🤖 The rep says it is an AI (EU AI Act, Article 50)
Article 50 of the EU AI Act has applied since 2 August 2026. An AI agent that emails, messages or calls people must tell them two things: that it is artificial, and on whose behalf it is acting. Under the Act that duty falls on the provider of the agent, which is us, not on you.
What the product does. Any message the rep writes and sends with no person approving it ends with one plain line: “Written and sent by [your company]’s AI sales assistant. A person at [your company] reads every reply.” On WhatsApp and LinkedIn the same line appears in brackets. The phone rep says it in its opening sentence, in words, not a tone. Both required facts are in that one line: artificial, and acting for you.
What it does not do. A draft you read and approve in the Inbox is your message, sent under your name, and carries no line. The Act treats a human who genuinely reviews and sends as the sender. An approval queue nobody opens is not that, which is why review mode also nudges you when drafts pile up.
The line is on by default. Settings → Rep behaviour → “Say it is an AI when no person approved the message” turns it off, and the responsibility for that choice moves to you.
📮 Email: CAN-SPAM, GDPR and ePrivacy
Every email carries your legal name, your postal address and a one-click unsubscribe link, plus the List-Unsubscribe headers Gmail and Yahoo require. An unsubscribe is honoured in seconds: the person is marked do-not-contact, every sequence they are in stops, and waiting drafts to them are deleted.
GDPR and ePrivacy decide whether you may email a stranger at all; Article 50 does not change that. BOSRAI records where each contact came from and why they matched your audience, so you can answer “what is your lawful basis” with a record instead of a guess. A contact marked do-not-contact stays marked, whatever a later hunt finds.
France and Italy. Their regulators treat an open-tracking pixel as tracking that needs consent. For any contact we can place in either country, the email goes out as plain text with no HTML part, so there is no pixel and no rewritten link. You lose the open count for them and keep everything else.
💬 WhatsApp: consent first, and only in daylight
WhatsApp is a personal channel and the UAE, Saudi Arabia and Meta itself all treat unsolicited messages as spam. So the rep never opens a conversation on WhatsApp. A sequence cannot start with a WhatsApp step, and a WhatsApp step only goes to someone who has already engaged: they replied on any channel, accepted your LinkedIn invitation, clicked or visited, booked a call, or gave you their number themselves. Everyone else gets an email or a LinkedIn message at that step instead.
Every WhatsApp message says who is writing in its first line, ends with “Reply STOP and I will not message again”, and is sent between 07:00 and 21:00 where the person is. A STOP is honoured without a model in the loop. Numbers not on WhatsApp are discarded, and a dead number never counts against your account.
🔗 LinkedIn: inside the platform’s own limits
Connection requests and messages go out from your own account, paced across working hours, with a hard cap of 40 invitations a day and lower caps while an account is new. When acceptance falls below LinkedIn’s comfort line the rep rests the account rather than pushing on, because a restricted profile costs you more than a quiet week. Invitations are blank by default, which LinkedIn users accept more often and which keeps a pitch out of a place it does not belong.
📞 Voice: disclosed, requested, recorded
The phone rep only calls people who asked for a call from your booking page. It introduces itself as your company’s AI assistant in its first sentence, answers questions from the information you gave it, never invents a price or a commitment, and ends the call politely the moment someone says it is a bad time.
📉 Deliverability is compliance too
A burned domain is the fine nobody sends you. Sends are spread across the day, capped per mailbox, and paused automatically when bounces cross the line that hurts reputation. Catch-all addresses are parked rather than sprayed. Emails go out as plain text with a plain HTML twin, the way a person’s mail looks, not a marketing template.
🗂️ Your data, their data
Prospect data lives in your workspace only, is exportable at any time, and is deleted when you delete the workspace. Model providers are used under API terms that exclude training on your traffic. The full picture, including subprocessors and encryption, is on the Security page.
📖 The longer read
We read the Commission’s 51-page Article 50 guidelines so you do not have to: EU AI Act Article 50 and AI sales agents. The rules for every channel in one place, with the primary sources linked: the AI Outbound Compliance Handbook.
We are not lawyers and this page is not legal advice. It describes what the product does. If a rule changes or we have read one wrong, write to hello@bosr.ai and we will fix the product and this page.