For AEP 2027, marketing opens October 1 and enrollment runs October 15 to December 7. CMS dropped the 48-hour Scope of Appointment wait, lets agents collect SOAs at educational events, requires the TPMO disclaimer before any benefits talk, and cut call recording retention to six years. Cold calls, robocalls, texts and voicemails to non-requesters remain banned.
Takeaways
The SOA wait is gone
Record the SOA before the appointment and you can meet right after. It stays valid for 12 months.
Disclaimer timing changed
The TPMO disclaimer must be said before any benefits discussion, not within the first minute.
Recordings
6 years, not 10. Audio for years one to three. Audio or a full transcript for years four to six.
CMS rules and the TCPA both apply
CMS limits who you may contact. The TCPA governs how you call and text them.
The 2026-2027 calendar
Three dates drive the season.
CY2027 marketing begins
Plans and their agents may start marketing 2027 plans. The CY2027 marketing policies apply to all 2027 marketing from this date.
Annual Enrollment Period (AEP)
Beneficiaries can join, switch or drop Medicare Advantage and Part D plans, or move between Original Medicare and Medicare Advantage. Coverage starts Jan 1.
Medicare Advantage Open Enrollment Period (OEP)
Medicare Advantage enrollees only. One switch to another MA plan, or a move to Original Medicare plus Part D. Effective the first of the next month.
For definitions, see the glossary entries for the Annual Enrollment Period and the Open Enrollment Period.
What changed for CY2027
CMS finalized the CY2027 Medicare Advantage and Part D rule on April 6, 2026. It took effect June 1, 2026, and its marketing policies apply to all 2027 marketing starting October 1, 2026. Here are the changes agencies and FMOs (field marketing organizations, which contract and support agents) need to know.
| Feature | Through 2026 | CY2027 marketing |
|---|---|---|
| SOA timing | 48-hour wait before the appointment, with limited exceptions | Appointment can happen any time after the SOA is completed |
| SOA at events | Not at educational events | May be collected at educational events |
| TPMO disclaimer timing | Within the first minute of a sales call | Before any discussion of benefits |
| Call recording retention | 10 years | 6 years: audio for years 1-3, audio or full transcript for years 4-6 |
Scope of Appointment
A Scope of Appointment (SOA) is the beneficiary's record of which products they agreed to discuss. The current rule says only that the SOA must be agreed upon and recorded before the appointment. It must be in writing for in-person appointments. CMS's September 2026 guidance says appointments may happen "any time after a Scope of Appointment (SOA) form is completed."
What didn't change:
- The SOA is valid for 12 months from the beneficiary's signature date or their first request for information.
- You can't market products beyond the agreed scope.
- Other health product lines need a separate SOA.
- Non-health products, such as annuities, can't be marketed in the appointment.
The TPMO disclaimer
A TPMO (third-party marketing organization) is any agent, broker, agency or FMO that sells for a plan without being the plan. TPMOs must say the disclaimer on sales calls before any benefits are discussed. The CY2027 rule removed the "within the first minute" requirement and the reference to SHIPs (State Health Insurance Assistance Programs).
If you don't represent every plan in the area, the wording is:
"We do not offer every plan available in your area. Currently we represent [#] organizations which offer [#] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options."
If you represent every plan in the area:
"Currently we represent [#] organizations which offer [#] products in your area. You can always contact Medicare.gov or 1-800-MEDICARE for help with plan choices."
Call recording
All marketing and sales calls, including the audio of web-based calls, must be "recorded and retained in their entirety for a minimum period of 6 years." Years one to three must be audio. Years four to six may be audio or a complete transcript. The old period was 10 years.
Who you may contact
The contact rules didn't loosen. Plans and the agents who sell for them may not use:
- Telephone solicitation, meaning cold calling
- Robocalls
- Text messages or voicemails to people who didn't ask
- Direct messages on social media
- Door-to-door visits, or approaching people in parking lots and other common areas
Email is allowed if it includes an opt-out.
The rule draws a clear line for requested contact: "Returning phone calls or calling an individual who has completed a business reply card requesting contact is not considered unsolicited." A beneficiary who filled out a form, called in, or asked to be contacted can be called back.
Sharing leads between TPMOs
Since October 1, 2024, personal beneficiary data collected by one TPMO may be shared with another TPMO only with the beneficiary's prior express written consent. The disclosure must be clear and conspicuous and name each recipient. The beneficiary must be able to approve or decline each one separately. If you buy or sell leads, check that your forms meet this.
Run requested callbacks without cutting corners
Upload your AEP request list and see who is due a callback. Free with a HIPAA BAA.
The TCPA sits on top
CMS rules say who you may contact. The Telephone Consumer Protection Act (TCPA) governs how. For a full walkthrough, see our TCPA compliance guide. The points that matter most for AEP:
- AI and prerecorded voices need consent. The FCC ruled in 2024 that AI-generated voices count as "artificial" voices under the TCPA.
- Sales calls need written consent. A telemarketing call made with an autodialer or an artificial or prerecorded voice needs the person's prior express written consent. That means a signed written agreement that authorizes those calls to a specific number. Your request form should capture it.
- Calling hours. 8 a.m. to 9 p.m. in the recipient's local time.
- State rules can be stricter. Florida bars commercial solicitation calls after 8 p.m. and limits calls to three in 24 hours on the same subject. Oklahoma has similar limits.
- Opt-outs. Honor revocation by any reasonable method, within 10 business days at most. The FCC voted on September 30, 2026 to revise the revocation rules. The changes take effect 30 days after Federal Register publication, which had not happened as of October 1, 2026. Recheck before relying on any change.
- Damages. $500 per violation, up to $1,500 if willful or knowing.
A compliant AEP call flow
Here's the order a requested callback should follow. Use it as a script outline and an audit checklist.
- 1
Confirm the request
Only call people who asked: a callback request, a reply card, a web form, or an inbound call you are returning. Check that the form captured written consent for the way you will call. Respect calling hours in their time zone.
- 2
Start the recording
Record the full call from the start. Confirm your storage keeps audio for three years and audio or a full transcript through year six.
- 3
Identify yourself and the purpose
Say who you are, who you work with, and why you are calling back. If an AI places the call, say so plainly. Some state laws, such as the Utah AI law, require AI disclosure in certain settings.
- 4
Capture the Scope of Appointment
Ask which products they want to discuss: MA, Part D, Medigap, dental, and so on. Record their answer. Anything outside that scope is off limits on this call.
- 5
Say the TPMO disclaimer
Read the correct version, partial or full representation, with your current numbers. Do this before any mention of benefits, premiums or plans.
- 6
Hold the appointment
With the SOA recorded, the licensed agent can meet right away. A warm transfer to the agent works, as does a booked time.
- 7
Honor opt-outs and log the outcome
If they ask not to be called, stop and log it everywhere. Record the outcome, the SOA, and the consent source with the call.
Where Rivvi fits
AEP is a volume problem with strict rules. Requests pile up in October, and every callback has to follow the same order.
Rivvi is a HIPAA-compliant AI workspace with calls and texts on the Team plan. Rivvi has run AEP outreach for community pharmacies. Here's what it handles for agencies:
- Requested callbacks at volume. Upload your request list and Rivvi works through it within calling hours.
- The SOA comes first. Rivvi captures the Scope of Appointment up front, before any plan discussion.
- A licensed agent takes the plan talk. Rivvi warm-transfers the beneficiary live to an available agent, or creates a task with the details for a callback. If a connected CRM such as HubSpot, Salesforce or Zoho is set up, outcomes are pushed there.
- Opt-out is honored on every path. A "stop calling me" on a call or a STOP on a text ends contact.
- Spanish and 30 more languages.
What Rivvi doesn't do: decide who you're allowed to call. Your agency still owns its compliance program, including call recording and retention. Confirm your setup meets the six-year rule.
See how it works on the AEP appointment setting page, or the full agency picture on Rivvi for brokers.
Work your AEP requests today
You and two colleagues, with a HIPAA BAA. No card. No clock. Calls and texts are on Team.
Sources
- Medicare.gov, Joining a plan (AEP and OEP dates)
- 42 CFR 422.2263, General marketing requirements
- Federal Register, CY2027 MA and Part D final rule, Apr 6, 2026
- 42 CFR 422.2264, Beneficiary contact
- 42 CFR 422.2267, Required materials and content
- 42 CFR 422.2274, Agent, broker and TPMO requirements
- CMS, Changes to the Medicare Communications and Marketing Guidelines
- 47 CFR 64.1200, TCPA rules
- 47 U.S.C. 227, TCPA statute
- FCC Declaratory Ruling FCC 24-17 on AI voices
- Utah SB 226 (2025), AI disclosure amendments
- Florida Statutes 501.616
- Benesch, Oklahoma Telephone Solicitation Act
- MS Law Group, FCC finalizes new TCPA revocation rules