An AI sales agent in outbound prospecting takes over the manual sequence a sales rep normally works through: finding companies that fit, identifying the right person and their email address, researching each company, writing a tailored first email, sending it at a sensible time, replying when the prospect answers and reporting what happened. Done well, it produces fewer generic emails rather than more of them, because each message is built from research on one specific company. Done badly, it becomes a fast way to damage your sending domain and break email marketing law.
This guide explains each stage of the work, where people should stay involved, the rules the agent has to follow in the UK, US and EU, and what to check before you buy or build one.
The outbound workflow, stage by stage
An AI sales agent is not a single model writing emails. It is a piece of software that runs a sequence of steps. It calls a language model where judgement or writing is needed and uses ordinary code, search tools and email systems for everything else.
1. Finding prospects
The agent starts from a definition of your ideal customer: sector, size, location, and signals such as hiring or a recent product launch. It then searches the web, directories or data providers for companies that match, and filters out those that do not. The quality of this definition matters more than the quality of the model. A vague brief such as "small businesses that need marketing" produces a long, weak list.
2. Identifying the decision-maker and their email
For each company, the agent works out who actually decides on your type of purchase, such as the owner of a small firm or the operations lead at a larger one. It then finds or verifies a contact email. This is where a lot of manual time used to go. It is also where legal risk starts, because data about a named person counts as personal data in the UK and EU, even when it relates to their job.
3. Researching the company
Before writing, a good agent reads the company's website and public information and works out the problem the company is likely to have that your product solves. This step separates a useful agent from a mail-merge tool. In a sales agent we built, this principle shaped everything else: an email that could have gone to anyone gets ignored. So before it writes a word, the agent reads the company and works out the problem it faces against what the client sells.
4. Writing the email
The agent drafts a short message that refers to the specific problem it found, explains how you help, and asks for a small next step. You control the tone, the length, the claims it is allowed to make and the words it must never use. The model should not be free to invent customer names, results or discounts.
5. Sending at the right time
The agent sends through your own email setup and schedules each message for working hours in the prospect's time zone, rather than sending a batch whenever the job happens to run. It should also pace volume so that a new domain does not suddenly start sending hundreds of messages a day.
6. Handling replies
When a prospect answers, the agent reads the reply and decides what kind it is: interested, a question, "not now", "wrong person" or "stop emailing me". It can answer simple questions, offer meeting times or pass the thread to a person. An opt-out must be recorded and honoured every time, with no exceptions in the logic.
7. Reporting
Finally, the agent reports what happened: emails sent, opens, replies and meetings. The agent we built schedules each send for the prospect's time zone and reports opens back to the client. Treat opens as a rough signal. Replies and booked meetings are the measures that show whether outreach is working.
Where people should stay involved
Full automation is possible, but most businesses benefit from keeping people involved at a few specific points:
- Defining the target market and the offer. The agent carries out a strategy. It does not supply one.
- Reviewing early output. Read the first few dozen emails before you let the agent send without review. This is where you catch claims you would never make yourself.
- Taking over warm replies. Once a prospect is genuinely interested, a person is usually better placed to move the conversation towards a sale.
- Spot checks. Check a sample of sent emails and reply handling every week so that drift is caught early.
The rules the agent must follow
An agent sends email on your behalf, so its mistakes are your legal responsibility. The rules differ by region, and an agent prospecting internationally has to apply the right ones to each recipient. This is a summary, not legal advice.
United States: CAN-SPAM
The FTC's guidance says the CAN-SPAM Act covers commercial email and makes no exception for business-to-business messages. Requirements include:
- accurate header information
- subject lines that reflect the content of the message
- a clear statement that the message is an advertisement
- a valid physical postal address
Opt-out requests must be honoured within 10 business days, and any opt-out mechanism must keep working for at least 30 days after sending. The FTC states that each email that breaks the law can attract penalties of up to $53,088. It also says that hiring another company to handle your email marketing does not remove your legal responsibility. That applies equally to software acting for you.
United Kingdom: PECR and UK GDPR
The ICO's guidance separates "corporate subscribers" (such as companies and limited liability partnerships) from individuals. The PECR rule on marketing by email does not apply to corporate subscribers. You must still not hide your identity, and you must give a valid address where recipients can opt out. Sole traders and some partnerships are treated as individuals, so you can email them only with their consent or where the soft opt-in applies. The soft opt-in means you got their details during a sale or sale negotiation and are marketing similar products. An agent therefore needs to know the legal form of each business it contacts, not just its name.
Separately, UK GDPR applies to an individual's personal data even when it relates to their work. If you rely on legitimate interests, you must identify the interest, show the processing is necessary for it, and weigh it against the individual's rights. If you collect someone's details from another source, you must give them privacy information no later than one month after collection. They also have an absolute right to object to direct marketing.
European Union: GDPR and national e-privacy rules
Under the EU GDPR, Recital 47 recognises that direct marketing may be a legitimate interest, but each case needs its own assessment. Article 21 gives people the right to object at any time to direct marketing, including related profiling. Once they object, their data can no longer be used for that purpose. National rules also differ. Germany, for example, requires prior consent for unsolicited electronic marketing even between businesses, with a narrow exception for existing customers. Check the rules in each country you are targeting with a lawyer before turning the agent on.
What this means for the build
- A suppression list that every send checks first, shared across all campaigns and mailboxes.
- Reply classification that treats any opt-out wording as an opt-out, even when it is phrased informally.
- A record of where every contact came from, so you can answer "where did you get my details?"
- Country and entity-type rules applied before an email is written, not after.
- Footer content (address, opt-out route, privacy information) inserted by code, not left to the model.
Deliverability: the constraint most buyers underestimate
The fastest way to waste an AI sales agent is to send so much that mailbox providers start filtering you. Google's sender guidelines require everyone sending to Gmail accounts to set up SPF or DKIM authentication, use TLS and keep the spam rate shown in Postmaster Tools below 0.3%. Google recommends keeping it below 0.1%. Senders of 5,000 or more messages a day face extra requirements, including SPF, DKIM and DMARC together and one-click unsubscribe for marketing messages.
The practical consequences:
- Volume is not the goal. At a 0.3% limit, a handful of spam reports can be enough to cause problems. Fewer, better-researched emails protect the domain.
- Use a separate sending domain for outreach, so problems do not affect invoices and customer email on your main domain.
- Verify addresses before sending. A high bounce rate points to a poor-quality list.
- Monitor continuously with Google Postmaster Tools, and have the agent pause automatically if the signals get worse.
Off-the-shelf tool or custom agent?
Ready-made sales tools with AI writing and email sequences are quick to start with. They suit teams whose process fits the tool's assumptions. The trade-offs appear when you need something the tool does not do, such as:
- a research step specific to your market
- reply handling tied to your calendar and CRM
- compliance logic for the countries you sell into
- a data source the tool does not support
You also rent the workflow, and changing vendors can mean rebuilding it.
A custom agent takes more work to set up and needs someone to maintain it, but the research logic, prompts, suppression rules and integrations are yours. Khive builds custom AI agents in code and hands the system over, so the client owns it. That matters for outbound because the research and writing logic is where your knowledge of your market lives.
What to check before you commit
- Show me ten real emails. Ask for drafts written to real companies in your market. If you could swap the company name and the email would still make sense, the research step is not working.
- How are opt-outs handled? Ask to see the code or setting that stops an opted-out contact from ever being emailed again.
- Where does contact data come from? You need to be able to explain this to a prospect or a regulator.
- What can the model say? Confirm there are limits on claims, pricing and promises, and that legally required footer content is fixed.
- What happens when something goes wrong? Look for automatic pauses when bounces or complaints spike, and a clear log of every email sent and why.
- Who owns it? Check whether you keep the prompts, data and code if the relationship ends.
- How is success measured? Agree on replies and meetings, not the number of emails sent.
The short version
An AI sales agent takes over the repetitive parts of outbound: building the list, finding contacts, research, drafting, timing, first replies and reporting. Its value comes from the research step that makes each email specific. Its risks come from high sending volume and gaps in compliance. Whether you build or buy, put suppression, contact sourcing and deliverability controls in place from the first day, and keep people in charge of strategy, review and warm conversations. You can see how one works end to end in our AI sales agent case study.
If you are considering an AI sales agent for your own outbound, send us a brief. Tell us who you sell to, how you prospect today and which systems you use, and we will explain how we would approach it.