AI in email is the use of software to draft, personalize, time, route, or answer the messages your company sends to customers. It is already running in most inboxes, usually without a formal decision, and the question nobody settles before launch is whether to tell anyone.
Somewhere in your company, a model is writing to customers right now. It drafts the follow-up, picks the send time, decides who gets which message, and increasingly it answers the phone as well. Disclosure is the part with real consequences.
This is not legal advice. Rules on automated communication vary by state and by channel and they change. This is about the practical question underneath the legal one, which is what you owe the person on the other end and what happens to trust when you get it wrong. Most examples here cover AI in email, because that is where the volume sits, and the voice section covers where the stakes rise.
TL;DR
Consent and disclosure are different problems. Consent is largely settled law. Disclosure is mostly a brand decision you are making by default if you are not making it deliberately. For AI in email, the working test is accountability rather than authorship, so ask whether a named person is answerable for every claim in the message.
On voice, decide your position before launch and write one rule into the script. If a caller asks whether they are speaking to a person, the agent says no immediately. If your team is not willing to answer that question honestly, do not deploy a voice agent at all.
Key takeaways
- Consent is a legal obligation and disclosure is mostly a trust decision, so treat them as two separate policies.
- The workable test is whether the recipient would feel misled if they knew exactly how the message was produced.
- Disclosing AI in email on every message becomes noise, so reserve it for the cases where a reader could be genuinely misled.
- On voice, never let an agent dodge a direct question about being human.
- Write disclosure as an introduction, not a warning, because defensive phrasing creates the suspicion it was meant to avoid.
- Get retention, training use, and access answers in writing before customer conversations reach a third party model.
- Give the policy a named owner, because policies with no owner default to whatever the implementing team decided that week.
Table of contents
- What AI in email disclosure means
- Where this is legal and where it is trust
- When disclosure is actually needed
- The accountability test for AI in email
- Voice, the harder case
- Writing disclosure that does not kill the conversation
- Data handling, the part people skip
- A disclosure policy you can actually ship
- AI disclosure FAQ
- The bottom line
What AI in email disclosure means
AI disclosure is telling the person you are communicating with that artificial intelligence was involved in producing the message. That sounds simple until you write the policy, because AI involvement covers an enormous range.
A spell checker is AI by most definitions. So is the model that picked the send time. So is the system that drafted the entire message. So is the voice on the phone that sounds like a person and is not one.
Nobody thinks the spell checker needs a notice. Most people think the voice does. The interesting work sits in the middle, and the way through it is to stop asking how much AI was used and start asking a different question. Would this person feel misled if they found out exactly how this message was produced?
That question is answerable in a meeting. It also tracks fairly closely to where the law is heading, which is a convenient accident rather than a coincidence.
Where this is legal and where it is trust
Two things get tangled together and they behave differently.
Consent is largely settled. If you are making automated or prerecorded calls or sending marketing texts in the United States, there are rules about permission, about when you may contact someone, and about honoring an opt-out. Those are obligations rather than preferences. For email specifically, the FTC’s CAN-SPAM compliance guide sets out the header, subject line, identification, and unsubscribe requirements, and none of them change because a model wrote the draft. For outbound calling, the Telemarketing Sales Rule is the companion document.
Disclosure is mostly not settled. Outside specific state rules and specific contexts, there is often no statute requiring you to announce that a message was AI-assisted. That means you are making a brand decision, and you should make it deliberately rather than by accident.
The trap is treating an unsettled question as a settled one in your favor. Absence of a requirement is not absence of a consequence. The consequence simply arrives as a customer who feels tricked rather than as a fine.
One correction worth making
A lot of vendor content still describes the FCC one-to-one consent rule as binding law with a 2025 or 2026 effective date. That is wrong. The rule was vacated by the Eleventh Circuit in January 2025 and never took effect. Prior express written consent under the TCPA remains the operative standard for automated marketing calls and texts.
Adopting one-to-one consent as internal policy is still sensible, because it reduces litigation exposure and it is easier to explain to a customer than a shared lead form. The genuinely live change is the cross-channel revocation requirement, which means an opt-out given in one channel has to be honored across the others. Our legal and compliance overview covers how that is handled on live campaigns.
When disclosure is actually needed
The policy question is easier once you stop treating every message the same way. Below is how the common cases usually resolve. Your counsel may draw the lines differently, and the states you operate in matter.
| Message type | Reader expectation | Disclose | What it usually looks like |
|---|---|---|---|
| Bulk newsletter | Assumes automation already | Not needed | Standard sender identification and unsubscribe |
| Drafted one-to-one sales email | Assumes a person wrote it | Not needed if a person reviewed and sent it | Nothing, provided the named sender is real and accountable |
| Automated reply to a complaint | May believe a person answered | Yes | One line stating the reply is automated and when a person will follow up |
| AI voice call | Assumes a human by default | Yes, up front or on request | A short introduction naming the assistant and the company |
| Chat widget handoff | Often unclear to the visitor | Yes at the start of the session | A label on the agent and a visible route to a person |
Most AI in email lands in the first two rows, which is why a blanket notice on every send adds nothing. The pattern is consistent. Disclosure matters where the recipient would otherwise form a false belief about who they are dealing with, and it is noise everywhere else.
The accountability test for AI in email
Email is the easier channel, because readers have assumed a machine was involved for twenty years. Nobody believes the newsletter was handwritten.
So disclosing AI in email on every single message is not useful. It would be noise, and it would train people to ignore the notice in the cases that matter.
The line that holds up is accountability rather than authorship. Ask who is answerable for the claim in this message. If a person reviewed it and stands behind it, the fact that a model produced the first draft is a process detail. If nothing was reviewed and the message asserts something specific about price, availability, results, or someone’s account, you have a problem, and the problem is not disclosure. It is that you are making unreviewed claims.
Two cases still deserve explicit handling. A message that appears to be personal correspondence from a named individual should actually involve that individual. And an automated reply that could be mistaken for a human response to a specific complaint should say it is automated, because the alternative is a customer waiting for a reply that already arrived.
Three questions that settle most arguments
- Is a named person accountable for every factual claim in this message?
- Could the recipient reasonably believe a human wrote this specifically for them?
- If this message were screenshotted next to an explanation of how it was produced, would it read as ordinary or as a trick?
Disclosure on live calls
See the exact wording other teams approve
We will show you how disclosure sits inside a working call script and what it does to answer rates. Twenty minutes, and you keep the script.
Voice, the harder case
Voice is different, and the difference is not subtle.
Modern voice agents pass as human on a short call. That is a product achievement and an ethical exposure at the same time. When someone discovers mid-conversation that they have been talking to software, the reaction is rarely mild. People feel embarrassed, embarrassment converts quickly to anger, and the anger attaches to your brand rather than to the technology.
There is an asymmetry worth noticing. A reader who suspects a template shrugs. A caller who realizes they were fooled tells other people.
Practically, the teams that handle this well do one of three things.
They disclose up front, briefly, and move on. This costs less than people fear when the phrasing is confident.
Or they disclose on request and train the agent to answer the question honestly and immediately. If a caller asks whether they are speaking to a real person, the agent says no. Any design where the agent deflects that question is a decision to deceive, whatever the intention was.
Or they use a voice that does not attempt to pass, which sidesteps the problem and costs some warmth.
What does not work is refusing to decide, which in practice means the agent evades and a caller eventually posts the recording. Our own platform leaves the choice with the customer and puts the wording in the script you approve. If you are comparing options on this specifically, our notes on TCPA compliant AI calling platforms set out what to check before you buy.
Writing disclosure that does not kill the conversation
Most disclosure reads badly because it is written by someone worried about liability. Hedged, passive, apologetic phrasing signals that something is wrong even when nothing is.
Compare these. “Please be advised that this call may be conducted using automated artificial intelligence technology” sounds like a warning. “Hi, this is Ava, I am an AI assistant with Bigly Sales” sounds like an introduction.
The second is more honest and performs better, for the same reason. Confidence reads as normal. If you sound like you are admitting something, people conclude there was something to admit.
Three rules hold up across channels. Say it early rather than when challenged. Say it in one short sentence. Then continue as though it is unremarkable, because it is.
The same rules apply to AI in email. A single plain line at the top of an automated reply works. A paragraph of legal hedging at the bottom does not, because nobody reads it and its presence suggests the company expected an objection.
Data handling, the part people skip
Disclosure debates focus on the message. The more consequential question is what happens to the conversation afterward.
If customer conversations pass through a third party model, ask three things and get the answers in writing. Is this data used to train the provider’s models. How long is it retained. Who can access it internally.
For regulated conversations there is a fourth. Can recordings and transcripts be produced on demand for your compliance team, and for how long.
A team can be scrupulous about announcing the AI and still be quietly sending customer health or financial details into a system with unclear retention. The disclosure question is visible. This one is not, and it is the one that turns into a real incident.
There is a version of this that applies specifically to AI in email. Drafting assistants often retain prompt content, which means the customer record you pasted in to personalize a message may now sit with a vendor you never reviewed.
A disclosure policy you can actually ship
Most disclosure policies fail because they are written as a philosophy rather than as instructions. A usable one fits on a page and answers the questions an implementing team will actually hit.
- Name an owner. Usually shared between whoever owns compliance and whoever owns brand, because this is simultaneously a legal exposure and a trust decision.
- Write the sentences. Approve the exact wording for voice, for automated replies, and for chat, so nobody improvises under pressure.
- Set the escalation rule. Define when an automated interaction has to reach a person, and how fast.
- Record the vendor answers. Retention period, training use, internal access, and export terms, kept with the contract rather than in someone’s inbox.
- Review after real complaints. The first genuine complaint teaches you more about your policy than the drafting process did.
If you want the shared vocabulary before writing yours, our AI calling glossary defines the terms that tend to get used loosely in these documents.
AI disclosure FAQ
What is AI disclosure?
AI disclosure means telling the person you are communicating with that artificial intelligence is involved, whether that is a drafted email, an automated reply, or a voice agent on a call. It is separate from consent, which governs whether you were permitted to contact them at all. One is about honesty in the interaction and the other is about permission to start it.
Do I legally have to disclose that a caller is talking to AI?
It depends on where you are calling and why. Consent, calling hours, and opt-out handling are governed by federal and state rules, while explicit AI disclosure requirements vary by state and by context and are still developing. Treat the absence of a clear rule as a decision you have to make rather than permission to say nothing, and get advice for the states you actually operate in.
Is AI disclosure the same as consent?
No, and conflating them causes most of the confusion. Consent is permission to contact someone and is largely settled law. Disclosure is telling them how the message was produced and is largely a trust decision. You can be fully compliant on consent and still damage a relationship by hiding how a message was made.
Should every use of AI in email include a disclosure?
No. Readers have assumed automation for decades, and a notice on every message becomes noise that trains people to ignore it when it matters. Focus instead on whether a named person is accountable for the claims the message makes, and reserve explicit notices for automated replies that could be mistaken for a human response. In practice, AI in email needs a notice only when the reader could reasonably think a person wrote it for them.
Is using AI in email marketing legal?
Yes. AI in email marketing is subject to the same rules that already apply to your email program. Accurate headers and sender identification, a subject line that reflects the content, a working unsubscribe, and prompt honoring of opt-outs are required whether a person or a model wrote the copy. The tool does not change the obligation.
What should an AI voice agent say if someone asks whether it is human?
It should say no, immediately and plainly. Any design where the agent deflects that question is a choice to deceive, and it is the fastest way to turn a routine call into a complaint that other people see. Write the answer into the script rather than leaving it to the model.
Does disclosing AI hurt conversion rates?
Less than teams expect when the wording is confident and brief. Most of the damage teams attribute to disclosure comes from disclosure written defensively, which makes an ordinary practice sound like an admission. An introduction performs differently from a warning, and the difference is in the first four words.
Is the FCC one-to-one consent rule in force?
No. It was vacated by the Eleventh Circuit in January 2025 and never took effect, so prior express written consent under the TCPA remains the operative standard. Many teams still adopt one-to-one consent voluntarily because it lowers litigation risk and is easier to defend than a shared lead form.
What is the difference between disclosure and transparency?
Disclosure is the specific act of saying AI is involved in this interaction. Transparency is broader and covers what data you collect, how long you keep it, whether it trains a model, and who can see it. You can disclose well and still be far from transparent, and customers usually discover the gap at the worst moment.
Who should own the AI disclosure policy internally?
It needs a named owner, usually shared between whoever owns compliance and whoever owns brand, because it is simultaneously a legal exposure and a trust decision. Policies with no owner default to whatever the implementing team decided that week, which is how two departments end up with contradictory scripts.
The bottom line
The companies that handle this well are not the ones with the longest notice. They decided in advance, wrote it in one plain sentence, told their agents to answer honestly when asked, and got their retention terms in writing.
The ones that struggle treated silence as the safe option, which it is right up until somebody finds out. That is true for AI in email and it is far more true on the phone.
Before you launch
Get the disclosure wording right the first time
Tell us your industry and we will walk through how other teams worded disclosure and what it did to their numbers. No script is deployed without your approval.
