AI makes outreach cheap. The rules that govern outreach did not get cheaper. This is a practical overview, not legal advice — check with your counsel for each country you sell into.
- United States — CAN-SPAM: the FTC is clear that the law makes no exception for business-to-business email. Requirements include accurate header information, non-deceptive subject lines, identifying the message as an ad, a valid physical postal address, and an opt-out honoured within 10 business days. Each violating email can draw penalties of up to $53,088 (the FTC's current figure).
- United Kingdom — PECR: you can email corporate bodies without prior consent, but sole traders and some partnerships are treated as individuals and need consent (or a previous customer relationship). You must not disguise your identity and must offer an opt-out. GDPR also applies to the personal data you use.
- Gmail's sender rules: since February 2024, senders of more than 5,000 messages a day to Gmail accounts must authenticate with SPF, DKIM and DMARC, support one-click unsubscribe for marketing messages, and keep spam rates below 0.3% (Google recommends below 0.1%). Agents that blast volume can damage your domain's deliverability for everyone in the company.
Voice
- US — TCPA and AI voices: in its February 2024 Declaratory Ruling, the FCC confirmed that the TCPA's restrictions on "artificial or prerecorded voice" cover AI technologies that generate human voices, so such calls require the prior express consent of the called party absent an emergency purpose or exemption.
Disclosure
- EU AI Act, Article 50: from 2 August 2026, AI systems that interact with people must be designed so people are informed they are interacting with an AI system, unless that is obvious from the context.
- Research shows why this matters commercially: in a field experiment, disclosing a sales chatbot before the conversation cut purchase rates by more than 79.7% compared with undisclosed bots. You cannot avoid disclosure where it is required — design for it.
Platforms
- LinkedIn prohibits bots or unauthorized automated methods to send messages or drive inauthentic engagement, and accounts can be restricted or shut down.
Brand
Rules are the floor. Brand damage starts earlier: irrelevant messages at scale, false familiarity, or marketing that alienates buyers — as when AI SDR startup Artisan's "Stop Hiring Humans" billboards drew a wave of negative reaction, which its CEO later said was mostly for attention.