What privacy, marketing and safety checks are required before launch?

How should you handle personal information and recordings?

Have the responsible privacy lead document the purpose and lawful basis of the processing. Where ordinary legitimate interests are proposed, the ICO describes a necessity and balancing assessment; do not use the phrase as a blanket justification for any AI feature. (ico.org.uk)

Create a data-flow map covering the telephone provider, transcription service, AI provider, automation platform, job system, monitoring tools and any support contractor. Request processor terms, subprocessor information, retention settings, access controls and a clear explanation of whether data is used to train or improve models.

For recorded staff/customer calls, the ICO’s monitoring guidance addresses necessity, proportionality and informing both workers and callers. It also says callers must be told that recording is happening and why; further privacy information can be supplied separately. Recording and transcription should therefore be deliberate configuration decisions, not unnoticed defaults. (ico.org.uk)

Recommended implementation controls:

• Explain that the caller is dealing with an automated assistant.
• Explain recording or transcription accurately where used.
• Offer a practical alternative for someone who cannot use the automated route.
• Set separate retention periods for audio, transcripts, summaries and operational records.
• Test deletion across downstream copies, not only the original call platform.
• Keep secrets and account credentials out of prompts and customer-facing logs.

Do not assume a UK hosting location settles international-transfer questions. The ICO’s January 2026 guidance also considers personal information made accessible to separate organisations outside the UK, and describes the mechanisms required for restricted transfers. (ico.org.uk)

Does every AI pilot require a DPIA?

Screen the actual processing rather than assuming either “all AI needs one” or “small businesses are exempt”. The ICO requires a DPIA for processing likely to result in high risk and provides screening guidance; its current page also carries a notice that guidance is under review following the Data (Use and Access) Act. (ico.org.uk)

Record the screening decision. If a DPIA identifies high risks you cannot sufficiently reduce, seek appropriate advice and follow the ICO’s consultation requirements before proceeding. (cy.ico.org.uk)

Are quote chasers and maintenance reminders marketing?

Classify the purpose and content of each message. The ICO distinguishes purely administrative service messages from promotional communications; adding an offer to an appointment reminder can make it direct marketing. (ico.org.uk)

For unsolicited email or text marketing to individual subscribers, the ICO requires consent or a valid soft opt-in. Sole traders and some partnerships are included; public availability of an address is not consent. A requested message is treated differently from unsolicited marketing. (ico.org.uk)

If using the products-and-services soft opt-in, check the collection circumstances, similarity of the service and opt-out opportunities at collection and in subsequent messages. Keep outbound AI marketing calls outside this first pilot: the ICO states that automated marketing calls require consent for both individuals and businesses. (ico.org.uk)

What must happen with gas or carbon-monoxide concerns?

An emergency must not become an ordinary sales qualification or callback task. Have a competent technical lead approve the exact routing and wording for your operating area and fuel types.

National Gas directs callers reporting gas or carbon-monoxide emergencies to 0800 111 999. Build the applicable official emergency route into the approved procedure, and verify regional and fuel-specific arrangements rather than assuming one script fits every UK enquiry. (nationalgas.com)

For this pilot, prohibit diagnostic or repair instructions. HSE states that people employed to work on domestic gas appliances must be Gas Safe registered and competent for that work; AI handling an enquiry does not replace qualified technical judgement. (hse.gov.uk)

Never make a caller wait for your routine callback process instead of following the relevant emergency guidance. Test emergency handling even if you advertise only routine servicing.