Make continued operation and exit demonstrable. The ICO’s controller–processor guidance covers documented instructions, security, subprocessors, assistance, end-of-contract provisions and audits. The ICO marks this guidance as under review following the Data (Use and Access) Act, so check the current position when contracting. (ico.org.uk)
Our commercial checklist adds:
- Account control: agreed ownership and administrator access for telephony, workflows and connected systems.
- Exact integration scope: supported records and actions, licence dependencies, write permissions and duplicate prevention.
- Fallback: an approved human route, visible failed actions and a way to disable automation without losing enquiries.
- Costs: included usage, overages, support hours, change fees and the response to approaching spending limits.
- Data map: what is collected, where it goes, who can access it and when it is deleted.
- Exit rehearsal: export usable records and instructions, revoke access and demonstrate the replacement process before a long renewal.
For customer-facing AI, the ICO’s transparency guidance calls for privacy information covering purposes, retention and sharing. Put that information into the operational design, not just the supplier’s sales pack. (ico.org.uk)
These are procurement checks, not legal certification; have the final arrangement reviewed where necessary.
Sources cited on this page
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
PUT THE RESEARCH TO WORK