New Customers

Questions this playbook answers

• Why does most AI-written outreach read as fake, even when the writing is good?
• What should an AI SDR actually decide, and what should it never decide?
• What do we need to know about a prospect before we are allowed to be specific?
• Which deliverability and consent rules shape cold outreach now?
• How do we prove researched outreach beats volume, and how long will it take?

The moment

Larkspur Systems is a fictional composite company used throughout this handbook. Its numbers are illustrative.

Six weeks after Larkspur paused its AI SDR pilot (Chapter 6), the CRO put two emails on the conference-room screen.

The first was the pilot's best-rated message from the spring: 140 words, warm, fluent, with a second sentence congratulating an HVAC operations director on an acquisition her company never made (Chapter 15). The second was a note one of Larkspur's senior SDRs had written by hand two years earlier to a regional utility. Four sentences. It said that the utility had just posted three dispatcher roles for a new service territory, that bringing a second dispatch team online before storm season is where most fleets lose a month, and asked whether that was on her list. No flattery, no "companies like yours." She had replied the same afternoon.

The pilot had sent to 300 prospect accounts with a name, a title, an industry, and a company size (Chapter 4). Reply rates fell below the plain template the team had used before. The vendor's proposed fix was to triple volume across the full prospect list.

"Which of these," the CRO asked, "do we want a machine to write 20,000 times?"

The answer turned out to be neither. What Larkspur wanted a machine to do was the part of the second email that happened before any writing: noticing that the utility had a reason to talk now, and that the SDR could say so truthfully.

The decision

Why most AI outreach sounds fake

The usual diagnosis is the writing: too polished, too long, too many adjectives. That is almost never the reason. Readers do not detect a model. They detect a message that was not written for their situation, and three structural causes produce it.

Decorative specificity. Thin data plus a model instructed to "personalize" yields details that prove research was done without changing what is said: the podcast you appeared on, the post you liked, your alma mater. The detail decorates. It does not give a reason to talk. Detail included only to prove the sender found it makes a message worse, not better.

No reason now. Most outbound exists because a sequence reached step three, not because anything changed for the buyer. The model is asked to invent relevance for a send that had none. It obliges, fluently.

The most skeptical channel, with the least context. A stranger's inbox is where tolerance for error is lowest (Chapter 6). And buyers arrive late: 6sense's 2025 survey of nearly 4,000 B2B buyers found first contact with sellers happening about 61% of the way through the journey, with buyers initiating 79% of those engagements and choosing from their day-one shortlist 95% of the time [1]. Gartner, surveying 632 B2B buyers in late 2024, found 61% preferred a rep-free buying experience and 73% actively avoid suppliers who send irrelevant outreach [2]. Its analyst put it plainly: "Bad prospecting actively damages relationships with potential customers" [2]. These are vendor and analyst surveys of stated behavior; read the direction, not the decimal.

Taken together, the first message's job is small, the penalty for a bad one is lasting avoidance, and fluency does nothing to fix either. Put more bluntly: a plain template, written by hand, that names a real need a specific person actually has will often beat a fluent, machine-written message built on a shallow understanding of them. The reader does not reward eloquence. They reward being understood.

The decision is whether, not how

Here is the sentence this playbook turns on. In prospecting, research is not there to make the message sound personal. It is there to decide whether to send one at all.

For each account, and then each person, the system chooses among:

Five inputs drive the choice: fit (does the account resemble customers who succeed with you, not merely customers who bought), a reason now (a dated, sourced trigger), the right person (a role that owns the problem the trigger creates), permission (jurisdiction, suppression, consent basis, existing relationship), and budget (how many touches this account and this domain can absorb this month). No reason now, no message. That single rule removed about three quarters of Larkspur's planned sends. It is the rule most AI SDR deployments do not have.

Figure S1.1. Research decides whether to send; without a reason now, the answer is do nothing.

What you need to know

Research belongs to the account, not the lead

Most enrichment pipelines are built around the record: a lead arrives, it is researched, a message is drafted, and the same company is researched again for every employee in the funnel. Chapter 5's Research Once per Entity fixes that: keyed to the company with a seven-day freshness window, research-rich records rose from 60.3% to 93.5% on a pipeline I run while spend fell [3].

Research also has a second job most stacks skip. It adds what you lack, and it challenges what you already believe. A field saying fifty employees next to current sources describing a national operation is not a fact; it is a disagreement. The working rule: a fact from a single source is a hypothesis; corroborated by an independent source, it is something you can put in front of a stranger [4]. Chapter 8 covers the mechanics.

Signals, ranked by what they are allowed to do

Not every signal may appear in the message. Some may only decide timing.

The last two rows are where accurate outreach becomes invasive outreach. Chapter 1's rule applies: facts from outside the relationship may inform whether and when you reach out; they are quoted back only when they are professional, recent, and something the person would expect a vendor to know.

The memory shape

A prospect is a pair of linked records in the same Unified Customer Memory that serves customers (Chapter 10), not a row in a sequencer. Typed properties hold what code must filter and enforce; memories hold the evidence; a short synthesis holds the "why now" hypothesis.

account: regional-utility-0417
properties:
  customer_status: prospect          # checked against CRM before every send
  icp_fit: {score: 0.82, model: fit-v3, computed_at: 2026-09-20}
  fleet_size_band: 250-500
  trigger_events:
    - type: territory_expansion
      evidence: "3 dispatcher postings, new service territory"
      sources: [careers_page, job_board]   # two sources: corroborated
      observed_at: 2026-09-18
      entity_match_confidence: 0.97
  contact_policy: {last_touch: null, suppressed: false, jurisdiction: US}
synthesis:
  why_now: "Standing up a second dispatch team before peak season."
  confidence: medium
people:
  - role: director_field_operations
    remit_verified: true
    consent_basis: none_required_us_b2b_email   # set by policy, not the model

Every trigger carries source, date, and an entity-match confidence, because the acquisition email came from a real article about the wrong company matched by name alone (Chapter 9). Freshness is per signal (Chapter 11): a job posting is stale in weeks, a role in months. And customer_status is read before every send, because the fastest way to look automated is to prospect an existing customer, or to thank a former customer "as a valued customer" (Chapter 20).

Two more identity rules from the governed personalization engine I built belong in the record. A prospect writing from a personal mailbox does not inherit the firmographics of the mailbox provider: an address at a freemail domain is flagged, company-specific research is suppressed, and the tier drops. And a firmographic value that fails plausibility (an invalid value, a provider's bucket artifact, a tiny headcount beside strong enterprise markers, a contradiction with current research) is marked untrusted and hidden, not quoted. The policy is hide when uncertain. In a first touch, a missing number costs less than a confident wrong one [18].

The action

What the system does, and what it does not

An AI SDR done right is not one agent with an inbox. It is a pipeline in which code orchestrates, models read and write, and people own the conversation.

1. Research, asynchronously. Account research takes minutes, not milliseconds, and should (Chapter 17). It runs on a schedule and on triggers, writes to memory, and never runs at send time.
2. Decide in code, with a model's help. Fit scoring and trigger detection can use models; the send decision, suppression, jurisdiction, and volume caps are deterministic. Let the model reason; let the code decide what is allowed (Chapter 14).
3. Draft under a contract. The message is a few typed zones (subject, reason now, one value claim, one question), each with allowed evidence, forbidden claims, and a fallback (Chapter 15). The tier (person, account, industry) is computed from evidence before the model is called.
4. Route by value. For Larkspur's top 300 accounts, the output is a researched brief with sources and a draft; a seller edits and sends. Below that, the account and industry tiers send automatically within caps. Every human edit is logged as a label for what the system got wrong.
5. Classify replies, then hand off. One model call classifies each reply (positive, question, not now, wrong person, unsubscribe, out of office); code executes the branch. A positive reply goes to a human the same day. The machine opens; it does not negotiate.

Figure S1.2. Code orchestrates, models read and write, and people own the conversation.

Here is the rewritten Larkspur note at account tier, where the person's situation is unknown but the company's is verified:

Subject: dispatch for the new territory

I saw the three dispatcher openings for your new service territory. Standing up a second dispatch team is usually where routing gets done by hand for a while, which is the problem we work on. Is that on your list this quarter, or is it already handled?

It is plain. It is true. It makes one claim, cites a public fact the reader knows is public, and asks a question the reader can answer in one word. That is the whole craft.

The brief is for the seller; the email is for the buyer

For the top tier, the artifact that matters is the seller's brief, and it needs a boundary most stacks do not enforce. In the engine I built, one account's research and score (with rationale, priority, and a suggested approach) feed a brief, a seller playbook, and an email sequence, all from one governed context. The playbook may carry hypotheses and competitive context that must never reach the buyer, so rep-internal intelligence and customer-facing copy are separate outputs, and an explicit serialization layer decides what leaves the system.

Four checks earned their place. Code flags a score that contradicts its own label (88 with a band of LOW). A playbook whose load-bearing sections are empty is not done because the generation step reported success; it is retried with bounded backoff. When rich enrichment fails near a deadline, the engine writes a deterministic, lower-specificity brief instead of inventing detail or leaving the record stuck. And in some of its content engines, a first email set is scored in code (blank, wrong length, repetitive opening, incomplete ending, missing required proof); only a flawed set triggers a second generation, and the lower-penalty set wins, so quality improves without doubling model cost. If one message in a sequence fails, only that slot is regenerated [18].

The next step I am building, a design and not yet a result, is one reusable brief template set up by configuration rather than a code fork per campaign. Verified facts render straight from structured research, each with its source and a freshness date; the model writes mainly the customer-safe drafts. The brief confirms which account it describes, shows a thin-data state instead of padding when research is sparse, and lets a seller flag a wrong fact [18].

What the contract forbids

The governance list for outbound matters as much as the prompt. Larkspur's contract forbids, in code: implying a prior relationship or conversation that did not happen; fake reply threads ("Re:" on a first touch); invented mutual connections; urgency or scarcity language; any number about the prospect that is not sourced; customer-status claims; and follow-ups that add no new information. Two follow-ups at most, each carrying something the first did not, or the sequence ends.

It also bounds what the model may offer. In the engine I built, each campaign carries a capability map, so the model is asked which approved capability fits this buyer, not what solution would sound good; that stops it inventing a feature because it fits the problem. Some of its content engines also restrict numeric proof to an approved list of figures. And without a recorded relationship, "your renewal is coming up" is reframed as an evaluation, never stated as ownership [18].

The rules that shape the channel

As of September 2026, and not legal advice (details belong in dated companion notes; Chapter 19):

• Gmail treats any domain sending 5,000 or more messages a day to personal Gmail accounts as a bulk sender, permanently. Bulk senders need SPF, DKIM, and DMARC with alignment, one-click unsubscribe for marketing messages, and spam rates reported in Postmaster Tools below 0.30% [5]. Google recommends honoring unsubscribes within 48 hours and, from November 2025, began rejecting non-compliant traffic [6]. Yahoo and Microsoft have similar rules [7]. Cold volume from your primary domain puts every invoice and renewal email on that domain at risk.
• CAN-SPAM (US) is opt-out: honest headers and subject lines, a working opt-out honored within 10 business days, and penalties up to $53,088 per violating email [8].
• CASL (Canada) is opt-in: commercial email generally needs express or implied consent, with implied consent time-limited, and penalties up to CAD $10 million for organizations [9].
• EU and UK B2B cold email rules vary by country under the ePrivacy framework, and the right to object to direct marketing under GDPR Article 21 is absolute [10]. Treat jurisdiction as a typed property, not a guess.
• AI voice. The FCC ruled in 2024 that AI-generated voices are "artificial" under the TCPA, so AI-voiced calls fall under its consent rules [11].
• LinkedIn's user agreement prohibits bots or unauthorized automated methods to "send or redirect messages" or add contacts [12]. Draft there if you like; a person sends.

What can go wrong

Failure story: The Volume Rescue

Larkspur's vendor had a fix for falling reply rates: send three times as many, across the full prospect list rather than the 300 pilot accounts. In the fictional telling, the tripled volume went out from Larkspur's primary domain, spam complaints climbed past Gmail's limit within a week, and the first casualty was not the pilot. It was a batch of renewal notices and invoices from the same domain that landed in customers' spam folders. Meetings booked per week rose for a month. Replies saying "take me off your list" rose faster. The anti-pattern: volume as a fix for irrelevance. A message that should not have been sent does not improve by being sent more often.

Evaluate the category on your own data

The AI SDR market is young and its claims outrun its evidence. In March 2025, TechCrunch reported allegations that 11x, a venture-backed AI SDR company, listed customers it did not have, including ZoomInfo, which said its trial "performed significantly worse than our SDR employees," and that former employees disputed how its revenue figures were counted. 11x said it had removed inaccurate customer mentions, attributed the rest to human error, and defended its revenue metric as one investors reviewed [13]. These are allegations, and the company disputes them. The lesson does not depend on who is right: logos and demos are not evidence. A holdout on your own accounts is.

Governance risks, named

• The Hallucinated Detail (Chapter 15): an unsourced or mismatched event. Control: entity-match threshold, grounding check, whole-zone fallback.
• The Creepy Reveal (Chapter 1): true, invasive, unexpected. Control: signal-use table in code.
• The customer prospected as a stranger: identity failure between CRM and sequencer (Chapter 9). Control: status check at send time, not at list build.
• Contradicting yourself: Gartner found 69% of buyers see inconsistencies between a supplier's website and its sellers [2]. Control: one governed context and one claims library for every surface (Playbook P9, Chapter 18).
• An open promise ignored: a contact at a customer's parent company under an outreach hold (Chapter 18). Control: holds are typed and read by every sender.

What this does not do

Research does not create demand. If 6sense is even roughly right that most buyers choose from a shortlist formed before they talk to anyone [1], researched outbound works mainly by reaching the minority of accounts with a live reason, and by not burning the rest. It will send fewer messages and may book fewer meetings in the first month. That is the cost of stopping the damage, and you should measure it rather than argue about it.

It also qualifies something I have written before. In an earlier article I described an outbound email that addressed a prospect's publicly stated frustration with her current vendor [14]. For an account where a relationship exists, that is right. For a stranger, the better use of that signal is timing: it says now, and the message says something true and general about the problem. The deeper the evidence, the more carefully it should be spent in a first touch.

And the rep-free trend does not mean sellers are obsolete. Gartner's 2026 buyer survey found 67% prefer rep-free buying [15], while a companion survey found 69% turn to sales reps to validate AI-generated insights [16]. Buyers want fewer, better human moments. Automating all of them misreads the data; so does ignoring it.

How you will know

The metric is qualified meetings per 1,000 accounts considered, not replies per send. Sends are a cost. Measuring per account considered rewards the system for deciding well, including deciding not to send. Track the harm side with equal weight: spam complaint rate by domain, unsubscribes, "wrong company" and "remove me" replies per 1,000, and domain reputation in Postmaster Tools.

The test design. Randomize at the account level, not the contact level, so two people at one company never see two treatments. Three arms: the best human plain template (the control the pilot never had), researched and tiered outreach, and a no-outbound holdout. The holdout matters because buyers initiate most engagements [1]; some meetings outbound "creates" would have arrived inbound anyway.

The arithmetic. Suppose the qualified-meeting rate is 1.0% of accounts and you hope to reach 1.5%. A standard two-sided test at 5% significance and 80% power needs about 7,750 accounts per arm. Larkspur's 300-account pilot could not have detected that lift, which is why it proved nothing except that it was hurting replies. Pipeline and win rate arrive a quarter or two later; reputation damage can arrive faster. Chapter 21 covers holdouts, incrementality, and why reply rate is a proxy that can move in the wrong direction from revenue.

Reader Q&A

Should we buy an AI SDR or build one? Ask any vendor four questions: where does research live and is it shared with the rest of the company; who decides whether to send; what does it write when evidence is thin; and will it run against a holdout on our accounts. Buy or build by the answers, not the demo (Chapter 22).

Do we still need human SDRs? Yes, fewer and differently. They work the top accounts from researched briefs, own every positive reply, and label what the system gets wrong.

Should we disclose that AI drafted the message? A message a person reviews and sends is theirs. An AI agent conversing with a prospect is different: in the EU, Article 50 of the AI Act has required disclosure of AI interaction since August 2026 [17]. Whatever the law, never let the system imply a human wrote something no human saw.

How many follow-ups? As many as you have new, true things to say, capped at two for strangers. "Just bumping this" is a reason to end the sequence.

Can we use website visits to time outreach? For timing and routing, carefully and within your consent notices. Never in the message.