AI use policy for a sales team

Sales teams were the earliest adopters of AI tools: prospecting tools that find and enrich contacts, sequencing tools that generate outreach, call recorders that transcribe and coach, proposal generators that draft and price. Each touches the law: who may be contacted, where the contacts came from and who is told, the recording of calls with prospects who were not asked, the proposal that promises what the product does not do, and the confidential information that goes into a tool to draft a pitch. The policy sets the rules for each stage of the pipeline. I draft the AI use policy for the business, with the accompanying contract provisions, for a fixed fee of £995, delivered in five working days.

Who this is for

Businesses in England and Wales with a sales, business development or account management team using AI tools for prospecting, outreach, call analysis or proposals, in any sector.

What matters in a sales team's AI use policy

Prospecting, scraping and the data a tool finds

Prospecting and enrichment tools assemble profiles from professional networks, websites and data brokers that the business did not collect from the person, and Article 14 of the UK GDPR requires the business to tell those people, within a month or at first contact, what it holds and where it came from, with a lawful basis (legitimate interests, with the balance recorded) and within the terms of the sources (which for professional networks usually prohibit scraping); entering personal data into an AI tool is processing under the UK GDPR and brings with it the need for a lawful basis, a notice to the individuals, an Article 28 data processing agreement with the provider and, where people are affected, an Article 35 impact assessment, and the policy requires prospecting tools to be approved with their sources and terms checked, the Article 14 notice built into the first outreach, the privacy notice to describe the prospecting, and the data retained for a stated period and then deleted.

Generated outreach and the marketing rules that still apply

Electronic marketing to individuals requires consent under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 unless the soft opt-in applies, so that generated email sequences to sole traders and partners need consent, while sequences to named individuals at corporate subscribers may rest on legitimate interests with an opt-out and relevance to the role; the policy requires the list to be sorted before the sequence runs, every message to identify the business and carry an opt-out that works (an automated sequence that ignores a reply saying stop is the complaint), generated messages to be read before they are sent (a tool that invents a shared connection or a previous conversation has made a misrepresentation in the business's name), and calls to be screened against the Telephone Preference Service under regulation 21; the Data (Use and Access) Act 2025 raises the fines under the Regulations to the UK GDPR level on commencement.

The CRM, the call recordings and the tools that listen

Call recording and transcription tools that join sales calls, record them, transcribe them and generate coaching and CRM notes process the prospect's data and the words of everyone on the call, and the policy requires the prospect to be told the call is recorded and transcribed by a tool at the start (which the business's privacy notice also states), requires the recording tool to be under a data processing agreement with training excluded and retention limited, requires sensitive content a prospect volunteers to be handled under the right conditions or deleted, sets the retention of recordings and transcripts, and prohibits recording where the prospect objects.

Proposals, pricing and the promise the tool made

A generated proposal, quote or statement of work is an offer the business may be bound by, and a tool that describes features the product does not have, quotes a price the business has not approved, or commits to a delivery date, a service level or a warranty the contract does not provide has made a representation the customer may rely on; the policy requires every generated proposal to be checked against the product's actual capabilities and the business's approved pricing and terms before it goes to a prospect, requires commitments on scope, dates, service levels and warranties to come from the approved templates, requires the proposal to state that the contract terms govern, and makes the salesperson who sends it responsible; the contract provisions carry an entire agreement clause, which helps but does not excuse a misrepresentation.

Competitors, confidential information and the pitch that leaked

the business's trade secrets, confidential information and clients' data must not be put into tools that may retain inputs or train on them, which is what the reasonable-steps requirement in the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations demand, and a sales team's prompts contain the business's pricing, its pipeline, its win-loss analysis, its customers' requirements under NDA and its competitive positioning; the policy requires sales tools to be on business accounts with training excluded, prohibits a prospect's confidential requirements (disclosed under an NDA for the tender) from entering any tool the NDA does not permit, prohibits generating comparative claims about competitors that cannot be substantiated under the Business Protection from Misleading Marketing Regulations 2008, and treats the leaving salesperson's tool accounts as part of the offboarding.

The contract provisions that go with the policy

The contract provisions drafted with the policy go into the customer terms (the entire agreement clause, the pre-contract statements excluded, the recording and analysis of calls disclosed, the prospect's data processing described), the supplier agreements with the prospecting, sequencing, recording and proposal tools (sources and terms warranted, training excluded, retention, the data processing agreement, the location of processing, the business's right to delete), and the sales team's contracts and handbook (the policy incorporated, the approved tools, the ownership of prompts and outputs).

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Our prospecting tool finds contacts on professional networks. Is that allowed?

Only within the network's terms (which usually prohibit scraping), with a lawful basis recorded, the people told at first contact where their data came from, and the data retained for a stated period. The policy requires the tool's sources and terms to be checked before it is approved.

Can our sequencing tool email a list without consent?

Named individuals at companies on legitimate interests with an opt-out and relevance to their role; sole traders and partners need consent or the soft opt-in. Every message identifies the business, carries a working opt-out and is read before it is sent.

Do we have to tell prospects our call recorder is on?

At the start of the call, with the privacy notice stating the recording and transcription. The tool is under a data processing agreement with training excluded, retention is set, and recording stops where the prospect objects.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Email marketing and consent for a small business
• AI use policy for a customer service team

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.