AI email automation reads incoming mail, works out what it's about, looks up the context in your systems and then sorts it, drafts a reply or takes an action. Start with sorting, move to drafting, and allow automatic sending only for narrow, low-risk categories. Treat every incoming mail as untrusted input.
What are the steps?
Most systems follow the same pattern, whether it's a feature in your mail tool or something custom built.
- Trigger. A new mail arrives in a connected mailbox.
- Classify. The AI decides what kind of mail it is and how urgent.
- Look up. It finds the customer, order or earlier conversation in your systems.
- Decide. Rules and the classification choose what happens: route, draft or act.
- Draft. It writes a reply using your approved information and tone.
- Approve or send. A person checks it, or it's sent if the category allows that.
- Log. The outcome is recorded, ideally on the customer record.
This is different from email marketing automation, which sends planned campaigns on a schedule. Here the work starts from what comes in.
How much should you let it do alone?
Move up one level at a time, and decide per category of mail rather than for the whole inbox.
| Level | What it does | Risk if wrong | Good for |
|---|---|---|---|
| 1. Sort | Labels and routes to the right person | A mail lands in the wrong place | Any shared inbox |
| 2. Draft | Writes a reply, a person sends | Time lost on a bad draft | Most customer mail |
| 3. Send | Replies without review | A wrong message reaches a customer | Narrow, factual categories |
Our rule for level 3: the answer must come from a system instead of being worded freely, and a wrong reply must be easy to fix. "Your order shipped, here is the tracking link" fits. Complaints, price discussions, anything legal and anything from an upset customer don't. Fall back to a person when the AI is unsure.
What risks are specific to email?
- Prompt injection. A mail is text from a stranger, and the AI reads it. OWASP describes indirect prompt injection as instructions arriving through external content, and its examples include an LLM-powered email assistant. It advises least privilege and human approval for privileged operations.
- Wrong thread, wrong person. Long threads and forwarded mails contain other people's information. A draft can repeat it.
- Confident errors. A reply can sound right and be wrong. Limit it to your approved sources.
- Personal data. Mail is full of it. Where a supplier processes it for you, GDPR Article 28 requires a contract covering that processing, so check this before you connect a mailbox.
In practice, an agent that reads your mail shouldn't also be able to send anything anywhere or see everything. Separate reading from acting, and give it only what this job needs.
How do you know it's working?
Track three things from day one: how often the sorting is right, how much reviewers change in the drafts and how often it hands off to a person. A steady fall in edits is your signal to widen what it does. A test set of real past mails, including the odd ones, lets you recheck after every change.
Should you buy or build this?
Check first whether your mail or helpdesk tool already includes AI sorting and drafting. Go custom when replies depend on data in several systems, or when you need actions beyond a reply. Then it becomes an agent rather than a feature. At 5DAYS that's a Business Agent, from €7,950, excluding VAT. Running costs come on top: see what AI automation costs.
