The rulebook for letting AI contact customers first by voice, SMS and email: consent, contact hours, frequency caps, opt-outs, and the guardrails to test and audit.
Hannah Owen
·
Updated
The usual advice on proactive outreach is about reach: more channels, more touches, more automation, and the conversions will follow. That advice was written for marketing teams sending the same message to a segment. It holds up badly once an AI is deciding, customer by customer, whether to call, text or email someone. The hard part of letting AI contact customers first is not getting messages out. It is making sure the wrong message never goes out at all: at 10pm, to someone who opted out, for the fifth time this week, to a customer in hardship.
This is the operating rulebook for that job. It covers what each channel is good for, the consent and timing basics in the US, UK and Australia, the guardrails a system should enforce before every single message, and how to test and audit them. Lorikeet publishes this article and sells an AI account manager that does proactive outreach, so we have kept the rulebook general and put our own product in one clearly marked section. None of this is legal advice. Set your actual rules with your own counsel; the system's job is to enforce them every time.
Key takeaways
Proactive AI outreach is a decision problem, not a volume problem. The system that decides not to send is doing as much work as the one that sends.
Voice, SMS and email have different consent rules, different tolerances for frequency and different jobs. Treat them as one budget, not three.
In the US, the FCC ruled in February 2024 that AI-generated voices count as "artificial" under the TCPA, so AI voice calls carry the same consent requirements as prerecorded calls.
Six guardrails belong in front of every message: contact hours in the customer's time zone, cross-channel frequency caps, consent and channel preference, suppression after complaints or hardship, a reasoning log, and human handover.
Test each guardrail with deliberate edge cases and audit a sample of decisions, including the ones where nothing was sent.
What proactive AI outreach actually is
Proactive outreach means contacting a customer before they contact you: a failed payment, an application left half finished, a renewal coming up, a follow-up appointment nobody booked. Most teams already do a version of this with notification rules and lifecycle journeys. What changes with AI is who decides. A rules-based journey sends step three because step two happened. An AI that works toward a goal for each customer, what we call an AI account manager, reads the customer's situation and chooses whether to reach out, on which channel, with what, or not at all.
That freedom is the point, and it is also the risk. A journey can only do what someone drew on a canvas. An AI can do anything its rules allow, which means the rules carry the whole weight. For a broader view of where this fits, see our guide to proactive AI customer engagement.
Channel by channel: what each one is for
The three outreach channels are not interchangeable. Each has a job it does well, a consent profile and a point at which customers stop tolerating it.
Voice | SMS | ||
|---|---|---|---|
Best for | Complex or sensitive steps, anything that benefits from a back-and-forth, customers who have ignored written messages | Short, time-sensitive nudges with one clear action | Detail, documents, links, anything the customer may want to keep |
Intrusiveness | Highest: it interrupts | High: it lands on the lock screen | Lowest: it waits to be read |
US consent baseline | TCPA: prior express consent for artificial or prerecorded voice calls, including AI voices; written consent for telemarketing robocalls | TCPA: the FCC applies the same consent protections to autodialed texts as to calls to wireless numbers | CAN-SPAM: no prior consent required for commercial email, but a working opt-out is |
Timing sensitivity | Very high | High | Moderate |
Opt-out signal | Spoken request during the call | Reply keywords such as STOP, plus free-text replies | Unsubscribe link or reply |
Voice
Voice is the channel to use sparingly and well. It suits the customer stuck on identity verification, the member who needs to reschedule and would rather talk it through, or the policyholder with one missing document who has ignored three emails. It is the worst channel for routine reminders. Keep calls short, say who you are and why you are calling in the first sentence, and offer an easy way to stop future calls. Our AI voice and SMS support guide covers the support side of the same channels.
SMS
SMS gets read, which is exactly why it gets abused. Use it for one thing at a time: a link to finish an application, a confirmation, a heads-up about a failed payment. Make sure replies go somewhere. A text that invites a response and then ignores it is worse than no text. For the mechanics of two-way text, see how to do AI customer support over SMS.
Email is the patient channel. It carries detail, it can be forwarded to a partner or accountant, and it does not interrupt anyone's dinner. It is also where frequency creep hides, because each individual send feels harmless. Count email against the same contact budget as calls and texts.
The regulatory landmarks, carefully stated
These are the landmarks most teams start from. They are summaries, not a compliance programme, and state, sector and country rules can add to them. Have your own counsel turn them into rules for your business.
United States: TCPA and AI voices
The Telephone Consumer Protection Act restricts calls made with an autodialer or an artificial or prerecorded voice. On 8 February 2024, the FCC announced a Declaratory Ruling recognising that calls made with AI-generated voices are "artificial" under the TCPA. The ruling itself (FCC 24-17) says such calls "require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption." In plain terms: an AI voice is not a loophole. If your use case would need consent for a prerecorded call, it needs consent for an AI call. The FCC's consumer guide to unwanted robocalls and texts explains the consent rules for calls and texts more broadly.
United States: calling hours
Under the FCC's TCPA rules at 47 CFR 64.1200(c)(1), no telephone solicitation may be made to a residential subscriber "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)." Note two things. The rule is written for telephone solicitations, but most teams apply the same window to all proactive calls and texts as a matter of good practice. And the clock that matters is the customer's, not your contact centre's.
United States: CAN-SPAM for email
The FTC's CAN-SPAM compliance guide says commercial email must include a clear way to opt out, that you "must honor a recipient's opt-out request within 10 business days," and that the opt-out mechanism must work for at least 30 days after you send. Transactional and relationship messages are exempt from most of the Act, but the FTC reads those categories narrowly. A "your payment failed" email that also pitches an upgrade may not stay transactional.
United Kingdom: PECR and the ICO
In the UK, marketing by email and text falls under the Privacy and Electronic Communications Regulations. The ICO's guidance on electronic mail marketing says you must not send marketing emails or texts to individuals without specific consent, with a limited "soft opt-in" exception for your own previous customers. Service messages are treated differently from marketing, so classify each outreach type with counsel.
Australia: the Spam Act and the Do Not Call Register
The ACMA's guidance on the Spam Act 2003 sets three rules for commercial electronic messages, including SMS: get consent, identify yourself as the sender, and make it easy to unsubscribe. The unsubscribe option must be honoured within 5 working days and work for at least 30 days after the message is sent. For telemarketing calls, the Do Not Call Register lets people list their numbers, and callers can "wash" their lists against it before calling.
The six guardrails to enforce before every message
Laws set the floor. The guardrails below are what turns that floor into something a system can enforce on every message, in real time, without a person checking each one. They should run before the message is generated and sent, not as a report afterwards.
1. Contact hours in the customer's time zone
Store a time zone for every customer, derived from their address or account settings rather than their phone number's area code, which can be years out of date. Set separate windows per channel: a calling window inside your legal limits, a narrower one for texts, and a looser one for email. Block outreach on public holidays where you can. If the system cannot determine a time zone, it should hold the message, not guess.
2. Frequency caps across all channels
A customer does not experience "two emails, two texts and a call" as three acceptable channel budgets. They experience five contacts. Set caps per day, per week and per month that count every channel together, plus a minimum gap between any two contacts. Support conversations the customer started should not count against the cap, but outreach about the same issue should.
3. Consent and channel preference
Track consent per channel and per purpose, with its source and date. Honour opt-outs on the channel they arrived on immediately, and decide with counsel whether an opt-out on one channel should apply to others. Respect the customer's preferred channel even when another would convert better.
4. Suppression after complaints, hardship or vulnerability
Some signals should stop proactive outreach cold: an open complaint, a declared hardship arrangement, a bereavement, a fraud report, or anything your team flags as vulnerability. In digital health, anything clinical goes to a clinician, not to an outreach sequence. The system must read these signals before each message, including signals from support conversations.
5. A reasoning log for every decision
Every decision, including "do nothing", should be logged with the inputs it used and the reason in plain language: "Did not text. Customer has an open complaint opened Tuesday." Without it you cannot answer a regulator, a complaints team or the customer.
6. Human handover
Some next steps belong to people. When the AI hits one, it should create a task for your team with the context attached and stop contacting the customer about that issue until a person has acted.
Guardrail, why it matters, how to test it
Guardrail | Why it matters | How to test it |
|---|---|---|
Contact hours | Out-of-hours contact breaks calling rules and trust | Create test customers in several time zones, including one with no time zone set, and trigger outreach at 7:55am and 9:05pm their time |
Cross-channel caps | Over-contact drives opt-outs and complaints | Fire several triggers for one customer in an hour across email, SMS and voice; confirm only the capped number goes out |
Consent and preference | Contact without consent is the core legal exposure | Opt a test customer out by replying STOP, then trigger every channel; check what is blocked and how fast |
Suppression | Outreach during hardship or a complaint causes real harm | Open a complaint or hardship flag on a test customer mid-journey and confirm outreach halts |
Reasoning log | You cannot defend decisions you cannot read | Pick 20 random decisions, including non-sends, and check each has a reason a non-engineer understands |
Human handover | Some situations need a person, not another message | Simulate a request to speak to someone and confirm a task is created with context and outreach pauses |
How to audit proactive AI outreach
Testing proves the guardrails work on the cases you thought of. Auditing catches the ones you did not.
Sample weekly. Read a random sample of decisions every week, split between messages sent, messages blocked and decisions to do nothing.
Reconcile against the rules. For each sent message, confirm the time, the consent record and the cap count at the moment of sending.
Watch the leading indicators. Track opt-out rates, complaint rates and STOP replies per channel. A rise is the first sign a rule is too loose.
Review handovers. Check that tasks reached a person and the customer was not contacted in the meantime.
Measure against a holdout. Compare goal outcomes for customers who got outreach with a random group who did not. If the goal does not move, more contact is only cost and risk.
Re-check after every rule change. Re-run the test suite above whenever counsel or your team changes a rule.
Example: how Lorikeet Dreamweaver applies these guardrails
For a concrete example, here is how our own product handles this. Lorikeet Dreamweaver increases customer lifetime value by giving every customer their own account manager. You set long-term goals such as activation, retention, conversion or lifetime value, and every customer gets their own Dreamweaver that works toward those goals over weeks and months.
Dreamweavers wake on a schedule and when something changes for a customer. The next step can be a message on the channel the customer prefers across voice, SMS and email, a task for your team, or no action at all. Contact hours, limits and consent are checked before every message, and every decision is logged with the reasoning behind it. Because Dreamweavers are built into the Lorikeet Concierge, they share context with support conversations, so a customer who complained yesterday is not chased today. A built-in holdout group measures whether the outreach moved the goal. There is no separate charge: Dreamweavers are billed as touches and conversations at your existing rates (see pricing).
Getting started
Start with one goal and one channel. Write down, with counsel, the rules a careful human would follow: the hours, the caps, who must never be contacted and when a person takes over. Then build the test cases in the table above before the first real message goes out, and read the decisions for the first few weeks, not just the dashboard.
If your outreach rules live in a spreadsheet and nobody is sure they are applied to every message, we should talk. You can get a demo, or try Dreamweaver with a 30-day free trial.
Frequently asked questions
Can AI legally call customers in the US?
It depends on consent and purpose. In February 2024 the FCC ruled that AI-generated voices count as artificial under the TCPA, so AI voice calls need the same prior express consent as prerecorded calls unless an emergency purpose or exemption applies. Teams should set their own rules with counsel.
What hours can you contact customers by phone in the US?
FCC rules under the TCPA bar telephone solicitations to residential subscribers before 8am or after 9pm, local time at the called party's location. Many teams apply the same window, or a narrower one, to all proactive calls and texts, measured in the customer's own time zone.
Does CAN-SPAM require consent before sending email?
CAN-SPAM does not require prior consent for commercial email, but it does require a clear opt-out. The FTC says opt-out requests must be honoured within 10 business days and the mechanism must work for at least 30 days after sending. UK and Australian rules are stricter on consent.
How often should AI contact a customer?
There is no single right number. Set caps per day, week and month that count every channel together, plus a minimum gap between contacts, then tune them against opt-out and complaint rates and a holdout group. Fewer, better-timed contacts usually beat more.
What guardrails should proactive AI outreach have?
At minimum: contact hours in the customer's time zone, cross-channel frequency caps, consent and channel preference checks, suppression after complaints or hardship, a reasoning log for every decision including decisions not to send, and a handover to a person when the situation needs one.
How do you audit an AI that contacts customers?
Sample decisions weekly, including messages blocked and decisions to do nothing. Reconcile sent messages against consent, time and caps at the moment of sending, track opt-out and complaint rates per channel, check handovers reached a person, and measure outcomes against a holdout group.
