This guide shows each region as it stood on 27 October 2026. It is for a company whose agents send emails, chat, negotiate or give quotes. It is not legal advice, and we are not lawyers. Where we couldn't confirm something, we say so. Check anything you rely on with a lawyer who knows that region.
The rules at a glance
| region | the rule that matters most for a sales agent | when |
|---|---|---|
| EU | AI Act Article 50: people must know they are dealing with an AI | applies now, since 2 August 2026 |
| UK | PECR, the UK's rules on marketing emails, with fines now as high as UK GDPR fines | applies now, since 5 February 2026 |
| US | laws against misleading people, CAN-SPAM, consent before AI voice calls, and California's rule that bots must not hide what they are | applies now |
| Colorado | automated decisions with major effects on people. Marketing is left out | 1 January 2027 |
| South Korea | tell users in advance that a service uses AI | applies now, since 22 January 2026, with a grace period before fines |
| Australia | privacy policies must describe automated decisions that matter | 10 December 2026 |
| Canada, Japan, Singapore, India, Brazil | no AI law that affects sales outreach yet. Existing privacy and email law does apply | existing law applies now |
European Union
The AI Act's rule on being open about AI applies now. Article 50(1) says a system that talks to people must be built so that it is immediately clear to them that they are dealing with an AI. It has applied since 2 August 2026. The Digital Omnibus, a package of changes agreed in 2026, did not delay it (Houthoff, 1 September 2026). Fines for breaking it go up to €15m or 3% of worldwide turnover.
The high-risk rules have moved, and a sales agent is normally not high-risk. The Omnibus moved the duties for high-risk systems in Annex III to 2 December 2027, and those in Annex I to 2 August 2028. It also moved the rule on marking AI-made content (Article 50(2)) to 2 December 2026 for systems already on the market (Orrick, July 2026; Hunton, 28 July 2026). Sales outreach is not on the Annex III list.
GDPR Article 22 covers decisions that have a legal effect on a person, or an effect that is just as serious. Most outreach and quoting between businesses will not reach that bar. For a decision that does, the EU's top court has said people are owed a real explanation of the logic behind it (CJEU, Dun & Bradstreet Austria, 27 February 2025).
The new Product Liability Directive applies from 9 December 2026. It treats software, including AI, as a product (BTO, 30 July 2026). It protects people and does not cover companies, so a seller that only sells to businesses has little direct risk from it.
Each country sets its own rules on email consent. Some EU countries require consent before you email a business. Others allow it as long as people can opt out. We have not checked them country by country, so check the ones you sell into.
What to do: make every agent say it is an AI in its first message to a buyer in the EU. Keep a record of what each agent sent. Check the email rules in each country you sell into.
United Kingdom
There is no AI bill yet. A bill is a proposed law, and one has been expected for some time. The earliest it could now arrive is a King's Speech in late 2027 (Lewis Silkin, 14 September 2026).
The Data (Use and Access) Act 2025 changed the rules on automated decisions from 5 February 2026. The general ban now only covers significant decisions based on special category data, which is sensitive data such as health or religious beliefs. Every significant automated decision still needs safeguards. You must tell the person, let them give their side, let a human step in, and let them challenge the decision (Bratby Law, updated 25 October 2026; Clifford Chance, 6 February 2026).
PECR fines rose to UK GDPR levels at the same time, to as much as £17.5m or 4% of turnover. When one business emails another, you can email a corporate subscriber without consent. That means a limited company, an LLP or a public body. You must say who you are and give a way to opt out that works. In England, Wales and Northern Ireland, self-employed people trading in their own name, and ordinary partnerships, count as individuals. You need their consent, or the soft opt-in, which is a narrow exception for existing customers. A named employee's work email address is still personal data. So you need a legitimate interests assessment, which is a written check that your reason for contacting them is fair to them. And if someone objects, every system that sends must respect it (Global Law Experts, 25 September 2026).
What to do: before an agent writes to a prospect, check whether they are a company or a person trading in their own name. Make sure an opt-out reaches every system that can send. Keep a record of why each person was contacted.
United States, federal
There is no federal AI law, and state laws still apply. The executive order of 11 December 2025 set up a Justice Department task force to challenge state AI laws, and asked agencies to review them. The order does not override state law by itself (Paul Hastings, 16 December 2025). We could not confirm what the review found.
The FTC, the US consumer protection agency, can still act against deception, and that includes AI. In December 2025 it set aside its 2024 order against the writing tool Rytr. Its reason was that a tool being open to misuse is not enough on its own (Mintz, 13 February 2026). A false statement your agent makes to a buyer is still a false statement your company made.
CAN-SPAM covers emails between businesses too, with no exception for them. You need accurate sender details in the email headers, a subject that doesn't mislead, a physical address, and an opt-out that is honoured within ten days. The fine for each email is updated every year, and we could not confirm the 2026 figure.
Under the TCPA, a US law on phone calls, an AI voice counts as an artificial voice. So the consent rules for automated calls apply to AI voice agents (NCLC, 27 January 2025). A proposal to make callers say during the call that it is an AI is not final.
What to do: treat everything an agent tells a buyer as something your company said. Honour opt-outs within ten days in every system that sends. Get consent before an AI voice agent calls anybody.
United States, state by state
| state | what it says | when | does it matter for sales agents? | source |
|---|---|---|---|---|
| California, BOT Act | it is against the law to use a bot online to mislead someone about it being a bot, in order to make a sale. Saying clearly that it is a bot is a defence | in force since 2019 | yes, directly | §17941 |
| California, CCPA rules on automated decisions | notices and opt-outs for significant decisions in finance, housing, education, jobs and healthcare. Advertising is left out | comply by 1 January 2027 | probably not, for outreach | Hunton |
| Colorado, SB 26-189 | replaces the 2024 AI Act. It asks for notice, an explanation within 30 days of a decision that goes against someone, human review on appeal, and records kept for three years. Advertising, marketing and sorting customer-service requests are left out | 1 January 2027 | only if an agent makes a decision with major effects | Eckert Seamans; AFS, 22 May 2026 |
| Texas, TRAIGA | bans AI that is built or used to push people towards harm or to discriminate unlawfully. The duty to say you use AI falls on government and healthcare | 1 January 2026 | the ban, yes. The duty to say you use AI, no | Norton Rose Fulbright |
| Utah, AI Policy Act | say you use generative AI when a consumer clearly asks. You must say it up front only in regulated professions | amended May 2025, due to end July 2027 | yes, if buyers ask | Davis Polk, 4 April 2025 |
| New York, One Fair Price Act | bans prices set using a person's own data | in effect since mid-September 2026 | possibly, for agents that give quotes. We could not confirm whether it covers sales between businesses | SecurePrivacy, 2 October 2026 |
What to do: make every agent that might write to somebody in California say it is an AI. Never let an agent set a price based on what it knows about the person it is talking to. Anywhere an agent makes a decision that matters, keep records for three years.
The rest of the world
| region | where it stands | does it matter for sales agents? | source |
|---|---|---|---|
| Canada | the federal AI bill died in January 2025. Quebec's Law 25 already says people must be told about decisions made only by automated processing. They can ask for the main factors, and they get a chance to give their view to a person | in Quebec, for automated decisions | ComplianceHub, 22 August 2026 |
| Australia | no AI act. From 10 December 2026, privacy policies must describe the decisions made by computer programs that significantly affect people | for your privacy policy | Allens, 2 October 2026 |
| Singapore | no binding AI law. A framework for agentic AI, meaning AI that acts on its own, from January 2026. It says to set limits on the risks, keep people accountable, use technical controls and be open with users | the clearest official guidance on agents anywhere | Baker McKenzie, 29 January 2026 |
| Japan | the AI Promotion Act of May 2025 asks for reasonable efforts and sets no penalties | low | White & Case, 14 April 2026 |
| South Korea | the AI Basic Act has applied since 22 January 2026. Tell users in advance that a service uses AI, and label what generative AI produces. Larger foreign companies need a local representative. Fines go up to KRW 30m, after a grace period of at least a year | yes | Cooley, 27 January 2026 |
| China | AI-generated content has had to be labelled since 1 September 2025. This is a duty on the service provider | if you sell into China | Loeb, March 2025 |
| India | rules on AI-made content have been in force since February 2026, aimed at platforms. The data protection rules arrive in stages, most of them by 13 May 2027 | the data protection rules | Conventus, 9 December 2025 |
| Brazil | the AI bill passed the Senate in December 2024 and is still with the Chamber. The data protection law already applies | not yet | CASRAI, 25 September 2026 |
We have not looked into Canada's anti-spam law, Australia's Spam Act or Singapore's rules on data protection and spam for this guide. All three control outbound email in those countries.
Seven good habits that work in every region
These are what the rules above have in common. Where Reynforce does one of them, we say so. Where it doesn't, we say that too.
- Say it is an AI, in the first message. This is the one AI-specific rule that already applies to sales agents in the EU, California and South Korea, and in Utah when someone asks. Reynforce does not check this today. Put it in your agent's instructions and your templates.
- Keep a record of what every agent promised, and whose rules it was following. Every rule on automated decisions asks you to be able to show this. You also need it the day a buyer says your agent promised. Reynforce records this on the Activity page as it happens. It keeps each check, what the answer was, which agent asked, and whose rules it was following. See how to prove what an AI agent said.
- Have a person check the promises that matter. Every law above that touches automated decisions asks for a human to review something. Reynforce answers “ask first” for the promises you choose. It sends them to the person who can approve, by email, Slack or text, and gives the agent words to use while it waits. See do AI sales agents need human approval?
- Never let an agent make up prices or discounts. Laws against misleading people, and New York's ban on personal pricing, both depend on what was offered and why. In Reynforce, an agent may quote a price only if somebody owns it and has checked it. You decide, topic by topic, whether an agent may offer a discount, must ask first, or may never offer one. See can an AI agent offer a discount?
- Keep what agents say about you up to date, with a name on each fact. If an agent repeats a certification you let lapse, that is a false statement under every law above. This is what Reynforce's Facts are. Each fact has an owner and a check date, and an agent may not use a fact nobody stands behind.
- Respect an opt-out everywhere at once. PECR, CAN-SPAM and GDPR's right to object all mean an objection must reach every system that can send. Reynforce does not enforce do-not-contact lists. It can show, as one total, how many systems and agents are contacting the same person, which is often where a missed opt-out shows up. The list itself belongs in your sending tools.
- Keep records for long enough. Colorado asks for three years where its law applies. Reynforce keeps records for 24 months by default. It never deletes a promise nobody has closed, and it records every deletion. You can't yet change that period for your workspace. If you need three years, tell us before you rely on it. See what we hold.
When Reynforce is the wrong choice
- You need a lawyer's view on one region. This guide is a map of the rules and it is not legal advice. Reynforce is not a compliance product.
What it costs
£99 a month for each agent for your first 10 agents. After that it is £79 a month for each agent, up to 49 agents. If you pay for a year at once, you get two months free. If you want us to set it up and get it signed off with you, that starts at £2,500, paid once, and the price depends on the agent's job. Pricing has the rest.
What this guide does not cover
Rules for particular industries, such as financial promotions, healthcare and insurance. Anything to do with decisions about employing people. Email consent law in each EU country. For a particular company, any of these can matter more than everything above.
Each source has its date next to it. Several rows above come from law firm summaries, which are not the law itself. Things are changing quickly, so if a date matters to you, check it at the source.