Do You Have to Disclose AI-Generated Emails to Customers? A Practical Policy for Sales Teams
In general, no: if a person reads an AI-drafted email, edits it where needed and sends it under their own name, it is ordinary business correspondence, and you are not usually required to label it as AI-written. Disclosure becomes a real question when customers interact directly with an AI system, for example a chatbot or an automatic reply that nobody checks, or when you would otherwise mislead them about who they are dealing with.
This article explains the difference in plain terms, lists the situations where you should say more, and gives you a short internal policy and sample wording. It is general guidance, not legal advice. For specific sectors, contracts or edge cases, check with a lawyer.
Why the answer depends on who is talking to the customer
The EU AI Act includes transparency ideas aimed mainly at situations where a person is interacting directly with an AI system, or where content is generated or manipulated in a way that could deceive. The common thread is simple: people should not be misled into thinking they are talking to a human when they are not.
A sales email that a colleague has checked and sent is a different thing. The sender is a real person, the commitments in it are theirs, and the customer can reply to that person. The AI was a drafting aid, in the same way a template, a spellchecker or a junior colleague's first draft would be.
The test to keep in mind: is there an accountable human who reviewed the message and stands behind it? If yes, you are in ordinary correspondence territory. If the message goes out with no human involved, treat it as a different case.
When you should disclose or say more
Even if a plain AI-drafted email needs no label, there are situations where being open is either expected or simply wise.
1. Customers talk to a bot
A chat widget or automated responder that answers on its own should make clear it is an automated system. Do not give it a human name and photo and let people assume otherwise.
2. Nobody reviews what is sent
Fully automatic replies are the high-risk end of the scale. If you run any, label them as automated and give a route to a person.
3. The customer asks
If someone asks directly whether AI was involved, answer honestly. Do not deny it, and do not dodge.
4. Your contracts or the customer's rules say so
Some tenders, procurement policies and client contracts include clauses about AI use or confidentiality. Read them before you paste anything into a drafting tool. This is where a lawyer's opinion is worth having.
5. Personal data is involved
Drafting from customer history means personal data is processed. That is a GDPR matter, not a labelling matter: you need a lawful basis, a clear privacy notice and a processor agreement with your vendor. Our article on customer history in AI-drafted replies covers what to feed in and what to leave out.
What GDPR adds, whether or not you label anything
Labelling is only one question. The more practical one is what happens to the data in the enquiry. Your privacy notice should describe, in plain words, that you use service providers to help prepare correspondence. You should know where the tool stores data, which provider's model processes the text and whether that provider uses it for training.
Note that an EU server answers only the storage question. It does not tell you where the language model processes the text. We explain how to read those claims in AI EU server hosting: what it covers and what it doesn't. For a full vendor checklist, see Is an AI sales tool GDPR-compliant?, and for a wider view, how to choose an EU-hosted AI sales assistant.
A five-point internal policy you can adopt this week
Put this on one page and share it with everyone who writes to customers.
- A human approves every outgoing message. Nothing leaves the building because a tool wrote it. The sender owns the content, prices, dates and promises.
- Check facts before sending. Names, quantities, dates, availability, prices and scope are verified against your own records, not trusted because the draft sounds confident.
- Keep confidential material out. No messages covered by an NDA or a client restriction go into a drafting tool until you have checked what is allowed. See confidential enquiry and NDA handling.
- Never deny AI use. If a customer asks, answer truthfully and briefly.
- Label anything automatic. Bots and unattended auto-replies say that they are automated and offer a way to reach a person.
Review the policy when you change tools or when a client contract adds new terms.
Sample wording you can reuse
If a customer asks whether AI was used
Hi Anna, good question. We sometimes use software to help prepare first drafts of our emails. Every message is read, checked and sent by a member of our team, and the details in it are ours. If you would prefer to deal with a specific person on everything, just say so and we will arrange it.
Optional line for your website privacy notice
We use service providers, including software that helps prepare draft correspondence, to handle enquiries. Messages are reviewed and sent by our staff. Personal data in enquiries is processed only as needed to respond to you.
Label for an automatic acknowledgement
This is an automated message confirming we have received your enquiry. A member of our team will reply personally.
Adjust the tone to your brand, and ask a lawyer to review the privacy notice wording if you handle sensitive data.
How BOTrento handles this
BOTrento Chief of Staff is built around the human-approval principle. It watches enquiries and quotes in your mailbox and uploaded data, then prepares draft replies, quotes and follow-ups in four languages. It never sends anything itself: a person approves every draft. You can see the process in the demo, and read more on the Chief of Staff page.
On data: we store data on servers in Germany (EU), and the text needed for a task is processed by a commercial model provider through its API, by default through our account or optionally through your own key. A server in the EU that calls an external AI API is not a closed computation, and we do not claim otherwise. Details on keys are in the API keys help page.
AI use is included in the plan with a monthly consumption limit. You can try it for 14 days free, with no card and no API key of your own. The 14 days start when you first upload data, so you test it on your real enquiries. Not sure what it costs? See the pricing page or what an AI sales assistant costs a small business.
FAQ
Do I need to disclose AI-written emails to customers?
Generally not when a person reviews the draft and sends it under their own name, because it is ordinary correspondence for which that person is accountable. Disclosure matters more for bots and unattended automatic replies, and when a customer asks directly. Check specific contracts and sectors with a lawyer.
Does the EU AI Act require a label on AI-drafted sales emails?
The AI Act's transparency ideas focus mainly on people interacting directly with AI systems and on content that could mislead. A human-reviewed email from a named sender is a different situation, but rules and guidance evolve, so confirm your own case with a lawyer.
Is using AI to draft customer emails a GDPR issue?
Yes, if the drafts use personal data such as names, email addresses or customer history. You need a lawful basis, an accurate privacy notice and a processor agreement with your vendor, and you should know where the data is stored and processed.
What should I say if a customer asks whether AI wrote the email?
Answer honestly and briefly: say you use software to help prepare drafts and that a member of your team reviews and sends every message. Never deny it.
Summary
- A human-reviewed AI draft sent under a named person's name is generally ordinary correspondence, not something you must label.
- Be explicit about automation when customers talk to a bot or receive unattended automatic replies, and answer honestly if asked.
- GDPR matters more than labelling: lawful basis, privacy notice, processor agreement, and clarity on where data is stored and processed.
- Adopt a one-page policy: human approval, fact-checking, no confidential material, no denial, labelled automation.
- This is general guidance; ask a lawyer about contracts, tenders and sensitive sectors.
Try BOTrento free for 14 days
Start your 14-day free trial on your own data. Nothing is sent without your approval, and our team will get back to you within 24 hours on working days to help connect your mailbox. Fill in a few details and your access arrives by email right away. We are happy to help you connect your mailbox.
14 days free, no card and no API key of your own. The trial starts only once your data is first loaded. Then from €79 per month excl. VAT, AI included.
Nothing is sent without your approval. You add a card at the end, only if you continue; without payment access is blocked until you pay, we keep your data for 30 days and the export stays available. Pricing · See the process demo
Thank you, we have your sign-up.
We have sent a sign-in link and first steps to your email. If it does not arrive within a few minutes, please check your spam folder.