AI sales prospecting tools can research accounts, draft emails and even place calls, but the rules for email and phone outreach still apply to every message they produce. Before we connect an AI prospecting tool to a CRM, we set four guardrails: commercial email rules, inbox provider limits, consent for AI voice calls, and one opt-out record that every tool reads.
What changes when AI writes and sends prospecting messages?
Volume changes first. A rep might send a few dozen careful emails a day. An AI tool connected to a contact list can send thousands, in more variations, from more mailboxes. Every compliance gap a team had before now repeats at that scale.
Accountability does not move to the tool. The FTC's CAN-SPAM compliance guide says a company stays responsible for email sent on its behalf, and that both the company being promoted and the company sending the message can be held liable. Buying a tool or hiring an agency does not hand off that duty.
Our advice to buyers is to treat an AI prospecting tool like a new sales hire with a very fast keyboard. It needs written rules, limited access and a manager who checks its work.
Which email rules apply to AI-written prospecting emails?
In the United States, CAN-SPAM covers commercial email, and the FTC is direct about B2B outreach: "The law makes no exception for business-to-business email." Under the FTC guide, each commercial message must:
- Use accurate header information that identifies who sent it.
- Use a subject line that matches the content, with no deceptive wording.
- Identify the message as an ad.
- Include a valid physical postal address.
- Explain clearly how to opt out of future email.
Two timing rules matter most for automation. Opt-out requests must be honored within 10 business days, and the opt-out method must keep working for at least 30 days after the message is sent. The FTC guide lists penalties of up to $53,088 for each email that violates the law.
AI drafting adds one more risk. A model asked to raise reply rates may write a subject line like "Re: our call" when no call happened. That is the kind of deceptive subject line the law prohibits. We set prompt rules and review samples before any sequence goes live.
How do Gmail sender rules limit AI outreach?
Even a lawful email can fail if it never reaches the inbox. Google's email sender guidelines, in effect since February 1, 2024, set requirements for anyone sending to personal Gmail accounts:
- All senders need SPF or DKIM authentication and must keep the spam rate reported in Postmaster Tools below 0.3%. Google recommends staying below 0.10%.
- Senders of more than 5,000 messages a day need SPF, DKIM and DMARC, with the From domain aligned.
- Those bulk senders must support one-click unsubscribe for marketing messages and show a clear unsubscribe link in the body.
AI tools make it easy to cross these lines without noticing. Ten new sending domains, each sending a few hundred messages a day, can add up fast. A complaint rate that looks small per mailbox can sink a whole domain's reputation. We ask clients to set daily send caps per domain and to watch spam rates weekly before raising volume.
Can AI voice agents make sales calls?
Only with the right consent. On February 8, 2024, the FCC ruled that AI-generated voices count as artificial voices under the Telephone Consumer Protection Act. The FCC's announcement notes that telemarketers generally need prior express written consent before robocalling consumers, and the ruling holds AI-generated voices to those same standards.
For a buyer, that means an AI voice feature is not a cold-calling shortcut. If you plan to use one, your CRM must store when and how each person gave consent, and the voice tool must check that record before it dials. If the consent field is empty, the call does not happen. Your counsel should confirm how these rules apply to your call types.
What should your CRM enforce before the AI tool sends anything?
The CRM should be the single source of truth, and every tool should read from it. In practice we build five controls:
- One suppression list. Opt-outs from email, forms, calls and replies land in one CRM field that every sending tool checks, synced at least daily.
- Consent records. Channel, date, source and wording for each consent, especially for calls and texts.
- Send limits. Daily caps per domain and per mailbox, set in the tool and checked against actual sends.
- Content rules. Approved subject line patterns, the physical address and the opt-out link built into every template.
- Human review. A person approves new sequences and samples live messages every week.
Most of this is integration work. The AI tool, the email platform and the dialer each keep their own lists unless someone connects them through API integrations. When they drift apart, a contact who opted out on Monday can still get a message on Thursday.
Follow-up should stay human where it counts. One of our clients, a solar solutions provider, builds task reminders into its Arches workflow automation for every bid, so a person owns each next step instead of a sequence firing blindly. AI can draft the note. The reminder makes sure someone reads it before it goes out.
How should you roll out an AI prospecting tool?
Start small and measure. Pick one segment, one sending domain and one sequence. Run it with the five controls above for a few weeks, and track replies, opt-outs, spam rate and meetings booked. Then expand only if the numbers hold.
Ask vendors direct questions before you sign. Can the tool read your CRM suppression list in real time? Does it log every message it sends, with the prompt and version used? Can you cap volume per domain? Can a manager approve sequences before launch? A vendor that cannot answer these clearly is asking you to carry the risk alone.
Done this way, AI sales prospecting becomes a controlled extension of your sales team, with the CRM as its memory and its rulebook. Our CRM services and workflow automation work cover exactly that setup.
Frequently asked questions
Yes. The FTC says the law makes no exception for business-to-business email, so commercial messages to business addresses must follow the same rules on headers, subject lines, address and opt-out.
Under CAN-SPAM, within 10 business days, and the opt-out method must keep working for at least 30 days after the message is sent. Syncing your CRM suppression list daily keeps every tool inside that window.
Google asks all senders to keep the spam rate reported in Postmaster Tools below 0.3% and recommends staying below 0.10%. Senders of more than 5,000 messages a day also need SPF, DKIM, DMARC and one-click unsubscribe.
The FCC ruled in February 2024 that AI-generated voices are artificial under the TCPA, so the consent rules for robocalls apply. Store consent in your CRM, have the tool check it before dialing, and confirm details with counsel.
Sources
- FTC: CAN-SPAM Act: A Compliance Guide for Business
- Google Gmail Help: Email sender guidelines
- FCC: FCC Makes AI-Generated Voices in Robocalls Illegal
- FCC news release, February 8, 2024 (PDF)
Set up AI prospecting with guardrails
Tell us which prospecting tools you use and where your contacts live. We will map one suppression list, consent records and send limits into your CRM, and connect each tool through API integrations and workflow automation.
