AI email assistants: triage, drafting, limits

The problem with a busy shared inbox isn't reading speed. It's that every message costs a context switch and a decision — is this urgent, is it mine, what is it about — and those decisions get made repeatedly, badly, at the worst moments. Meanwhile the message that needed an answer within the hour sits between a newsletter and a calendar invite.

That's a sorting and routing problem, and it's the part machines handle well. Writing is the part everyone demos, because it's visible. It's also the part carrying the most downside.

What triage actually involves

Four separable jobs, worth building in this order.

Classification. What kind of message is this? A useful label set is small and specific to your business: new enquiry, customer question, supplier or invoice, internal, scheduling, recruitment, vendor pitch, notification. Ten well-separated classes beat thirty overlapping ones, and an explicit "unclear" class routed to a person beats a forced guess.

Priority. Urgency isn't a property of the message alone — it's a function of who sent it, what it says, and the state of the relationship. A one-line "still waiting on this?" from a customer whose ticket has been open five days outranks a detailed message from a stranger. Combine sender history, first contact versus follow-up, explicit deadlines, open items in your CRM, and thread age.

Routing. Which person or queue owns this? For a shared inbox this is the whole game. Route by class and content — billing to finance, faults to support, new enquiries to whoever's on rotation — and make ownership visible so two people don't answer the same message.

Summarisation. Long threads with forwarded history, quoted replies and three participants take minutes to reconstruct. A summary of what's agreed, what's outstanding and who owes what turns that into seconds — quietly the most-used feature in most deployments.

Where the auto-send line should sit

The right question isn't whether the model can write a good reply. It usually can. It's what happens when it's wrong, and who finds out.

The pattern behind the table: auto-send is safe when the message asserts nothing the system can't verify. An acknowledgement asserts only that mail arrived. A status update asserts what a database says. An answer to a question asserts something about your business — and if that's wrong, you've created a written commitment, in your name, that nobody at your company ever saw. Approving a draft takes seconds. One wrong quote costs a refund, a discount, or a relationship.

There's a compliance edge if you're generating marketing email at volume. The FTC's CAN-SPAM compliance guide requires accurate headers and subject lines, identification of the message as an advertisement, a valid physical postal address, and a clear opt-out honoured within 10 business days — and states civil penalties of up to $53,088 per non-compliant email, adjusted for inflation. Generated subject lines that oversell the content are exactly what fails the truthfulness test. Transactional messages sit outside most of those rules, another reason the auto-send list should stay transactional.

Action extraction, the underrated part

Most work that gets dropped was agreed in an email and never written down anywhere else. "I'll send that over Thursday." "Can you get us a revised quote by the 12th."

An assistant that reads for commitments and creates records from them changes the failure rate of that work more than any drafting feature. What to pull out:

• Commitments made by your team — with owner and date, into a task system
• Commitments made to you — into a follow-up queue, so a missed one becomes visible
• Deadlines and dates — into a calendar
• Relationship facts — a new contact, changed address, stated budget — into the CRM
• Sales signals — a pricing request, renewal question, expansion hint — onto the opportunity

Two details decide whether this works. Extracted items need a source link back to the exact message, or nobody trusts them. And extraction should be reviewable in bulk — a daily digest of "here's what I picked up, confirm or dismiss" — rather than writing silently to your CRM, which produces a CRM full of half-facts within a month.

Security: your inbox is a fraud channel

Email automation gets specified as a productivity project, and email is in practice the main way money gets stolen from businesses. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558 — within a year totalling $20.877 billion across all reported internet crime.

Two consequences for putting an AI assistant on an inbox.

Automation is predictable, and predictability is what fraud exploits. A system that automatically actions "urgent" requests from apparent executives, or updates records from emailed instructions, is a target. Any message that changes bank details, redirects a payment, or requests credentials should stop automation and route to a human who verifies through a different channel — a known phone number, not one printed in the email.

A model that reads untrusted text can be instructed by it. If your assistant reads message bodies and can send mail or update systems, an attacker can put instructions in an email and see whether it complies. Mitigations are structural, not clever prompting: separate read from write permissions, never let inbound content trigger an outbound send without approval, scope tool access to the minimum, and log every action against the message that caused it.

The same care applies to supplier invoices arriving in that inbox — the bank-detail check in OCR invoice processing is the same control on a different document, and the invoices you send out have their own loop in accounts receivable automation.

The cost of over-caution

Excess caution has a price too. An assistant that routes everything to "needs review" is just a second inbox, and a classification set nobody trusts gets ignored within a fortnight. A good deployment looks like this: triage on everything, summaries on long threads, action extraction reviewed daily, drafting on the message types that repeat, auto-send on a short and boring list.

Frequently asked questions

Should an AI email assistant send replies to customers automatically?

Not as a default. Auto-send is reasonable for messages that assert nothing the system can't verify — receipt acknowledgements, meeting confirmations drawn from a real calendar, order status read from a live record. It's a bad idea for anything answering a question about your business, stating a price, committing to a timeline, or responding to a complaint. The asymmetry settles it: approving a draft costs seconds, while one confidently wrong email sent in your name creates a written commitment nobody reviewed.

What does an AI email assistant do beyond writing replies?

The more valuable functions are classification, prioritisation, routing, summarisation and action extraction. Classification labels each message by type. Prioritisation ranks by urgency using sender history and open items rather than the message alone. Routing assigns it to the right person or queue. Summarisation collapses forwarded threads into what's agreed and outstanding. Action extraction pulls commitments and dates into task and CRM systems. These usually beat drafting, because forgotten email costs more than slow typing.

Can an AI assistant handle a shared support inbox?

Yes, and shared inboxes are where it pays off fastest, because routing decisions get made dozens of times a day and made inconsistently. The assistant classifies each message, assigns it to the right queue or person, flags urgency, and marks ownership so two people don't reply to the same thread. Drafting can be layered on for repetitive question types. Keep escalations, complaints and refunds on human review — there, tone is the substance rather than the packaging.

Is it safe to give an AI assistant access to my email?

It requires deliberate design rather than a blanket yes or no. Two risks matter. Email is a primary fraud channel — the FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025 with over $3 billion in reported losses — and automation is predictable in ways attackers exploit. Second, a model reading untrusted message content can be influenced by instructions hidden inside it. Separate read from write permissions, require human approval for outbound sends, scope tool access narrowly, and log every action.

How is this different from email rules and filters?

Rules match patterns you defined in advance: this sender, that subject line, this keyword. They're precise, fast and free, and you should keep the ones that work. What they can't do is interpret meaning — a rule can't tell that a message with no keywords is an unhappy customer, or that a polite one-liner is the third follow-up on an unanswered question. An AI assistant reads intent and context alongside relationship history. Run both.

Will AI-generated replies sound like a template?

They will if you configure them that way. Generic output comes from generic input: no examples, no product knowledge, no tone guidance. Assistants grounded in your actual sent mail, your documentation and the customer's history produce noticeably better drafts. But accept a limit — for complaints and negotiations, where the relationship is the point, a person should write it. The measurable test is your edit rate: rewriting more than roughly a third of drafts means drafting isn't saving time.