How to run an AI SDR safely: protect your domain and follow the rules
This is not legal advice. This playbook covers the email and phone rules in primary sources, what AI SDR vendors say on their own pages about opt-outs and approvals, and a set of operating steps. The steps are our suggestions. The thresholds from Google and Yahoo are theirs. Where a number is yours to set, we say so and leave it blank. We invent no benchmarks.
You stay responsible
Hiring a vendor does not move the duty. The FTC’s CAN-SPAM guide says you “can’t contract away your legal responsibility” and that the company that sends the message may also be held responsible (FTC). The guide does not mention AI senders. Our reading: an AI SDR that sends email is, on the face of the guide, a sender like any other, and the business whose product is promoted stays on the hook.
Vendors say the same in their own terms. Regie.ai’s terms say you must send commercial email in compliance with CAN-SPAM and state law, and that you are “solely responsible” for calling-law compliance (Regie.ai terms). 11x’s docs say the lawful basis for contacting a person on a channel is yours (11x docs).
The rules and thresholds
| Source | What it says | Status |
|---|---|---|
| CAN-SPAM guide | Covers all commercial email, including business to business. Every message must say how to opt out, say it is an ad, and give a valid physical postal address. Honor opt-outs within 10 business days. | Page shows “August 2023”, edited January 2024. Live. |
| Google sender rules | All senders authenticate (SPF or DKIM), have valid DNS records and TLS, and keep Postmaster Tools spam rate below 0.30%. Target below 0.10%. Bulk means more than 5,000 messages a day to Gmail accounts. Bulk marketing mail must support one-click unsubscribe. | Live. Our copy of the page states no unsubscribe time limit. |
| Yahoo sender rules | Spam rate below 0.3%. Bulk senders need SPF, DKIM and a DMARC policy (at least p=none), a working list-unsubscribe header, and must honor unsubscribes within 2 days. | Page says enforcement began in February 2024. Yahoo gives no number for “bulk”. |
| FCC 24-17 | AI-generated voices are “artificial” voices. The caller needs prior express consent, and prior express written consent for advertising or telemarketing. | In force. |
| FCC 26-67 | Changes consent revocation rules: for informational robocalls (no ad, no telemarketing), a revocation may be read as covering only that category; for ad or telemarketing calls, a revocation covers all such calls from that caller. Callers may also designate an exclusive revocation method from three listed ones. | Adopted 2026-09-30. Comment dates are tied to Federal Register publication, which we did not see. |
Two readings follow. First, Yahoo’s 2 days is stricter than CAN-SPAM’s 10 business days, so a process built to the Yahoo number also meets the FTC one. Second, the email sender rules apply whether a person or AI writes the message. The FCC rows separately address AI voices and robocall consent. For when to tell people it is an AI, see our disclosure guide.
Domain basics, and whose domain it is
The primary sources support only the basics: authenticate with SPF and DKIM, add DMARC (Yahoo asks for at least p=none for bulk senders), keep DNS valid, use TLS, and watch your spam rate.
The reputation you risk is yours. Artisan says Ava sends in your reps’ names “from your own sending domains” (Artisan pricing) and manages warm-up, send throttling and bounce monitoring automatically (Artisan). Regie.ai sends from your own connected account, “not a vendor domain we rent you” (Regie.ai). 11x bundles domain setup, warm-up and inbox rotation into its plans (11x pricing). AiSDR lists a $33 charge per mailbox setup (AiSDR).
Our suggestion, not a source claim: keep cold outreach off the domain that carries your invoices and customer replies.
What vendors say about opt-outs and approvals
| Vendor | Approval controls, per its pages | Opt-out and suppression, per its pages |
|---|---|---|
| 11x | Three levels: review every message (“Nothing sends unseen”), a named approver, or autopilot with “No per-message approval”. The docs advise autopilot “only after you have validated output on that segment” (docs). | Exclusions are read from your CRM. Docs recommend treating opt-out as global and mention an opt-out portal (docs). Its regional page names US TCPA, GDPR and CASL; CAN-SPAM is not named (docs). |
| HubSpot Prospecting agent | You have the option to review and edit drafts before they are sent each time you enroll contacts; fully autonomous mode “sends emails without requiring review first”. Outreach guardrails are configurable per play (agent page), and credits can be capped per feature and action (HubSpot credits). | Opt-out handling not stated on the pages we read. |
| Artisan (Ava) | Approve before sending, lock tone, banned phrases; the same FAQ says “Autonomous by default, adjustable by design” (pricing, Businesses & Enterprises tab). Another page says most teams start with approvals enabled (Artisan). Exclusion and DNC lists for domains and accounts Ava never touches (home). Calls are queued for human reps, not placed by Ava (Artisan). | Unsubscribe handling not stated on the pages we read. |
| Regie.ai | You read every draft before it goes out (outbound page). | Says sending is throttled with unsubscribes handled (pricing); a do-not-call list blocks calls before they are placed (dialer). |
| AiSDR | You review and approve the campaign before launch (pricing). | Opted-out contacts go to suppression (security page). |
| Salesforce sales agents | “Suggestive or Autonomous Mode” for opportunity updates; guardrails for outreach (Salesforce). | Opt-out handling not stated on the pages we read. |
| Qualified (Piper) | An “Agent handoff” feature is listed from the Enterprise plan; the page does not say what it hands off to, and describes no approval-before-send mode (pricing). | Not stated. |
“Not stated” means the pages we read were silent, not that the feature is missing. Ask in the demo.
The playbook
1. Clean the list first. Know where each contact came from. Vendor databases are big (Artisan claims 250M+ contacts, 11x claims 400M, both vendor claims), but you cannot tell from a number how they were collected. Ask. Remove customers, partners, open deals, competitors and anyone on your own do-not-contact list before the first send. Verify addresses.
2. Authenticate before you send. SPF, DKIM, DMARC, valid DNS, TLS. Confirm each works with a test message.
3. Ramp volume in stages you define. Start small and move up only when the gates hold. Fill in the table.
| Stage | Daily cap | Who reviews | Move up only if |
|---|---|---|---|
| 1 | [you set] | Human, every message | Spam rate under 0.10%; every opt-out honored inside 2 days; bounces under [your limit] |
| 2 | [you set] | Human, sampled | Same gates, plus edit rate falling |
| 3 | [you set] | Exceptions only | Same gates for [your period] |
Plan around Google’s 5,000-a-day line: Google states it as messages to Gmail accounts, so check how your sending is counted.
4. Run an approval-first period. Every message is read by a person. Record how often the reviewer changes a draft and why. Leave this stage only when you have written exit criteria. Autonomy is a setting you grant, per message type, after evidence.
5. Build one suppression list. One list across every tool, sourced from the CRM. Treat opt-out as global, as 11x’s docs suggest. Treat free-text replies (“stop”, “remove me”) as opt-outs, not as objections to handle. A person owns the list.
6. Handle replies by category. Sort replies into interested, not now, out of office, opt-out, complaint, legal, and other. Let the AI handle only the categories you have approved. Send complaints, legal language and anything unusual to a human. Treat reply text as untrusted: OWASP warns that instructions hidden in content a model reads can alter its behavior (OWASP LLM01).
7. Install a kill switch, and test it. Decide who may stop all sending, and how. Pausing one campaign is not enough: queued follow-ups, other mailboxes and call tasks need to stop too. A spend cap is not a kill switch. Artisan pauses new enrollments when credits run out (Artisan pricing), and HubSpot offers feature- and action-level credit limits (HubSpot credits), but both are budget controls. Run a drill and time it.
8. Review deliverability weekly. Same day each week, same owner, written down.
Metrics to watch
| Metric | Where | Line |
|---|---|---|
| Gmail spam rate | Postmaster Tools | Below 0.30% required; aim below 0.10% (Google) |
| Opt-out processing time | Your suppression log | Within 2 days (Yahoo, for bulk senders); 10 business days is the FTC’s limit for commercial email |
| Bounce rate | Sending tool | [your limit] |
| Complaints and angry replies | Inbox | Read each one; count them |
| Opt-outs per 100 sends | Sending tool | [your trend line] |
| Draft edit rate | Approval log | Falling over time |
| Replies by category | Sending tool | Watch the share of opt-outs and complaints |
| Meetings booked, and confirmed real by a person | CRM | See our payback playbook |
| Consent on file for AI-voice call targets | CRM | Every target |
Do not trust vendor result claims, such as a customer’s reply rate on a vendor homepage, as your baseline. Measure your own.
Related reading
- Best AI SDRs of 2026: top picks, prices and compliance
- Artisan review (2026): what Ava does, costs and leaves to you
- 11x review (2026): pricing, Outbound, Inbound and the digital worker pitch
- Do you have to tell people they are talking to an AI? What the rules say
- Security questions to ask before giving an AI employee your inbox
Frequently asked questions
Who is responsible if an AI SDR breaks the rules?
You are. The FTC’s CAN-SPAM guide says you can’t contract away your legal responsibility, and that the company that sends the message may also be held responsible. Vendors say the same in their terms: Regie.ai says you are solely responsible for calling-law compliance, and 11x says the lawful basis for contacting a person is yours.
What deliverability numbers should I watch?
Google requires a Gmail spam rate below 0.30% and says to aim below 0.10%. Yahoo’s rule for bulk senders is to process opt-outs within 2 days; the FTC’s limit for commercial email is 10 business days.
Should cold outreach use my main domain?
Our advice, not a sourced rule: keep cold outreach off the domain that carries invoices and customer replies.
Which metrics should I track?
Gmail spam rate, opt-out processing time, bounce rate, complaints and angry replies, opt-outs per 100 sends, draft edit rate, replies by category, meetings confirmed real by a person, and consent on file for AI-voice call targets.