Reject options that fail essential controls before applying a commercial score. A low price cannot compensate for unsafe advice, unauthorised disclosures or an appointment system that fabricates confirmations.
Which controls are non-negotiable?
The requirements below combine official guidance with the desk’s recommended implementation tests. They are procurement guidance, not legal certification.
| Issue | Evidence or control to require | Why it belongs in the comparison |
|---|---|---|
| Safety-sensitive enquiries | Expert-approved escalation wording; no autonomous diagnosis; geographically appropriate emergency routing | HSE directs suspected gas leaks to emergency action and requires relevant competence for gas work. A receptionist must not replace that route with a routine booking. (hse.gov.uk) |
| Regional emergency differences | Validate the emergency process for the areas and fuels served | Gas Safe’s guidance distinguishes Great Britain, Northern Ireland and other territories, and directs LPG users to their supplier. (gassaferegister.co.uk) |
| Data-processing responsibilities | Identify controller/processor roles and obtain appropriate contractual terms, including subprocessors and end-of-contract handling | ICO guidance covers documented instructions, confidentiality, security, assistance and contract-end provisions. (ico.org.uk) |
| Recording, transcription and reuse | Establish purposes and lawful bases; explain processing; minimise collection and retention; resolve training use explicitly | ICO AI guidance emphasises transparency, purpose limitation, data minimisation and storage limitation. (ico.org.uk) |
| International access | Map entities, locations and remote access; identify the applicable transfer mechanism where required | ICO guidance treats making information accessible to a separate overseas organisation as potentially relevant to restricted-transfer rules. (ico.org.uk) |
| Impact assessment | Document screening and complete a DPIA where processing is likely to create high risk | The ICO identifies innovative technologies, including AI, within its DPIA guidance; assess the actual processing rather than assuming every deployment is identical. (ico.org.uk) |
| Prompt injection and tool misuse | Restrict accessible records and actions; validate tool requests; test malicious caller instructions | NCSC guidance explains why prompt injection requires system-level risk management rather than treating the prompt as a complete security boundary. (ncsc.gov.uk) |
| Operational security | Named incident owner, logs, monitoring, controlled updates and recovery procedures | NCSC guidance extends security obligations across development, deployment and ongoing operation. (ncsc.gov.uk) |
Recommended buyer standard: callers should be told clearly when they are speaking to an automated assistant and be given an intelligible alternative when necessary. Have the privacy wording and recording arrangements reviewed for the actual deployment; do not assume either that consent is always the only lawful basis or that a generic recorded announcement resolves every obligation. (ico.org.uk)
Are outbound AI sales calls just ordinary live calls?
Do not accept that assumption without specialist review. ICO guidance defines live marketing calls by reference to a live person and separately describes automated marketing calls involving recorded messages. The latter require specific consent; general marketing consent is not enough. The reviewed material does not conclusively classify every real-time conversational AI architecture. (ico.org.uk)
Keep inbound enquiry handling and outbound marketing as separate purchase scopes. Before enabling AI-led cold calling, reactivation or promotional callbacks, obtain a documented assessment of the actual technology, audience and permissions.
Sources cited on this page
- hse.gov.uk ↗www.hse.gov.uk
- gassaferegister.co.uk ↗www.gassaferegister.co.uk
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
- ncsc.gov.uk ↗www.ncsc.gov.uk
- ncsc.gov.uk ↗www.ncsc.gov.uk
- ico.org.uk ↗ico.org.uk