Questions to ask before using an AI tool: UK GDPR and FCA
The questions to ask a provider before client data goes into an AI tool.
Questions to ask before you use an AI tool with client data. What we found in each provider's published information is a starting point for your own checks, not a compliance sign-off. The FCA does not approve or endorse software.
Checklist: questions to ask a provider
Print this page or copy the list into your own supplier file, with the provider's answers and source links.
- UK GDPR. Are you the processor and is our firm the controller? Is a DPIA needed for the client data we plan to use, including health data for protection?
Provider's answer and source: ______________________ - DPA. Is a data processing agreement offered, and on which plan? Is there a sub-processor list, and how are changes notified? What is the breach notification timing?
Provider's answer and source: ______________________ - Hosting and transfers. Where is client data stored and processed, including AI processing? Which transfer mechanism covers data leaving the UK?
Provider's answer and source: ______________________ - Training on your data. Do you or your AI suppliers train on our data? Is it on by default, and can an admin switch it off for the whole firm?
Provider's answer and source: ______________________ - Retention. How long are prompts, recordings and outputs kept? Can we delete them, and what happens at the end of the contract?
Provider's answer and source: ______________________ - Certifications. Which certifications are held (ISO 27001, SOC 2 Type II, Cyber Essentials)? Can we see the report or certificate?
Provider's answer and source: ______________________ - Recording consent. How are clients told before a call or meeting is recorded?
Provider's answer and source: ______________________ - SYSC 8 outsourcing. If the tool supports regulated activity, what oversight, audit and exit rights do we have?
Provider's answer and source: ______________________ - Record keeping. Can we export recordings, notes and outputs to keep as our own records (COBS 11.8, SYSC 9)?
Provider's answer and source: ______________________ - Consumer Duty. How accurate are the outputs, and how does the tool help us treat customers in vulnerable circumstances fairly?
Provider's answer and source: ______________________ - Human checks of AI output. Who reviews AI output before it reaches a client or lender, and how is that approval recorded?
Provider's answer and source: ______________________
Why each question matters
Who this page is for and what it covers
For advisers and firm principals looking at an AI tool. It sets out the questions to ask a provider. It is not legal or regulatory advice, and your network or compliance team has the final say.
Start with the data
What client data will go into the tool, including health data for protection, which is special category data. Whether a DPIA is needed.
Where the data goes
Storage and processing location. Transfer mechanisms for data leaving the UK: UK IDTA, UK Addendum to SCCs, UK-US data bridge. Storage location and AI processing location can differ.
The contract
Is a DPA offered, and on which plan. Is there a sub-processor list, and how are changes notified. Breach notification timing. Return and deletion at the end of the contract.
AI training and retention
Does the provider or its AI suppliers train on your data. Is it on by default. Can an admin switch it off for the whole firm. How long prompts, recordings and outputs are kept.
Security evidence
ISO 27001, SOC 2 Type II, Cyber Essentials or Cyber Essentials Plus. How to ask for the report and how to check a Cyber Essentials certificate on the IASME certificate search. What "aligned" or "working towards" means compared with certified.
Recording calls and meetings
Telling clients before recording, and how each tool helps (visible bot, automatic notice, or none, as with handheld recorders). Where FCA record-keeping rules may apply (COBS 11.8, SYSC 9), and checking with your firm whether a tool's recordings count as your records.
FCA points to cover
Outsourcing oversight (SYSC 8) where a tool supports regulated activity. Consumer Duty (PRIN 2A): accuracy of AI outputs, fair treatment of customers in vulnerable circumstances. Human review of every AI draft before it reaches a client or lender. Audit trail of who approved what. SM&CR accountability for the decision to use the tool.
Free and consumer plans
Why consumer versions of general AI tools often have different training and retention defaults from business plans.
Keep it under review
Re-check when the provider changes terms, adds sub-processors or releases new AI features.
Using a tool, or this checklist, does not make a firm compliant. Your network or compliance team has the final say. Each tool in the AI directory has a "Questions to ask the provider" section with what the provider publishes, checked 20 Oct 2026.
See also the ICO's guidance on AI and data protection and the FCA's approach to AI.