Stage 4: What must be settled before customer data or live calls enter the system?

What are the non-negotiable safety boundaries?

Our recommended starting boundary is administrative assistance, not autonomous technical diagnosis. Have your technical lead approve the emergency process, including what happens if the office or on-call engineer does not answer.

A suspected gas or carbon-monoxide emergency must not become an ordinary callback request. National Gas directs gas and carbon-monoxide emergencies to 0800 111 999; Northern Ireland’s official guidance gives 0800 002 001 for gas emergencies. Gas Safe’s published guidance separately directs LPG users to their supplier. Build the applicable geography and fuel type into the approved procedure. (nationalgas.com)

• [ ] Prohibit improvised diagnosis, appliance-reset instructions and assurances that equipment is safe.
• [ ] Separate routine loss-of-heating enquiries from suspected gas, CO, fire or medical emergencies.
• [ ] Approve emergency wording with the relevant technical professional.
• [ ] Test emergency handling even if the planned service is described as routine booking only.
• [ ] Do not require completion of a sales questionnaire before urgent guidance.
• [ ] Prohibit invented attendance times, engineer availability and emergency-service promises.
• [ ] Keep an independently usable phone-routing fallback.

These are deployment controls, not a substitute for emergency-service or qualified technical advice.

What should the UK GDPR and supplier review cover?

As a buying condition, ask whether recordings, transcripts or job records are used for model training, product improvement or evaluation. Require the answer to match the actual contract and configuration. Do not upload live customer recordings simply because an agency offers a free demonstration.

Current-law check: ICO guidance updated on 19 June 2026 states that all DUAA data-protection provisions were in force. Some AI-related guidance remains under review, so use current material rather than an old generic GDPR checklist. (ico.org.uk)

The regulator’s agentic-AI consultation opened on 8 October 2026 and closes on 20 November 2026. Its existence is not an approval scheme for suppliers or a reason to postpone existing obligations. (citizen-space.ico.org.uk)

Can you automate quotation follow-up and maintenance reminders?

Do not classify every message to an existing customer as a service message. ICO guidance distinguishes factual appointment information from promotional content; adding an offer can make the communication direct marketing. Have the actual templates, recipient categories, consent or soft-opt-in basis and suppression process reviewed. (ico.org.uk)

Keep outbound AI sales calls outside the first pilot unless their legal treatment has been assessed. ICO guidance requires specific consent for automated marketing calls, and its published innovation advice applies that rule to a system using an AI-generated recorded greeting. That example does not settle every conversational-AI architecture. (ico.org.uk)

Stage output: approved operating boundaries, a data-flow map and a risk register with named owners. Unresolved safety, privacy or access-permission issues are launch blockers.