Do not treat a supplier interview as UK legal clearance. The ICO’s AI guidance covers accountability, transparency, lawfulness, accuracy and security/data minimisation. Its reviewed page also says the guidance is under review following the Data (Use and Access) Act. ICO AI guidance
Marketing calls, emails and texts also engage PECR requirements alongside data-protection rules. The ICO’s PECR page carries its own update warning. Before launching automated outreach, obtain advice specific to the communication, recipient and deployment—not a generic assurance that the platform is “GDPR compliant”. ICO PECR guidance (ico.org.uk)
Our proposed purchasing boundaries are:
- No autonomous safety diagnosis: specify approved escalation rather than improvised advice.
- No unsupported appointment commitments: distinguish an enquiry, a booking request and a confirmed appointment.
- No unapproved pricing or suitability promises: keep technical and commercial authority explicit.
- No silent expansion of scope: approving inbound enquiry handling should not automatically authorise outbound campaigns or equipment control.
These are recommended procurement controls, not a certification of safety or legal compliance.
Sources cited on this page
- ICO AI guidance ↗ico.org.uk
- ICO PECR guidance ↗ico.org.uk