What do AI regulations require of sales agents, region by region?

Last updated 27 October 2026

Mostly three things: tell the buyer they are dealing with an AI, keep a record of what the agent said and decided, and put a person in front of the decisions that matter. Very few of the new AI laws are aimed at outbound sales, and the rules that bite hardest on an AI sales agent today are still the old ones: email consent, honest selling and data protection.

This guide covers each region as it stands on 27 October 2026, says what applies to a company whose agents email, chat, negotiate or quote, and ends with a short guide to doing it well. It is not legal advice, and we are not lawyers. Where we could not confirm that something is current, we say so rather than guessing. Check anything you will rely on with a lawyer who knows the region.

The short version

European Union

The AI Act's transparency rule applies now. Article 50(1) says a system that talks to people must be designed so that it is immediately clear to them that they are dealing with an AI. It has applied since 2 August 2026, and the Digital Omnibus agreed in 2026 did not delay it (Houthoff, 1 September 2026). Penalties for breaching it run to €15m or 3% of global turnover.

The high-risk rules moved, and a sales agent is normally not high-risk. The Omnibus moved the Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, and marking AI-made content (Article 50(2)) for systems already on the market to 2 December 2026 (Orrick, July 2026; Hunton, 28 July 2026). Outbound sales is not on the Annex III list.

One question we could not settle: whether a company that builds its own agent on somebody else's model is the provider Article 50(1) speaks to. Our reading is that a company putting an agent in front of buyers should act as though it is. That is our reading, not a source's.

GDPR Article 22 is about decisions with legal or similarly significant effect on a person. Most B2B outreach and quoting will not reach that bar. The court has said people are owed a real explanation of the logic behind an automated decision that does (CJEU, Dun & Bradstreet Austria, 27 February 2025).

The new Product Liability Directive applies from 9 December 2026, and it treats software, AI included, as a product (BTO, 30 July 2026). Claims are for people rather than companies, so a purely B2B seller's direct exposure is limited. It is still a signal of where liability for AI is going.

Email consent is national. Some member states require consent for B2B email and others allow it with an opt-out. We have not researched them country by country, so check the ones you sell into.

What to do: make every agent say it is an AI in its first message to a buyer in the EU, keep a record of what each agent sent, and check the email rules in each country you sell into.

United Kingdom

There is no AI bill. One has been expected for some time, and the earliest it could now come is a King's Speech in late 2027 (Lewis Silkin, 14 September 2026).

The Data (Use and Access) Act 2025 changed the rules on automated decisions from 5 February 2026. The general ban now covers only significant decisions based on special category data. Every significant automated decision still needs safeguards: telling the person, letting them make representations, a human to intervene, and a right to contest (Bratby Law, updated 25 October 2026; Clifford Chance, 6 February 2026).

PECR fines rose to UK GDPR levels at the same time, up to £17.5m or 4% of turnover. For B2B email, a corporate subscriber — a limited company, an LLP or a public body — can be emailed without consent, as long as you say who you are and give a working way to opt out. Self-employed people trading in their own name, and ordinary partnerships, in England, Wales and Northern Ireland count as individuals and need consent or the soft opt-in. A named employee's work address is still personal data, so you need a legitimate interests assessment, and an objection has to be honoured across every system that sends (Global Law Experts, 25 September 2026).

What to do: check whether each prospect is a company or a person trading in their own name before an agent writes to them, make sure an opt-out reaches every system that can send, and keep a record of why each person was contacted.

United States, federal

There is no federal AI law, and state laws still stand. The executive order of 11 December 2025 set up a Justice Department task force to challenge state AI laws and asked agencies to review them, but it does not itself override state law (Paul Hastings, 16 December 2025). What the review found is something we could not confirm.

The FTC's general power over deception still applies to AI. It set aside its 2024 order against the writing tool Rytr in December 2025, on the grounds that a tool being misusable is not enough (Mintz, 13 February 2026). A false statement an agent makes to a buyer is still a false statement your company made.

CAN-SPAM covers B2B email, with no exception for it: accurate headers, a subject line that does not mislead, a physical address, and an opt-out honoured within ten days. The per-email penalty is adjusted each year and we could not confirm the 2026 figure.

An AI voice is an artificial voice under the TCPA, so the consent rules for automated calls apply to AI voice agents (NCLC, 27 January 2025). A proposal to require AI disclosure during the call is not final.

What to do: treat everything an agent tells a buyer as something your company said, honour opt-outs within ten days in every system that sends, and get consent before an AI voice agent calls anybody.

United States, state by state

What to do: make every agent that might write to somebody in California say it is an AI, never let an agent set a price from what it knows about the person it is talking to, and keep records for three years anywhere an agent makes a decision that matters.

The rest of the world

We have not researched Canada's anti-spam law, Australia's Spam Act or Singapore's data protection and spam rules for this guide, and all three govern outbound email in those countries.

Doing it well: seven practices that hold in every region

These are what the rules above have in common. Where Reynforce does one of them, we say so; where it does not, we say that too.

1. Say it is an AI, in the first message. This is the one AI-specific duty that already bites on sales agents in the EU, California, South Korea and, when asked, Utah. Reynforce does not check this today. Put it in your agent's instructions and your templates.
2. Keep a record of what every agent committed to, and on whose authority. It is what every rule on automated decisions asks you to be able to show, and what you need the day a buyer says your agent promised. Reynforce records this as it happens: each check, what it answered, which agent, and the person whose authority it was acting under. See how to prove what an AI agent said.
3. Put a person in front of the commitments that matter. Every regime above that touches automated decisions asks for human review somewhere. Reynforce answers “needs approval” for the commitments you choose and sends them to the person who can give it, with words the agent can use meanwhile. See do AI sales agents need human approval?
4. Never let an agent improvise prices or discounts. Deception law, and New York's ban on personalised pricing, both turn on what was offered and why. In Reynforce an agent may cite a price only if somebody owns it and has checked it, and you decide by topic whether an agent may offer a discount, must ask first, or never may. See can an AI agent offer a discount?
5. Keep what agents say about you current, with a name on each line. An agent repeating a certification you let lapse is a false statement under every regime above. This is what Reynforce's facts are: each line has an owner and a check date, and a line nobody stands behind is one the agent may not use.
6. Honour an opt-out everywhere at once. PECR, CAN-SPAM and GDPR's right to object all mean an objection reaches every system that can send. Reynforce does not enforce suppression lists. It can show how many systems and agents are contacting the same person in one total, which is where a missed opt-out tends to show up; the list itself belongs in your sending tools.
7. Keep records long enough. Colorado asks for three years where its law applies. Reynforce keeps records for 24 months by default, never deletes a commitment nobody has closed, and records every deletion. A longer period is not yet a setting a workspace can change; if you need three years, tell us before you rely on it. See what we hold.

What this guide does not cover

Sector rules (financial promotions, healthcare and insurance), anything to do with employment decisions, and country-by-country email consent law in the EU. All of them can matter more than anything above for a particular company.

Sources are dated where they appear. Several rows above come from law firm summaries rather than the legislation itself, and things are changing quickly: if a date matters to you, check it at the source.