TL;DR
Most IT and facilities teams treat Kari’s Law and RAY BAUM’s Act compliance as a project that closed in 2020 — direct 911 dialing configured, front-desk notification tested, box checked. But the federal deadline for automated dispatchable location on non-fixed and off-premises devices didn’t land until January 6, 2022, and every remote hire, desk move, hot-desk setup, or softphone extension added since then is a device class that may never have been re-tested. The real exposure isn’t the original rollout — it’s the hybrid workforce built on top of it without anyone updating the 911 location records.
The Status Quo Trap: “We already did Kari’s Law”
Ask most telecom or IT managers when their organization last reviewed 911 compliance on its phone system, and the answer is usually a date, not a process: “we did that in 2020 when the law came out.” That’s the trap. Kari’s Law compliance was treated as a one-time configuration project — direct 911 dialing enabled, a notification routed to the front desk or security office — rather than an ongoing obligation that has to be re-verified every time the calling environment changes.
Two things make that assumption dangerous today. First, Kari’s Law and RAY BAUM’s Act are two different, stacked requirements with two different compliance clocks. Kari’s Law covers direct 911 dialing and on-site notification, with a compliance date of February 16, 2020 for systems manufactured, sold, leased, or installed after that date. RAY BAUM’s Act layers a separate “dispatchable location” requirement on top of it — and the FCC gave fixed devices until January 6, 2021 to comply automatically, while non-fixed and off-premises devices (softphones, hot-desk extensions, remote workers) got until January 6, 2022, with a manual-update fallback where automation wasn’t technically feasible.
Second, almost every organization’s device mix has changed substantially since that second deadline passed. Hybrid work turned “on-premises fixed phone” into the minority device class. Remote softphone extensions, mobile app dial-in, hot-desking, and cloud PBX migrations have all been layered on since 2022 — and none of those changes trigger an automatic re-check of dispatchable location. A UC platform migration gets tested for call quality and uptime. It rarely gets tested for whether 911 knows which floor and suite the call is coming from.
Treating the 2020 rollout as “done” instead of as a living compliance surface is how organizations end up out of compliance without a single person deciding to be.
The Tele Data Guru Framework: The MLTS 911 Exposure Matrix
Before assuming your organization is covered, score every device class on your multi-line telephone system (MLTS) against its actual compliance deadline and its realistic hybrid-work blind spot:
| Device Class | Direct 911 Dial Required | On-Site Notification Required | Dispatchable Location Deadline | Typical Hybrid-Work Blind Spot |
|---|---|---|---|---|
| On-premises fixed desk phone, untouched since 2020 | Yes | Yes | Met automatically — January 6, 2021 | Low, if the phone and location truly haven’t moved |
| On-premises non-fixed device (hot-desk phone, softphone, moved extension) | Yes | Yes | January 6, 2022 | Moderate-high — desk moves and hot-desking rarely trigger a location update |
| Off-premises remote softphone or mobile app extension | Yes | Yes, where feasible | January 6, 2022, with manual-update fallback allowed | Highest — most remote hires since 2022 were never added to a 911 location record |
| Cloud PBX / UC platform cutover (migration from legacy MLTS) | Yes | Yes | Immediate upon cutover — legacy exemption is lost | High — migrations get tested for dial tone, rarely for 911 location per extension |
Most organizations can account for the first row. Almost none can produce a current, tested answer for the other three — and those are exactly the device classes that have multiplied since hybrid work became permanent.
The Kari’s Law Exposure Formula
Federal Forfeiture Exposure = Non-Compliant Device Classes × Per-Violation Forfeiture (up to $25,132/day), capped at $251,325 per single act of noncompliance
Under the FCC’s catch-all forfeiture schedule, the per-violation ceiling for most organizations running an MLTS — hotels, offices, schools, hospitals — runs up to $25,132 per violation or per day of a continuing violation, with a cap of $251,325 for any single act of noncompliance; common carriers face steeper ceilings up to $1,000,000. In practice, enforcement has been far more modest — the FCC collectively fined businesses over $100,000 across all Kari’s Law and RAY BAUM’s Act violations in 2021 — but that gap between theoretical exposure and historical enforcement is exactly why most organizations underestimate the risk. The number that should actually worry a CFO isn’t the fine; it’s the civil liability that follows a 911 call that failed to connect or sent first responders to the wrong floor, which carries no statutory cap at all. With over 240 million 911 calls placed annually in the U.S., the odds that an untested device class gets used in a real emergency aren’t theoretical.
Commercial Realities & Vendor Pitfalls
- “Kari’s Law compliant” is a platform claim, not a deployment guarantee. UC and cloud PBX vendors market direct-dial and notification as built-in features of the platform. Dispatchable location per extension, per remote worker, and per desk move is a configuration responsibility that falls on whoever manages the deployment — not something the platform enforces on its own.
- The legacy exemption disappears the moment you upgrade. MLTS manufactured, sold, or installed on or before February 16, 2020 were exempt from the forward-looking rules — but any “significant upgrade” after that date removes the exemption, and most cloud PBX or UC platform migrations qualify as exactly that kind of upgrade.
- Compliant at launch is not compliant at scale. The 2020-2022 compliance project tested the device mix that existed at the time. Every remote hire, hot-desk move, or new branch office added since then is a new device class that was never run through that same test.
- The real cost rarely shows up as a fine. Historical FCC enforcement of Kari’s Law and RAY BAUM’s Act has been limited in dollar terms relative to the statutory ceiling. The exposure that actually matters is the civil liability and reputational damage that follows a failed or misdirected 911 call — a risk no forfeiture cap limits.
Implementation Checklist
- Inventory every device and softphone extension on your MLTS by class: on-premises fixed, on-premises non-fixed, off-premises remote, and mobile app extensions.
- Confirm the dispatchable location on file for each class reflects the current address, floor, and room or suite — not the organization’s main office address applied as a default.
- Test direct 911 dialing and on-site notification on at least one device per class, with particular attention to remote and hot-desk extensions added since your last audit.
- Flag any device class added after a UC platform migration or cloud PBX cutover — these lose any legacy exemption and must meet current requirements immediately.
- Assign ongoing ownership of 911 location updates to telecom or IT administration, triggered by every remote hire, office move, or platform change — not an annual calendar reminder.
- Document test results and location records so the organization has an audit trail ready if a PSAP or FCC complaint review ever asks for one.