AI in Email Marketing: What It Does Well and the Rules That Still Apply

Most email platforms now ship with AI built in. It can write a subject line, guess when each subscriber is likely to open, predict who is about to stop buying, and draft a whole welcome series in a minute. For a small e-commerce brand or a local practice with one person doing marketing, that is real time saved.

What AI does not change is the rulebook. Federal email law, the inbox providers' sender requirements and, for healthcare businesses, HIPAA all apply to an AI-written email exactly as they apply to one you typed yourself. This guide covers both sides: where AI earns its place, and the guardrails to set up before you let it near your list.

What AI does well in email marketing

Subject lines and preview text

This is the easiest win. AI tools are good at producing ten variations of a subject line in different tones, so you can test a few instead of guessing. Ask for options that are specific about the offer, not clever.

One caution on measuring the results: open rates are no longer a clean signal. Apple's Mail Privacy Protection loads email content in the background when a message arrives, which hides whether someone actually opened it. Judge subject line tests by clicks, orders or bookings, not opens alone.

Segmentation and prediction

AI-assisted segmentation is where e-commerce brands see the most value. Klaviyo, for example, uses order history from a connected store to predict each customer's lifetime value, their churn risk and the expected date of their next order, and lets you build segments from those predictions. A supplement or skincare brand can then send a reorder reminder a few days before a customer is likely to run out, instead of blasting everyone on the same day.

The catch is data. These models need a meaningful order history before they produce anything useful, so a brand-new store will not see much from them yet.

Send time

Send-time features pick the hour each subscriber is most likely to engage. Mailchimp's Send Time Optimization is included on its Standard plan and above, needs enough past sending data, and does not work for automated emails. Klaviyo offers a similar per-person feature. Expect modest gains, not a transformation: a good offer at an average time beats a weak offer at the perfect time.

Drafting emails and flows

AI is a fast first-draft writer for welcome series, abandoned-cart emails, post-visit follow-ups and win-back campaigns. Give it your brand voice, a few past emails that worked, the offer and the audience, and it will produce a usable starting point.

Where AI gets it wrong

AI drafts confidently, including when it is wrong. Common problems:

Invented details: discount codes, deadlines, prices or product features that do not exist.
Overstated claims. For supplements, skincare and medical services, an AI that writes "clinically proven" or "guaranteed results" can create a real problem for the business.
Generic copy that sounds like every other brand.
Subject lines that promise something the email does not deliver.

Every AI-written email needs a human read before it sends, especially offers, numbers and any health-related claim.

Guardrail 1: CAN-SPAM still applies

The CAN-SPAM Act covers commercial email in the US, including business-to-business email. The FTC's compliance guide sums up the main requirements:

Header information (From, To, Reply-To and routing) has to be accurate and identify the sender.
Subject lines cannot be deceptive and have to reflect the content of the message. This is where AI-generated subject lines deserve a second look.
The message has to be identified as an advertisement, though the law is flexible about how.
The email has to include a valid physical postal address.
It has to explain clearly how to opt out, and opt-outs have to be honored within 10 business days, without charging a fee or asking for more than an email address.
A business stays responsible even when an agency, a contractor or a software tool sends the email for it.

Transactional messages, such as order confirmations and appointment reminders, are largely exempt, but they still cannot carry false routing information. If a message mixes transactional and promotional content, its primary purpose decides which rules apply.

Penalties: each email that violates CAN-SPAM can cost up to $53,088. That is the 2025 inflation-adjusted figure. In September 2026 the FTC published a notice that it would not adjust civil penalties for 2026, because the federal government shutdown prevented the data needed for the calculation, so the 2025 level still applies this year.

Guardrail 2: Gmail and Yahoo sender requirements

Since February 2024, Gmail and Yahoo have required bulk senders to meet authentication and unsubscribe standards. Google defines a bulk sender as anyone sending more than 5,000 messages a day to personal Gmail accounts, and once a sender crosses that line, Google treats it as a bulk sender permanently. Microsoft announced similar requirements for Outlook.com, Hotmail and Live addresses, enforced from May 5, 2025, for domains sending more than 5,000 emails a day.

The core requirements across Gmail and Yahoo:

Authenticate your domain. Set up SPF, DKIM and DMARC. A DMARC policy of "none" is acceptable to start. The From domain has to align with the SPF or DKIM domain.
Offer one-click unsubscribe. Marketing emails need a one-click unsubscribe header plus a visible unsubscribe link in the body. Google gave senders until June 1, 2024 to add one-click unsubscribe.
Process unsubscribes fast. Yahoo requires honoring unsubscribes within 2 days, and Google says 48 hours. That is much shorter than CAN-SPAM's 10 business days, so in practice the inbox providers set the real deadline.
Keep spam complaints low. Both require a spam complaint rate under 0.3%. Google recommends staying under 0.1%.

Google has also said that from November 2025 it is stepping up enforcement on mail that does not meet these rules, including temporary and permanent rejections. Even if you send far fewer than 5,000 a day, Gmail's baseline rules for all senders still include SPF or DKIM and a spam rate under 0.3%, and meeting the full bulk standard is good practice.

AI makes this guardrail more important, not less. It makes it easy to send more emails, more often, to more segments. If that raises complaints, deliverability suffers for every email you send, including order confirmations.

Guardrail 3: patient data and AI tools

For med spas, clinics and dental practices, the biggest risk is not the copy. It is the data.

Under HIPAA, protected health information (PHI) includes more than medical records. A list of patients who had a specific treatment, an appointment history, or an email segment named after a condition can all count. Two points matter most for marketing:

Business associate agreements. If a vendor stores or processes PHI on a practice's behalf, HIPAA generally requires a business associate agreement (BAA) with that vendor. Many mainstream email marketing platforms do not sign BAAs. HIPAA Journal has reported that Mailchimp, for example, cannot provide the assurances needed for a BAA, so PHI should not go into it.
Marketing authorization. HIPAA's rules require a patient's written authorization before PHI is used for most marketing, with narrow exceptions such as face-to-face communication and promotional gifts of nominal value.

AI adds a new way to slip up. Pasting a patient list, appointment notes or a spreadsheet of treatment histories into a general AI chat tool to "write personalized follow-ups" puts PHI into a system that likely has no BAA with your practice. The same goes for AI features inside email platforms: if the tool is not covered by a BAA, the data you feed it should not identify patients or their care.

Practices that use email marketing often handle this by keeping a separate, non-clinical marketing list (people who opted in to newsletters), writing general content that does not depend on anyone's treatment history, and running anything that uses patient data through systems covered by a BAA. Where exactly the lines fall for your practice is a question for healthcare counsel.

A practical checklist before you turn on AI features

SPF, DKIM and DMARC are set up and aligned for your sending domain.
One-click unsubscribe is on, and unsubscribes process within 48 hours.
Every marketing email has a physical address and a clear opt-out.
A person reviews every AI-written email for invented offers, prices, dates and claims.
Subject lines match the email content.
Spam complaint rate is checked monthly (Google Postmaster Tools shows it for Gmail).
Healthcare businesses: no patient data goes into any AI or email tool without a signed BAA, and marketing that uses PHI has patient authorization.
Success is measured by clicks, orders and bookings, not opens.

Where NutriCove fits

NutriCove builds e-commerce stores and sets up email and SMS flows, such as welcome, abandoned-cart and reorder sequences, as part of its e-commerce work and growth retainers. If you are planning or cleaning up your email program, see our e-commerce services.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.