Jorge LewisDisclosure: GTM Bud is our product and sells AI-run outreach, the category this article discusses. We quote vendors and regulators with attribution and call the open questions open.
Do you have to disclose AI in sales outreach? Based on the legal coverage published so far, the answer splits on one line. A one-way email or LinkedIn message that AI drafted and a human account sent carries no recipient-facing disclosure duty that any major reading we could verify identifies. An AI agent that converses with the prospect on its own, in chat or in autonomous reply handling, sits inside disclosure rules that became enforceable in 2026. This article walks through the EU AI Act readings, California’s bot statute, and Utah’s on-request rule, names who published each reading, and covers what vendor default-disclosure settings mean for your brand before an AI SDR pilot.
We answer this as operators, not observers. Our parent agency, Referral Program Pros, has booked more than 7,000 meetings across 4,000+ outbound campaigns, and GTM Bud is built on that playbook with a written guarantee behind it: 5 percent positive replies on LinkedIn or 1.5 percent on email, or a full refund. A guarantee priced in replies forces you to track every rule that could touch a sequence, because a compliance surprise mid-campaign is a refund waiting to happen.
This is an operator’s reading, not legal advice. We are outbound practitioners, not lawyers, and the rules below are young, jurisdiction-specific, and still being interpreted. Have counsel review anything load-bearing before you rely on it.
The drafted-versus-interactive line decides almost everything
An AI disclosure in sales outreach is a statement telling the recipient that AI wrote the message or is running the conversation. Whether you owe one turns on how the AI is used, not on whether you used AI at all. Across every reading we verified, from EU AI Act law firm analyses to California’s statute text, the same split appears: AI that drafts a message a human reviews and sends is treated as a writing tool, while AI that interacts with the prospect directly, answering questions, handling objections, booking the meeting, is treated as a system the recipient has a right to recognize. Deliverability vendor Warmy’s analysis of the EU AI Act states that the common belief that every AI-personalized cold email will require a disclosure line does not align with the actual regulation. The duty concentrates on interactive agents, which is exactly where AI SDR products are heading.
That makes the first step of any compliance review a workflow inventory, not a legal memo. List which parts of your outbound are drafting and which are conversation. If you are still mapping what the category even does at each layer, our explainer on what an AI SDR is draws those boundaries, and our breakdown of how an AI cold email writer works covers the drafting side in detail.
What does the EU AI Act say about AI sales outreach?
The EU AI Act’s Article 50 transparency obligations became enforceable on August 2, 2026, and law firm coverage from Baker Botts notes they apply regardless of whether a system is classified as high-risk, with penalties reaching 15 million euros or 3 percent of worldwide annual turnover. Three provisions matter for outreach, and each lands on a different actor.
Interactive systems, Article 50(1). Systems intended to interact directly with people must make clear that the person is dealing with AI, unless that is obvious from the circumstances. The duty falls on the provider of the system, per the law firm coverage above, and commentary on the European Commission’s guidelines of 20 July 2026 reports that the “obvious” exception is read narrowly: regulators do not assume a user should have known. This is the provision that touches AI SDR chat and autonomous reply handling.
Synthetic content marking, Article 50(2). AI-generated content must carry machine-readable marking, and that duty also sits with the AI provider, not with the sales team deploying the tool. The same coverage reports a transition period: providers of systems already on the market before August 2, 2026 have until December 2, 2026 to implement the marking.
AI-generated text, Article 50(4). The deployer-facing text rule applies to text published with the purpose of informing the public on matters of public interest. Both Warmy and consultancy Something Inc read ordinary commercial sales email as outside that category, since a pitch is not public-interest publishing.
Not every reading is that relaxed. Smartlead’s compliance piece describes the Act as adding new transparency rules for AI-generated outreach from August 2026, a broader framing than the provision-by-provision readings above, and MarketBetter has described disclosure lines becoming routine practice. When the readings disagree, print both and let counsel arbitrate for your specific workflow. The authoritative text is the regulation itself in the Official Journal, and it is more readable than its reputation suggests.
Does California require you to disclose a bot?
California already answered the interactive question in 2018, years before the AI SDR category existed. Business and Professions Code section 17941, enacted as SB 1001 and often called the B.O.T. Act, makes it unlawful to use a bot to communicate or interact with a person in California online, with the intent to mislead them about its artificial identity, in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote. The statute contains its own safe harbor: a person using a bot is not liable if the bot’s status is disclosed in a manner that is clear, conspicuous, and reasonably designed to inform the recipient.
Two scope details matter for outbound teams, both drawn from WilmerHale’s analysis of the statute and the statute’s definitions. First, “online” is defined through “online platform,” a public-facing website or application with 10 million or more monthly unique visitors or users in the United States for a majority of the preceding 12 months. That definition reads private email inboxes as a weak fit and large social platforms, LinkedIn among them, as the clear target. Second, the trigger is a bot communicating with intent to mislead about its artificial identity, which is why a conversational AI agent working California prospects on a major platform without disclosure is the pattern that maps onto the statute, while an AI-drafted message sent by a human account does not involve a bot conversing at all. A 2025 amendment, AB 410, would have tightened the definitions, but tracker listings disagree on its status, between dead and held in committee, and it has not become law as of this writing.
Utah adds a narrower rule. Coverage from law firm Davis Wright Tremaine explains that Utah’s Artificial Intelligence Policy Act requires a business using generative AI to interact with a consumer in a regulated consumer transaction to disclose that fact when the consumer asks, with fines up to $2,500 per violation, and later coverage of the 2025 SB 226 amendment reports the trigger narrowed to a clear and unambiguous request. B2B outreach to work addresses is not that statute’s center of gravity, but teams selling into Utah consumers should put it in front of counsel.
Here is how the verified readings distribute the duty across outreach modes:
| Outreach mode | Disclosure duty as read by the coverage | Where the duty sits | Named source |
|---|---|---|---|
| AI-drafted email, human-reviewed, one-way | None identified; public-interest text rule read as inapplicable | Not triggered | Warmy, Something Inc |
| AI-drafted LinkedIn message sent by a human account | None identified; no bot conversing | Not triggered | Statute text, WilmerHale |
| Interactive AI agent chatting or handling replies (EU) | Must make clear the person is dealing with AI | AI provider, per Article 50(1) | Baker Botts coverage of Article 50 |
| Bot conversing with a California buyer on a large platform | Disclose bot status or risk liability | The person using the bot | B&P Code 17941, WilmerHale |
| Generative AI in a Utah consumer transaction | Disclose when clearly and unambiguously asked | The business using the AI | Davis Wright Tremaine coverage |
What do vendor default-disclosure settings mean for your brand?
Some vendors have already decided this question for their customers, and the defaults diverge widely. Workspace software company OfficeRnD states in its help documentation that AI disclosure is on by default for every organization and that organizations operating in the European Union cannot turn it off. AI sales vendor SalesApe takes the opposite stance: its help page describes an optional AI identity disclosure toggle and says the tool is optional and the customer is responsible for deciding whether to use it based on their own compliance needs. Same category, same regulation, opposite defaults.
For a buyer, the trade-off is concrete. A locked-on disclosure means a vendor’s compliance posture speaks in your brand’s voice in every conversation, whether or not your counsel believes the duty applies to your workflow. A fully optional toggle means the vendor has shifted the legal judgment, and the liability analysis, onto you. Neither default is wrong, but you should know which one you are buying before the pilot starts, not after a prospect forwards a disclosure line you did not know your tooling was sending.
So add three questions to your diligence script. First, which parts of this product draft and which parts converse, in the Article 50 sense of interacting directly with the prospect. Second, what disclosure does the product insert, where, by default, and who can change it. Third, which transparency duties does the vendor accept as provider and which does it push to you as deployer, in the contract rather than in a sales call. A vendor that answers all three crisply understands its own regulatory position; a vendor that waves at “we’re compliant” does not. These belong alongside the deliverability and reply-handling questions in our guide to evaluating an AI SDR before you buy.
Disclosure does not replace the rules you already have
Nothing in the AI Act readings, the California statute, or the Utah statute changes your existing obligations. Your lawful basis for processing, consent requirements by country, sender identification, and opt-out handling sit exactly where they always sat, and they apply identically to AI-drafted and hand-written messages. We cover those rules jurisdiction by jurisdiction in our guide to whether cold email is legal under GDPR and CAN-SPAM, and none of its conclusions move because a model drafted the copy.
The disclosure question is also separate from the perception question. Whether prospects can detect AI writing, and what they actually judge when they read a cold message, is its own evidence base, and we examined it in can prospects tell if AI wrote your cold email. The short version: recipients judge research depth, not authorship, which means a legally required disclosure and a reply-worthy message are solved by different work. One is a sentence; the other is a targeting and research system.
Frequently asked questions about disclosing AI in outreach
Do you have to disclose AI when sending LinkedIn outreach?
No statute names LinkedIn specifically, but the channel matters. Legal coverage of California’s bot statute reads large public platforms as the kind of venue the law reaches, so an AI agent conversing with a California prospect on LinkedIn without disclosure is the riskier pattern. An AI-drafted connection request or InMail reviewed and sent through a human-owned account is drafting, not bot conversation, under the readings we verified. LinkedIn’s platform terms separately restrict automation, and those contractual rules apply whether or not any statute does.
What should an AI disclosure actually say when you do need one?
The California statute text says a disclosure must be clear, conspicuous, and reasonably designed to inform the person that they are communicating with a bot. In practice, vendors that disclose use one plain sentence, such as stating that the assistant is an AI system and that a human can take over on request. Do not bury it in a signature block or a terms link. The statutes and the EU AI Act readings both target the recipient actually knowing, not a technical footnote that no one reads.
Who is liable if an AI SDR vendor fails to disclose, you or the vendor?
Both can be exposed, on different hooks. Law firm coverage of EU AI Act Article 50 places the disclosure duty for interactive systems on the provider, the party that builds the system and places it on the market, while warning that deployers keep obligations of their own and cannot contract everything away to the vendor. The California statute attaches liability to the person using the bot. Treat the split as a diligence question for any AI SDR for a small business: ask the vendor in writing which duties it takes on and which stay with you.
Does CAN-SPAM or GDPR require you to say an email was written by AI?
No. Neither law mentions AI authorship. CAN-SPAM regulates deceptive headers, subject lines, identification, and opt-outs, and GDPR regulates the lawful basis for processing personal data. Those obligations apply identically whether a human or a model drafted the message, which means an AI cold email writer has to meet exactly the same header, opt-out, and lawful-basis standards as a human writer. AI changes who typed the words, not which rules the message must satisfy.
Does adding an AI disclosure line hurt reply rates?
We could find no controlled public data measuring reply rates with and against a disclosure line, so anyone quoting a number is guessing. What the available evidence does show is that recipients judge research depth, not authorship: a message that proves someone did the work gets read, and a generic one gets archived, disclosure line or not. If a disclosure duty applies to your workflow, comply with it and spend your optimization effort on targeting and message relevance, which is where replies are actually decided.
Honesty and targeting keep you out of trouble, not a disclosure string
Step back from the provisions and the question of whether you have to disclose AI in sales outreach gets simpler, because every regime in this article punishes the same thing: deception. California’s statute triggers on intent to mislead. The EU AI Act’s interactive rule exists so people know who they are talking to. Utah’s rule exists so a consumer who asks gets a straight answer. A team that targets prospects its product can genuinely help, makes claims it can verify, and answers honestly when asked how its outreach runs is already aligned with where all of these rules point, and a team that blasts deceptive volume will not be saved by a disclosure string. The decisions that keep outreach out of trouble are targeting and honesty decisions, made long before any sentence about AI gets appended.
That is the posture GTM Bud is built around: AI does the research and drafting, the claims trace to real sources, and the results carry a written guarantee of 5 percent positive replies on LinkedIn or 1.5 percent on email, backed by a full refund. If you want that run for you, on the playbook behind 7,000+ booked meetings, start with done-for-you outbound and bring this article’s three diligence questions to the first call.