AI use policy for a customer service team

A customer service team uses AI in two ways the law treats differently: a chatbot that talks to customers directly, and an assistant that drafts replies and summarises cases for a human agent. The chatbot makes statements the business is bound by and must not pretend to be a person; the assistant puts customers' conversations into a tool whose terms the business must have checked. The policy sets how each is used, what customers are told, how the chatbot's answers are controlled and how a customer reaches a human. A fixed £995 covers the AI use policy and the accompanying contract provisions, drafted for the business and delivered in five working days.

Who this is for

Businesses in England and Wales with a customer service function using chatbots, AI assistants, automated ticket handling or generated replies.

What matters in a customer service AI use policy

The chatbot, the agent assistant and the difference the customer sees

The policy distinguishes the customer-facing tools (a chatbot, an automated email responder, a voice assistant) from the agent-facing tools (reply drafting, case summarising, classification, knowledge search), because the customer-facing tools make statements to customers in the business's name and the agent-facing tools do not, and sets for each what it may do, what it must escalate and what it must never do (the chatbot does not handle complaints, vulnerability disclosures or disputes without a human; the assistant's drafts are read and owned by the agent who sends them).

Telling customers they are talking to a machine

A chatbot that presents as a person, uses a human name and photograph without saying it is automated, or deflects the question 'am I talking to a bot' is a misleading practice capable of breaching the consumer protection rules in the Digital Markets, Competition and Consumers Act 2024 and of breaching the UK GDPR's transparency requirements where it collects personal data; the policy requires every customer-facing tool to identify itself as automated at the start and on request, prohibits names and avatars that imply a person unless the automated nature is stated, requires the privacy notice to describe the tool, and requires the tool to tell the customer how to reach a person.

Accuracy, promises and the chatbot that agreed a refund

A statement by a chatbot about the business's products, prices or policies is a statement by the business, capable of forming a contract or a misrepresentation, and a court abroad has already held an airline to a refund policy its chatbot invented; the policy requires customer-facing tools to answer only from the business's approved knowledge base (not from the model's general training), to be tested before launch and after each change for the answers they give to the commonest and the riskiest questions, to be prevented from agreeing refunds, discounts, exceptions or contractual commitments beyond the rules the business has set, to escalate anything outside its scope, and to be monitored, with the customer terms stating the limits of what the chatbot can commit the business to.

Customers' data, conversations and the tools behind the desk

personal data entered into an AI tool is processing under the UK GDPR that needs a lawful basis, a notice to the individuals, a data processing agreement under Article 28 with the provider and, where the tool is used on people in ways that affect them, an impact assessment under Article 35; the policy requires conversations and case data to be processed only in tools under the business's data processing agreements (with training on inputs excluded and retention limited), prohibits agents from pasting customer conversations into consumer tools, requires the tools to be configured to redact payment card data and special category data the customer may volunteer, addresses the transfers under Article 46, and requires the privacy notice to describe the tools and the retention; the policy bars confidential information, trade secrets and clients' data from tools whose terms allow the provider to retain inputs or train on them, since the reasonable-steps test in the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality duties both look at what was done to protect the information.

Vulnerable customers, complaints and the human a customer can reach

Automated tools handle vulnerable customers badly, and the regulators of consumer-facing sectors expect businesses to identify vulnerability and respond appropriately; the policy requires the customer-facing tools to escalate indicators of vulnerability and distress to a person without delay, requires complaints to be handled by a person (with the chatbot able to log but not resolve them), requires a route to a human to be findable, and treats a decision about a customer made solely by a tool with legal or similarly significant effects (refusing a claim, closing an account, declining a refund the customer is entitled to) as one the law restricts: the Data (Use and Access) Act 2025 amended Article 22 of the UK GDPR so that a solely automated decision with legal or similarly significant effects is lawful outside special category data only with the safeguards of information, representations, human intervention and the right to contest.

The terms, the supplier and the contract provisions that go with the policy

The contract provisions drafted with the policy go into the customer terms (the automated nature of the tools, the limits of what they can commit the business to, the route to a person, the recording and analysis of conversations), the supplier agreement with the chatbot or assistant provider (the knowledge base the tool answers from, the testing and monitoring the provider supports, the data processing agreement, the exclusion of training on the business's data, the provider's liability for the tool's failures, the business's right to switch the tool off), and the staff contracts and handbook; the policy is reviewed when the tools change and after any incident, and the transcripts and test results are the evidence that the business controlled what the tool said.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Does our chatbot have to say it is a bot?

It does, at the start and on request, with no human name or avatar implying a person unless the automated nature is stated. Deception is what the consumer and data protection rules catch; automation itself is not the problem.

Our chatbot told a customer they could have a refund our policy does not allow. Are we bound?

Possibly: a chatbot's statement is the business's statement and a customer who relied on it has a case. The policy requires the chatbot to answer only from the approved knowledge base, to be unable to agree exceptions, and to be tested and monitored, and the customer terms state the limits of what it can commit the business to.

Can agents use an AI tool to draft replies?

On the business's approved tools under a data processing agreement, with the agent reading and owning every draft they send. Not by pasting customer conversations into a consumer tool.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a company using AI tools on customer data
• AI use policy for a sales team

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.