# What do AI regulations require of sales agents, region by region?

**Mostly three things: tell the buyer they are dealing with an AI, keep a
record of what the agent said and decided, and put a person in front of the
decisions that matter.** Very few of the new AI laws are aimed at outbound
sales, and the rules that bite hardest on an AI sales agent today are still
the old ones: email consent, honest selling and data protection.

This guide covers each region as it stands **on 27 October 2026**, says
what applies to a company whose agents email, chat, negotiate or quote, and
ends with a short guide to doing it well. **It is not legal advice, and we
are not lawyers.** Where we could not confirm that something is current, we
say so rather than guessing. Check anything you will rely on with a lawyer
who knows the region.

## The short version

| region | the rule that matters most for a sales agent | when |
|---|---|---|
| **EU** | AI Act Article 50: a person must know they are dealing with an AI | **applies now**, since 2 August 2026 |
| **UK** | PECR email rules, with fines now at UK GDPR levels | **applies now**, since 5 February 2026 |
| **US** | deception law, CAN-SPAM, consent for AI voice calls, and California's rule against bots hiding what they are | **applies now** |
| **Colorado** | automated decisions with major consequences, **marketing excluded** | 1 January 2027 |
| **South Korea** | tell users in advance that a service uses AI | **applies now**, since 22 January 2026, with a grace period on fines |
| **Australia** | privacy policies must describe automated decisions that matter | 10 December 2026 |
| **Canada, Japan, Singapore, India, Brazil** | no AI law that bites on outbound sales yet; existing privacy and email law does | — |

## European Union

**The AI Act's transparency rule applies now.** Article 50(1) says a system
that talks to people must be designed so that it is *immediately clear* to
them that they are dealing with an AI. It has applied since **2 August
2026**, and the Digital Omnibus agreed in 2026 did not delay it
([Houthoff, 1 September 2026](https://www.houthoff.com/insights/news/ai-act-transparency-obligations-and-the-ai-omnibus-regulation/)).
Penalties for breaching it run to €15m or 3% of global turnover.

**The high-risk rules moved, and a sales agent is normally not high-risk.**
The Omnibus moved the Annex III high-risk obligations to **2 December 2027**
and Annex I to **2 August 2028**, and marking AI-made content (Article 50(2))
for systems already on the market to **2 December 2026**
([Orrick, July 2026](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes);
[Hunton, 28 July 2026](https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force)).
Outbound sales is not on the Annex III list.

**One question we could not settle**: whether a company that builds its own
agent on somebody else's model is the *provider* Article 50(1) speaks to.
Our reading is that a company putting an agent in front of buyers should act
as though it is. That is our reading, not a source's.

**GDPR Article 22 is about decisions with legal or similarly significant
effect on a person.** Most B2B outreach and quoting will not reach that bar.
The court has said people are owed a real explanation of the logic behind an
automated decision that does
([CJEU, Dun & Bradstreet Austria, 27 February 2025](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-02/cp250022en.pdf)).

**The new Product Liability Directive applies from 9 December 2026**, and it
treats software, AI included, as a product
([BTO, 30 July 2026](https://bto.co.uk/?p=3161)). Claims are for people
rather than companies, so a purely B2B seller's direct exposure is limited.
It is still a signal of where liability for AI is going.

**Email consent is national.** Some member states require consent for B2B
email and others allow it with an opt-out. We have not researched them
country by country, so check the ones you sell into.

**What to do:** make every agent say it is an AI in its first message to a
buyer in the EU, keep a record of what each agent sent, and check the email
rules in each country you sell into.

## United Kingdom

**There is no AI bill.** One has been expected for some time, and the
earliest it could now come is a King's Speech in late 2027
([Lewis Silkin, 14 September 2026](https://www.lewissilkin.com/insights/2026/09/14/ai-judgment-day-on-the-horizon-while-uk-lawmakers-play-catch-up)).

**The Data (Use and Access) Act 2025 changed the rules on automated
decisions from 5 February 2026.** The general ban now covers only
significant decisions based on special category data. Every significant
automated decision still needs safeguards: telling the person, letting them
make representations, a human to intervene, and a right to contest
([Bratby Law, updated 25 October 2026](https://bratby.law/data-use-and-access-act-2025-commencement/);
[Clifford Chance, 6 February 2026](https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2026/02/key-aspects-of-the-data--use-and-access--act-take-effect.html)).

**PECR fines rose to UK GDPR levels at the same time**, up to £17.5m or 4%
of turnover. For B2B email, a **corporate subscriber** — a limited company,
an LLP or a public body — can be emailed without consent, as long as you say
who you are and give a working way to opt out. **Self-employed people trading in their own name, and ordinary
partnerships, in England, Wales and Northern Ireland count as individuals** and
need consent or the soft opt-in. A named employee's work address is still
personal data, so you need a legitimate interests assessment, and an
objection has to be honoured across every system that sends
([Global Law Experts, 25 September 2026](https://globallawexperts.com/b2b-email-marketing-rules-uk/)).

**What to do:** check whether each prospect is a company or a person
trading in their own name before an agent writes to them, make sure an opt-out reaches every system
that can send, and keep a record of why each person was contacted.

## United States, federal

**There is no federal AI law, and state laws still stand.** The executive
order of 11 December 2025 set up a Justice Department task force to
challenge state AI laws and asked agencies to review them, but it does not
itself override state law
([Paul Hastings, 16 December 2025](https://www.paulhastings.com/insights/client-alerts/president-trump-signs-executive-order-challenging-state-ai-laws)).
What the review found is something we could not confirm.

**The FTC's general power over deception still applies to AI.** It set aside
its 2024 order against the writing tool Rytr in December 2025, on the
grounds that a tool being misusable is not enough
([Mintz, 13 February 2026](https://www.mintz.com/insights-center/viewpoints/54731/2026-02-13-emerging-federal-ai-strategy-ftc-sets-aside-rytr)).
A false statement an agent makes to a buyer is still a false statement your
company made.

**CAN-SPAM covers B2B email, with no exception for it**: accurate headers, a
subject line that does not mislead, a physical address, and an opt-out
honoured within ten days. The per-email penalty is adjusted each year and we
could not confirm the 2026 figure.

**An AI voice is an artificial voice under the TCPA**, so the consent rules
for automated calls apply to AI voice agents
([NCLC, 27 January 2025](https://library.nclc.org/article/top-six-tcparobocall-developments-20242025)).
A proposal to require AI disclosure during the call is not final.

**What to do:** treat everything an agent tells a buyer as something your
company said, honour opt-outs within ten days in every system that sends,
and get consent before an AI voice agent calls anybody.

## United States, state by state

| state | what it says | when | relevant to sales agents? | source |
|---|---|---|---|---|
| **California, BOT Act** | it is unlawful to use a bot online to mislead somebody about its artificial identity in order to drive a sale; a clear disclosure is a defence | in force since 2019 | **yes, directly** | [§17941](https://california.public.law/codes/ca_bus_and_prof_code_section_17941) |
| **California, CCPA rules on automated decisions** | notices and opt-outs for significant decisions in finance, housing, education, employment and healthcare. **Advertising is excluded** | comply by 1 January 2027 | probably not, for outreach | [Hunton](https://www.hunton.com/privacy-and-information-security-law/cppa-finalizes-ccpa-regulations-on-automated-decision-making-technology-risk-assessments-and-cybersecurity-audits) |
| **Colorado, SB 26-189** | replaces the 2024 AI Act. Notice, an explanation within 30 days of an adverse decision, human review on appeal, and **records kept for three years**. **Advertising, marketing and customer-service triage are excluded** | 1 January 2027 | only if an agent makes a consequential decision | [Eckert Seamans](https://www.eckertseamans.com/legal-updates/colorado-repeals-and-replaces-its-landmark-ai-statute-what-businesses-need-to-know); [AFS, 22 May 2026](https://www.afslaw.com/perspectives/alerts/colorado-replaces-its-landmark-ai-act-new-framework-what-developers-and-deployers-need-to-know-about-sb-26-189) |
| **Texas, TRAIGA** | bans AI built or used to manipulate people towards harm or to discriminate unlawfully. Disclosure duties fall on government and healthcare | 1 January 2026 | the ban, yes; the disclosure duty, no | [Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-us/knowledge/publications/c6c60e0c/the-texas-responsible-ai-governance-act) |
| **Utah, AI Policy Act** | disclose generative AI when a consumer clearly asks; up front only for regulated occupations | amended May 2025; due to lapse July 2027 | yes, if buyers ask | [Davis Polk, 4 April 2025](https://davispolk.com/insights/client-update/utah-scales-back-reach-generative-ai-consumer-protection-law) |
| **New York, One Fair Price Act** | bans pricing set from a person's own data | in effect since mid-September 2026 | **possibly, for quoting agents** — whether it reaches B2B is something we could not confirm | [SecurePrivacy, 2 October 2026](https://secureprivacy.ai/blog/new-york-ai-law-2026-guide) |

**What to do:** make every agent that might write to somebody in California
say it is an AI, never let an agent set a price from what it knows about the
person it is talking to, and keep records for three years anywhere an agent
makes a decision that matters.

## The rest of the world

| region | where it stands | relevant to sales agents | source |
|---|---|---|---|
| **Canada** | the federal AI bill died in January 2025. **Quebec's Law 25** already requires notice of decisions made solely by automated processing, the main factors on request, and a chance to put your view to a person | Quebec, for automated decisions | [ComplianceHub, 22 August 2026](https://compliancehub.wiki/canada-ai-regulation-2026-no-ai-act-what-actually-applies/) |
| **Australia** | no AI act. **From 10 December 2026**, privacy policies must describe the decisions made by computer programs that significantly affect people | your privacy policy | [Allens, 2 October 2026](https://www.allens.com.au/insights-news/insights/2026/10/mandatory-automated-decision-making-disclosure-requirements-are-coming-key-takeaways-from-the-oaic-guidance/) |
| **Singapore** | no binding AI law. A framework for **agentic AI** from January 2026: bound the risks, keep people accountable, apply technical controls, be open with users | the clearest official guidance on agents anywhere | [Baker McKenzie, 29 January 2026](https://www.bakermckenzie.com/en/insight/publications/2026/01/singapore-governance-framework-for-agentic-ai-launched) |
| **Japan** | the AI Promotion Act of May 2025 sets reasonable-efforts duties and no penalties | low | [White & Case, 14 April 2026](https://www.whitecase.com/insight-alert/japans-first-ai-legislation-becomes-law-focus-promoting-research-and-development-no) |
| **South Korea** | the AI Basic Act **applies since 22 January 2026**: tell users in advance that a service uses AI, and label generative output. Larger foreign companies need a local representative. Fines up to KRW 30m, after a grace period of at least a year | **yes** | [Cooley, 27 January 2026](https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways) |
| **China** | AI-generated content must be labelled since 1 September 2025, a duty on the service provider | if you sell into China | [Loeb, March 2025](https://www.loeb.com/en/insights/publications/2025/03/chinas-ai-labeling-measures-and-mandatory-national-standards-take-effect-september-1) |
| **India** | rules on synthetic content in force since February 2026, aimed at platforms. The data protection rules arrive in stages, most of them by **13 May 2027** | the data protection rules | [Conventus, 9 December 2025](https://conventuslaw.com/featured-content/building-indias-digital-privacy-framework-an-overview-of-the-dpdp-rules-2025/) |
| **Brazil** | the AI bill passed the Senate in December 2024 and is still with the Chamber. The data protection law already applies | not yet | [CASRAI, 25 September 2026](https://casrai.org/guides/brazil-ai-bill-pl-2338-status) |

**We have not researched** Canada's anti-spam law, Australia's Spam Act or
Singapore's data protection and spam rules for this guide, and all three
govern outbound email in those countries.

## Doing it well: seven practices that hold in every region

These are what the rules above have in common. Where Reynforce does one of
them, we say so; where it does not, we say that too.

1. **Say it is an AI, in the first message.** This is the one AI-specific
   duty that already bites on sales agents in the EU, California, South Korea
   and, when asked, Utah. **Reynforce does not check this today.** Put it in
   your agent's instructions and your templates.
2. **Keep a record of what every agent committed to, and on whose
   authority.** It is what every rule on automated decisions asks you to be
   able to show, and what you need the day a buyer says *your agent
   promised*. **Reynforce records this as it happens**: each check, what it
   answered, which agent, and the person whose authority it was acting under.
   See [how to prove what an AI agent said](prove-what-an-ai-agent-said.html).
3. **Put a person in front of the commitments that matter.** Every regime
   above that touches automated decisions asks for human review somewhere.
   **Reynforce answers “needs approval” for the commitments you choose** and
   sends them to the person who can give it, with words the agent can use
   meanwhile. See [do AI sales agents need human approval?](do-ai-sales-agents-need-human-approval.html)
4. **Never let an agent improvise prices or discounts.** Deception law, and
   New York's ban on personalised pricing, both turn on what was offered and
   why. **In Reynforce an agent may cite a price only if somebody owns it and
   has checked it**, and you decide by topic whether an agent may offer a
   discount, must ask first, or never may.
   See [can an AI agent offer a discount?](can-an-ai-agent-offer-a-discount.html)
5. **Keep what agents say about you current, with a name on each line.**
   An agent repeating a certification you let lapse is a false statement
   under every regime above. **This is what Reynforce's facts are**: each
   line has an owner and a check date, and a line nobody stands behind is
   one the agent may not use.
6. **Honour an opt-out everywhere at once.** PECR, CAN-SPAM and GDPR's right
   to object all mean an objection reaches every system that can send.
   **Reynforce does not enforce suppression lists.** It can show how many
   systems and agents are contacting the same person in one total, which is
   where a missed opt-out tends to show up; the list itself belongs in your
   sending tools.
7. **Keep records long enough.** Colorado asks for three years where its law
   applies. **Reynforce keeps records for 24 months by default**, never
   deletes a commitment nobody has closed, and records every deletion.
   **A longer period is not yet a setting a workspace can change**; if you
   need three years, tell us before you rely on it. See
   [what we hold](trust.html).

## What this guide does not cover

Sector rules (financial promotions, healthcare and insurance), anything to do
with employment decisions, and country-by-country email consent law in the
EU. All of them can matter more than anything above for a particular company.

**Sources are dated where they appear.** Several rows above come from law
firm summaries rather than the legislation itself, and things are changing
quickly: if a date matters to you, check it at the source.