Reviewing an AI vendor's terms for a customer service tool

A customer service AI speaks to the business's customers in its name, and the vendor's terms say the business is responsible for everything it says. The review reads the terms for what controls the vendor gives the business over the tool's answers, what happens to customers' conversations, whether the tool identifies itself as automated, what the integrations with the business's systems do with the data, and who carries the cost when the tool promises a customer something the business does not offer. The business receives a review of the AI supplier's terms within five working days for a fixed £595, with a note on what is permitted, what is reserved and what to ask for.

Who this is for

Businesses in England and Wales buying or using AI chatbots, virtual agents or agent-assist tools in customer service, and the people who have to sign off on them.

What matters in a customer service tool vendor's terms

What the tool says to customers and who the vendor says is responsible

The vendor's terms state that the business is responsible for the content, accuracy and lawfulness of the tool's responses, for its configuration and for its use, and disclaim any warranty that responses are accurate or appropriate, and the review reports that allocation together with what the vendor does commit to (the service's availability, its security, the controls it provides), because a customer who relies on the chatbot's statement has a claim against the business and the vendor's terms leave it carrying that risk; the note tells the business what controls and testing it needs before launch.

The knowledge base, the controls and the promise the vendor makes about staying on script

The review reports what the terms say about confining the tool's answers to the business's approved knowledge base (a hard restriction or a preference the model may depart from), the guardrails the vendor provides (refused topics, escalation triggers, no unauthorised commitments), the testing and monitoring tools, the vendor's commitments when it changes the model, and the business's ability to switch the tool off; a vendor that describes the knowledge base as guidance rather than a limit is telling the business something.

Customers' conversations, training and the transcripts the vendor keeps

any personal data that goes into an AI tool is being processed under the UK GDPR, which calls for a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and an Article 35 impact assessment where the use bears on people, and the review checks the vendor's data processing addendum for the Article 28 terms, the retention of conversation transcripts, the vendor's use of conversations to train or improve its models (whether inputs train or improve the provider's models, and how long they are kept, is set by the provider's terms, with business tiers generally excluding training and consumer tiers generally not), the handling of payment card data and special category data customers volunteer (redaction, exclusion from storage), the sub-processors (the model providers behind the tool) and the transfers under Article 46, and the deletion on termination; the business's privacy notice has to describe what the review finds.

Disclosure to customers and the vendor's own branding in the conversation

The review reports whether the tool can be configured to identify itself as automated at the start of the conversation and on request (which the consumer protection rules and the UK GDPR's transparency requirements make necessary), whether the vendor requires or permits its own branding in the conversation ('powered by'), whether the vendor's terms require the business to display any notice, and whether the tool can be given a name and avatar without implying a person; article 22 of the UK GDPR, as amended by the Data (Use and Access) Act 2025, governs decisions with legal or similarly significant effects taken solely by an AI tool, permitting them outside special category data where the person is informed, can make representations, can obtain human intervention and can contest, and the review checks that the tool can be prevented from taking such decisions (closing an account, refusing a claim, declining a refund the customer is entitled to) and configured to escalate them.

Integrations, the CRM and the data that flows both ways

Customer service tools connect to the business's CRM, ticketing and order systems, reading customer records and writing conversations back, and the review reports what the integrations access, what the vendor's terms say about the data it reads from the business's systems (whether it is covered by the training exclusion and the retention terms, or treated differently), what the tool writes back and whether the business controls it, and what happens to the integrations' data when the service ends; confidential information, clients' data and trade secrets are kept out of tools whose terms permit retention of inputs or training on them, because both the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations ask what steps were taken to protect them, and a tool with read access to the CRM holds the business's customer database.

Liability for the chatbot's statements and the indemnity the business will not get

The vendor's terms cap its liability low, exclude liability for the tool's responses and for the business's reliance on them, and require the business to indemnify the vendor for claims arising from the tool's use, and the review reports the exposure the business carries (customer claims, regulatory complaints, the cost of honouring a chatbot's promise), what to ask for (knowledge base confinement, notification of model changes, the data processing addendum, training excluded, retention set, redaction of payment and sensitive data, a higher cap for data breaches), and what the business must do on its own side (the chatbot terms, the testing, the monitoring, the escalation route, the privacy notice).

What it costs

AI supplier review, £595. You are buying an AI product and want to know what you are agreeing to. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

The vendor says we are responsible for everything the chatbot says. Can we change that?

Not much: vendors will not warrant responses. You can ask for a commitment on confining answers to your knowledge base and notification of model changes, and you must have the testing, monitoring and escalation in place before launch. The review tells you what the terms leave with you.

Does the vendor train on our customers' conversations?

On business tiers usually not, on consumer tiers usually yes, and some vendors reserve 'improvement' uses. The review reads the exclusion for your tier, the retention of transcripts and the handling of card and sensitive data, which your privacy notice must describe.

Can the chatbot be made to say it is a bot?

The review checks that it can, at the start and on request, without a name or avatar implying a person, and that it can be stopped from taking decisions the law restricts and configured to escalate them. A tool that cannot do those things is one to avoid.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• Chatbot terms for a website
• AI use policy for a customer service team

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.