Email audit checklist.

What you are really asking: Is the AI sending on my behalf without my sign-off?

• Does every outbound message wait for a person on my team to approve it?
• Is fully automated sending off by default, and does turning it on take a deliberate choice?
• Can I see the draft, edit it, and approve it before anything sends?
• Which messages, if any, can go out without review?

Red flag: A vendor that leads with "fully autonomous" sending and has no clear approval workflow.

What good looks like: Draft-first mode. You see the draft, approve it, and only then does it send. A person keeps approving high-stakes messages, such as proposals and sensitive client matters, for as long as you run it.

What you are really asking: Are my client emails stored on someone else's servers?

• Where are my emails stored, in which country, and whose hosting is it?
• Which AI provider reads the text, and is that provider named in the contract?
• Does the provider train on my content or keep a copy of it?
• How long do you keep copies, and how do I have them deleted?
• Can your staff read my email content, or only operational data such as system health?
• If something is compromised, how fast will you tell me?
• Which security certifications or audits do you hold, if any, and can you show the evidence?
• Where does processing run today, as opposed to where it could run later?

What good looks like: A plain-language written account of every place your data goes, naming the provider, handed to you before you sign.

What you are really asking: How bad can a mistake get, and how do I fix it?

• Can I retract or recall a message after it is sent?
• Does the system hold low-confidence drafts for human review?
• What is the rollback process if the drafts drift from my voice?
• Who is responsible if a client receives an incorrect statement, and where is that written down?
• What does the system refuse to handle on its own?

What good looks like: Low-confidence drafts are held, not sent. A clear escalation path routes edge cases to you. The vendor documents what the system will not do autonomously.

What you are really asking: Will this sound like me, or like a generic chatbot?

• How many sample emails does it need to model my voice?
• How long does calibration take before drafts are usable?
• Can I correct it when a draft feels off?
• Does it improve over time, or is the initial training the ceiling?

What good looks like: A structured onboarding period where you review drafts and give corrections, and a way to see whether the drafts are improving.

What you are really asking: What will this really cost me, in money and in my own time?

• Setup fee: is it one time, and is it refundable if it does not work?
• Monthly fee: is it per seat, per email volume, or flat?
• Your time: how many hours a week of reviewing drafts and tuning prompts, in year one?
• Training: who on my staff gets trained, and for how long?
• Maintenance: who updates the prompts when my workflows change?
• Credentials: who owns the accounts and logins from day one?
• Leaving: what ends the contract, and what do I keep if I cancel?

What good looks like: A written estimate of your time for the first month, the third month, and the twelfth month, next to the monthly fee. A vendor who cannot give you that may not know how the product performs in practice.

W&S answers every one of these in writing before you sign.

Want to go through them together? Book a free 15-minute call, or head back to the email audit page.