The compliance rails

Reps think in campaigns. Regulators think in people. That single mismatch causes most of the trouble I see. A campaign is one object with one set of settings; a list is 400 people each carrying their own rule. So the operating question is never "is this campaign compliant?" It is "is this contact allowed to receive this message, under the rule that applies to them?"

• Sort by the person, not the send. Your CRM needs a jurisdiction field that is actually populated, and a source field that says where the row came from. Without both, no gate can be checked at all.
• The tightest gate wins. A Canadian contact on a US-shaped sequence gets the Canadian treatment, not the US one. Averaging is how teams end up non-compliant on the minority of rows that matter most.
• The gate belongs in the tool, not the training. If compliance depends on a rep remembering something at 4pm on a Friday, it is not a rail, it is a hope. Rails are enforced by the system: suppression lists, required fields, blocked sends.

The most common thing I hear from B2B sales leaders is some version of "GDPR is fine, we rely on legitimate interest." That may well be available to you. The part people skip is that legitimate interest is a balancing test you are expected to have carried out and recorded before you sent anything, not a label you attach afterwards when someone complains.

• Documented - somebody wrote down the interest being pursued and why it is legitimate.
• Balanced - against the individual's rights and their reasonable expectations. A senior ops leader receiving a relevant work email is a different balance from a junior employee receiving 12 of them.
• Easy to object to - a person who says stop must be able to say it easily, and stopping must actually happen everywhere.

If your answer to "show me the assessment" is a Slack message from 2024, you do not have the thing you think you have. Ask counsel to help you write it once, properly, and then attach it to the campaign template so it travels with the work.

Write one script, make every rep say it out loud until it stops sounding like a legal warning and starts sounding like a person being straightforward. Twelve seconds. Then pause, because a consent nobody had a chance to refuse is not much of a consent.

"Before we start - I use a note-taker on these calls so I can
listen properly instead of typing. It records and transcribes,
it stays inside our team, and I can turn it off right now if
you would rather I didn't. Happy for me to leave it on?"

[ pause. wait for the actual answer. then start recording. ]

Calendar invite footer, 9pt grey:
"By joining this meeting you consent to recording & AI
transcription per our terms at cadence.example/legal"

[ recording already running when the buyer joins ]
[ nobody read it, nobody agreed, nobody could say no ]
[ <-- and the note-taker joined before the human did ]

The second one may or may not be lawful where you operate - that is a question for counsel, and the answer varies by jurisdiction and by one-party versus all-party rules. What is not in doubt is that it is bad selling. A buyer who realises mid-call that they were recorded without being asked has learned something about how you will treat their data after they sign.

Recording consent has decades of law behind it. AI disclosure mostly does not, which means you are setting policy rather than following one. Anchor it to the trust line from the rep track: the read, the promise and the price stay human. Everything else is preparation, and preparation does not need announcing.

• Always disclose a participant. If something joined the call, name it. A bot in the attendee list that nobody mentioned is the fastest way to make a buyer suspicious of everything else you said.
• Disclose authorship where a person would feel misled to learn it. A recap drafted by a tool and checked by a human is fine to say plainly. A "personal" note that was generated and never read is the thing that burns you.
• Never let AI hold the promise or the price. Not because of a rule, but because a commitment nobody made is a commitment nobody will honour.
• Set the default to tell. Disclosure costs you a sentence. A discovered deception costs you the account, the referral, and occasionally a screenshot on LinkedIn.

Some jurisdictions allow recording where one participant consents. Others require every participant to agree. Your discovery calls have four people on them from three countries and a rep who has no idea which rule applies, which is why the only workable team policy is the strict one: ask everyone, out loud, every time. It costs twelve seconds and it removes the need for anyone in a sales seat to make a legal judgement in real time.

Two edge cases worth taking to counsel rather than solving in a sales meeting: someone who joins the call twenty minutes late and never heard the disclosure, and a recording that is later shared outside the team that agreed to it. Have an answer for both before they happen, because they will.

In the rep-track simulator there is an eighth prospect, Marcus Hale, whose row is capped at 0.0% no matter how good the email gets. That cap is not a scoring choice, it is the shape of the rule. He opted out. There is no sentence that makes sending to him acceptable.

• Across domains. A suppression that only covers your main sending domain is not a suppression, it is a routing accident waiting to happen. New domain, new tool, same person.
• Across tools. Your sequencer, your marketing platform, your ABM tool and the spreadsheet one rep keeps privately are four separate send paths. The suppression list must be one list that all four consult.
• Forever. Not "expires after 18 months". Not "resets when they change jobs" - though a genuinely new person at a new company is a question for counsel, and the safe default is to leave the suppression alone.
• Enforced, not remembered. The import step checks the suppression file. If your process is "reps should check", you have a preference, not a rail.

This is the part that is genuinely new, and it is the reason a session like this exists at all. The rules did not change much. The blast radius did.

• The old error. A rep hand-writes 40 emails a week. A bad list costs you 40 wrong sends before someone notices, and the rep noticed around number 12 because they were reading each one.
• The new error. The same rep generates and schedules 4,000. Nobody reads them individually - that was the point of the tool. The error is discovered by the recipients, in the aggregate, at once.
• Detection got slower while damage got faster. The human in the loop used to be the quality gate by accident, because writing is slow enough to notice things. Remove the slowness and you have to add the gate back deliberately.
• Volume also changes how it looks. Forty wrong emails is a mistake. Four thousand is a pattern, and a pattern is what a regulator, a journalist or a competitor finds interesting.

Run this in the room. A rep comes back from a logistics conference with a 400-row attendee list, imports it, and launches a sequence. Three of those addresses are prior opt-outs from your own suppression file. Here is what happens next, in order, and notice how much of it is not about the three emails at all.

Note what is not on that list: disciplining the rep, and debating whether three counts as serious. Neither improves anything. The process let it happen.

Most sales leaders can name their CRM retention policy and cannot name their note-taker's. That is backwards - the note-taker holds the richer, more personal artefact. Four questions to answer in writing:

• What is stored? Audio, transcript, summary, or all three. Each has a different sensitivity and a different deletion story.
• For how long, and who decided? A default of "forever, because storage is cheap" is a decision somebody made by not making it.
• Who can see it? The rep, the manager, the whole GTM org, anyone with a link. Recordings of buyers being candid are exactly the thing that should not be broadly shareable.
• How does a person get it deleted? If a buyer asks you to delete their recording, can you actually do it, in every system, and prove it? Find out before someone asks.

Ask these before signing, and get the answers in writing rather than from a slide. A vendor who cannot answer them quickly is telling you something.

• Where is our data stored, and in which countries is it processed? Including any subprocessors, including the model provider.
• Is our customer data used to train anything? If the answer has the word "aggregated" in it, ask again more slowly.
• Can we export everything, in a usable format, on demand? This is the a6 question too, and it is the difference between a tool and a hostage situation.
• What is the deletion path for one individual's data? Not the account. One person, on request.
• How do you handle recording consent in all-party jurisdictions? Their answer tells you whether they have thought about it at all.
• What happens to our data if you are acquired or shut down?

Here is the failure I see most, and it has nothing to do with law. RevOps believes legal owns compliance. Legal believes they advise and the business owns it. Sales believes it is a RevOps configuration problem. All three are being reasonable, and the rail has no owner, so the rail does not exist.

• Name one accountable person, in writing, today. Usually a RevOps lead. Not a committee, not a function, a human with a name.
• Legal advises, they do not operate. Counsel tells you what the rule is. They cannot configure your sequencer, and expecting them to means nothing gets configured.
• Sales leadership owns the consequence. You are the one whose team sends. If the rails are wrong, it lands on your quarter and your reputation, so you have standing to demand they exist.
• Write down the review cadence. Quarterly, at minimum: list sources, suppression integrity, recording script, retention settings, and any new tool that quietly started sending.