Can an AI agent replace an SDR in Australia?

Partly. An AI agent can do most of what fills an SDR's day: researching accounts, building lists, finding the right contact and writing a decent first email. What it cannot do well is own the relationship, judge when to push and when to leave someone alone, or carry the legal responsibility for what gets sent.

The setup that works in 2026 is simple to describe. AI researches and drafts. A person reads, decides, sends, and owns the conversation from the first reply onwards.

In Australia there is a second reason to keep a person on the send button. The Spam Act 2003 applies to cold B2B email the same way it applies to a retailer's newsletter, every message counts as a separate breach, and an agent that sends on its own can send a lot of them before anyone looks.

Why everyone is asking this now

We hear some version of "how do we reach out quicker without adding headcount" on discovery calls with 60 to 200 person businesses. The tempting answer is to switch on an agent and let it run.

HubSpot's Prospecting Agent is the one most of our readers already have access to. According to HubSpot, it researches accounts, finds contacts, scores them against your ideal customer profile, watches buying signals such as funding rounds, leadership changes and website visits, and drafts outreach in each rep's voice. It can pull new contacts from an external data provider such as Apollo or ZoomInfo, or work from contacts already in your CRM.

The setting that matters most is autonomous mode. You choose between Review before sending, where a person approves every message, and Send automatically, where the agent sends without review based on your outreach settings.

That second option is where the "replace the SDR" idea comes from, and it is where Australian teams get burnt.

What does the Prospecting Agent cost?

Since 14 April 2026, HubSpot charges US$1 per lead the agent recommends for outreach, paid as 100 HubSpot Credits per lead. It runs on HubSpot Credits across Starter, Professional and Enterprise subscriptions. HubSpot lists these prices in US dollars, so convert at the day's rate and add GST where it applies to your invoice.

At 500 recommended leads a month, that is US$500 in credits on top of your subscription. We broke down credits in what HubSpot's AI agents actually cost to run, and our walkthrough of how the Prospecting Agent works covers setup.

Does the Spam Act apply to B2B cold email?

Yes. The Act covers any commercial electronic message, and its definition includes a message whose purpose is to offer to supply goods or services, or to promote a supplier of them. There is no general carve out for messages sent to a business, so a cold email offering your services to a Head of Operations is covered.

ACMA, the regulator, sets out three things every marketing email needs.

• Consent. Express (they ticked a box, filled in a form, agreed on the phone or face to face) or inferred. ACMA says inferred consent is less reliable than express, and puts the burden on you: "it's up to you to prove that you have a person's consent."
• Identification. Your name or business name, with your legal name or your ABN, plus contact details that stay correct for at least 30 days after the send.
• A working unsubscribe. Clear instructions, no fee, no login or extra personal details required, functional for at least 30 days after the send, and honoured within 5 working days.

Two more rules catch AI outbound in particular. You cannot email someone to ask for consent, because ACMA treats that request as a marketing message in its own right. And you cannot use or supply address-harvesting software, or a list built with it.

The published address rule, and how far it stretches

Most B2B cold email in Australia leans on one clause: Schedule 2, clause 4 of the Act, on conspicuous publication. It starts by saying consent cannot be inferred "from the mere fact that the relevant electronic address has been published." Then it sets out an exception. Consent is taken to exist when all of these are true:

• the address reaches a particular person, role or function in an organisation
• it has been conspicuously published
• it is reasonable to assume it was published with that person's or organisation's agreement
• the publication does not say they do not want unsolicited commercial messages
• your message is relevant to their work-related business, office or role

So the procurement manager whose email is on the company's contact page can probably receive an email about procurement software. A guessed address was never published. An address under "no sales enquiries" is excluded. An email to the same manager about your golf day fails on relevance.

An agent cannot reason about this clause on its own. It does not know whether a data provider's address was ever published with the person's agreement, and it judges relevance from a job title. ACMA is blunt on bought lists: "You are still responsible for making sure you have consent for any addresses you use."

Why an AI agent multiplies the risk

Penalties under the Spam Act are counted per message. When ACMA penalised Latitude Finance $3.96 million in April 2026, it described the company as breaching the spam laws "more than 2.7 million times". The problems were missing contact information and, on 344,416 of those messages, an unsubscribe that did not work. It was Latitude's second penalty, after $1.55 million in 2022.

In July 2026 Tabcorp (TAB) paid more than $2.7 million for spam and telemarketing breaches, including more than 217,000 marketing emails and SMS sent over 16 days to customers who had unsubscribed from those channels, and 351 calls to numbers on the Do Not Call Register without consent. ACMA says businesses have paid more than $12 million in spam and telemarketing penalties over the past 18 months.

Neither case involved an AI agent. Both show the pattern that should worry anyone switching on "Send automatically": one setup mistake, repeated on every send. An agent with a broken unsubscribe footer or a bad list makes the same mistake on every email until someone notices.

What to hand to AI, and what a person keeps

Here is the split we would set up.

In HubSpot terms, "Review before sending" stays on. It is slower than letting the agent run, and still far faster than researching every account by hand. Before any agent touches real contacts, test it. We wrote up how we test an AI agent before it goes near a customer.

What about calling? The Do Not Call Register

If the research ends in a phone call, different rules apply. Business phone numbers cannot go on the Do Not Call Register, but a number used for both business and personal purposes can, as long as personal use is more than 50 per cent. That can include a founder's or sole trader's mobile, which is the kind of number a data provider may hand you.

So wash the list before calling. ACMA also says all telemarketers must call only within permitted hours (9am to 8pm weekdays, 9am to 5pm Saturday, not Sunday or national public holidays), give their name and their employer's name, say why they are calling, end the call when asked, and show a caller ID with a return number.

A compliance checklist for AI-assisted outbound in Australia

• Record a consent basis on every contact in HubSpot: express, inferred from a relationship, or conspicuous publication. Add a source and a date.
• For conspicuous publication, keep where the address was published, check there is no "no marketing" statement, and confirm the message is relevant to their role.
• Do not use scraped lists or scraping tools to collect addresses. Treat a bought list as having no consent until you have checked it.
• Put your legal business name or ABN and real contact details in every email, including the agent's signature.
• Check that every agent email and sequence step carries a clear unsubscribe that works for 30 days. Sales emails sent from a personal inbox are the easy ones to miss.
• Make one opt out stop everything: the agent, sequences, marketing email and the rep's own inbox, within 5 working days.
• Keep "Review before sending" on, and set a daily cap you would be comfortable defending.
• Wash phone numbers against the Do Not Call Register and call within permitted hours.
• Have a lawyer check the campaign before it runs. This post is general information only. It is no substitute for legal advice on your campaign.

If your database is full of older contacts and you are not sure their consent still stands, start with waking up dead HubSpot contacts, Spam Act safe before the agent goes anywhere near them.

Frequently asked questions

Can an AI agent replace an SDR in Australia? It can take over most of the research, list building and first drafts. A person should still approve what gets sent and own every conversation, because the business carries the Spam Act responsibility for every message.

Is AI cold email legal in Australia? The Spam Act does not care whether a person or an AI wrote the email. A cold B2B email is legal only with consent, express or inferred, plus accurate sender identification and a working unsubscribe. Check specific campaigns with a lawyer.

Can I email a business address I found on a company website? Possibly. Under Schedule 2, clause 4 of the Spam Act, consent can be inferred if the address was conspicuously published with the person's or organisation's agreement, carries no statement refusing marketing, and your message is relevant to their role.

How much does the HubSpot Prospecting Agent cost? Since 14 April 2026, HubSpot charges US$1 per lead the agent recommends for outreach, paid as 100 HubSpot Credits. It needs a Starter, Professional or Enterprise subscription with HubSpot Credits.

Should I let the Prospecting Agent send automatically? For Australian outbound, keep "Review before sending" on. Spam Act breaches are counted per message, so a setup mistake repeats on every email an unattended agent sends.

Sources

• Spam Act 2003, Federal Register of Legislation, for the definition of a commercial electronic message, conspicuous publication (Schedule 2, clause 4) and per-message penalties.
• Avoid sending spam, ACMA, for consent, sender identification, unsubscribe rules, bought lists and address-harvesting software.
• Latitude Finance pays $3.96m for more spam breaches, ACMA, 15 April 2026.
• TAB pays $2.7m for telemarketing and spam breaches, ACMA, July 2026.
• Do Not Call Register and Dealing with telemarketing, ACMA, for registration rules and calling hours.
• Prospecting Agent and Use the prospecting agent, HubSpot, for features, autonomy settings and subscriptions.
• Customer Agent and Prospecting Agent: now you pay when the task is complete, HubSpot, for the per-lead price from 14 April 2026.

---

Want an AI prospecting workflow in HubSpot that does the research and drafting, and stays inside the Spam Act? See how we build AI agents, or talk to us.