Buy evidence, configuration and accountable maintenance—not a statement that the system is compliant. The following is this desk’s proposed acceptance pack, derived from the obligations and official guidance above.
| Deliverable | Evidence to request | Suggested buyer owner |
|---|---|---|
| Workflow and jurisdiction map | Permitted actions, customer types, countries and escalation boundaries | Operations director |
| Data-processing pack | Roles, contract terms, providers, retention and transfer assessment | Privacy lead or owner |
| Communications rules | Separate inbound, service-message, email/SMS-marketing and outbound-voice logic | Office/sales manager |
| Complaints and rights demonstration | Complaint capture, acknowledgement, escalation and record retrieval | Office manager |
| Approved knowledge register | Source, effective date, review date and approver for grants, prices and technical claims | Technical lead |
| Subscription readiness plan | Plan classification, configurable notices, cancellation and final-rule update responsibility | Finance/owner |
| Safety and outage tests | Approved escalation, human fallback and failure evidence | Service manager |
| Exit package | Account control, exports, deletion responsibilities and handover instructions | Owner/finance |
What should happen in the next 30 days?
Days 1–7: identify exposure. Inventory active automations, stop unapproved outbound campaigns, confirm complaint ownership, and identify social-housing work affected by the November change.
Days 8–14: inspect the evidence. Check processor terms, permission records, recordings, international access and grant wording. Classify consumer maintenance plans and confirm relevant MCS transition instructions.
Days 15–21: test exceptions. Run customer objections, cancellations, conflicting eligibility information, safety concerns, duplicate bookings and unavailable-human scenarios.
Days 22–30: approve a bounded pilot. Record who signs off each workflow, which failures stop the pilot, how rules are updated and what evidence survives an agency exit.
Bottom line: commission an AI receptionist or automation project only when the contractor can explain what the system is allowed to do, demonstrate how exceptions reach people, and replace its supplier without losing the records needed to operate responsibly.