail. The companies that start reviewing their flows now won't just avoid nasty surprises with the law. They'll also end up with a service that's faster and easier for customers to deal with.