Tools and providers
Part of A procurement process for AI marketing tools
AI marketing tools software selection: put it in writing before you sign
AI marketing tools software selection leaves a paper trail: a four-part procurement file, written broker-data answers, three contract clauses and GDPR checks.
What to take away
- Selection should leave a paper traila four-part file, written data answers, contract clauses and a dated sign-off.
- The UK government's Guidelines for AI procurement give the four parts: problem, options, evidence, decision.
- Audience data bought from brokers puts the accountability on your organisation, so get the provenance answers in writing.
- Contract terms on data deletion and model changes decide whether the choice survives year one.
- UK GDPR lawful basis and ICO registration apply to private buyers, not just public bodies.
Start with a four-part file
The UK government's Guidelines for AI procurement were drafted for public bodies, to help buyers evaluate suppliers and procure AI technologies. The four-part structure works for any buyer of AI marketing tools: problem, options, evidence, decision.
It asks for a problem statement, a reasoned shortlist, an evidence log and a documented decision. These artefacts travel between marketing, legal and finance, which matters when all three sign off.
Four parts of a procurement file
- Problem: define the need
- Options: longlist the vendors
- Evidence: log what each showed
- Decision: sign off across teams
The problem statement stops a vendor redefining your need during a demo. The evidence log records what each supplier actually showed, with dates.
Fix the scoring weights before the first demo. The rubric and review method sit in a separate guide. Here, the scored sheet simply goes into the evidence log with the scorer's name and the date.
Get broker-data answers in writing
A tool that ingests audience data bought from a broker puts the accountability on your organisation. The ICO guidance on data brokers says you must undertake appropriate due diligence, and that simply accepting a broker's assurances is not enough.
Broker data duties before campaign use
- Provenance chain in writing
- Consent and lawful basis
- How long data stays in tool
- Who removes it afterwards
Provenance, consent, lawful basis and retention all need written answers from the vendor. A supplier who answers data questions only on a call has already told you something.
File each reply in the evidence log, and take the wider rules from the data protection guidance.
Put three clauses in the contract
Price gets the attention and carries the least risk. Ask for the sub-processor list before signature, then negotiate three clauses.
- Deletion on exitpersonal data is deleted or returned within 30 days of termination, confirmed in writing.
- Model-change noticeat least 30 days' written notice before a material change to the model or a new sub-processor.
- Exit assistancefull export in a machine-readable format at no extra charge.
Example wording for the first:
On termination the supplier shall delete or return all client personal data within 30 days and confirm deletion in writing.
For example, a team paying £400 a month for a tool nobody can export from has bought a problem, not a platform. A slower read of the whole agreement is set out in commercial contracts.
Match the tool type to the situation
Pick the tool type from your situation, then run the paper trail on the shortlist. Each row below pairs a situation with what to choose and what to avoid.
Choose
- One channel, small team, no developer
- A packaged tool with published pricing and a clean export
- Consent-sensitive list or regulated sector
- A vendor that documents provenance and deletion
- Group with several brands
- Role-based access and audit logs as standard
- Testing agents before committing
- A framework with a sandbox and clear hosting terms
Avoid
- One channel, small team, no developer
- Annual seat deals you cannot leave mid-term
- Consent-sensitive list or regulated sector
- Vendors who answer data questions only on a call
- Group with several brands
- Tools where every user sees every audience
- Testing agents before committing
- Frameworks that assume an engineering team you do not have
Agent frameworks are kits, not products. Budget engineering time as its own invoice line, because it will not appear on the supplier's.
What happens after signature, where the value is won, is covered in the account of going from pilot to rollout.
Confirm the UK GDPR and registration duties
No exemption exists for private companies. Any AI tool that processes personal data needs a lawful basis under UK GDPR, and consent is only one route. The ICO's guidance on AI and data protection covers profiling, automated decisions and impact assessments.
Most organisations processing personal data must pay the ICO data protection fee and appear on the register. Confirm your entry covers the marketing uses you are buying.
Regulated sectors add rules. Financial promotions follow FCA requirements whatever tool drafts them. AI-generated ads also sit under the ASA codes, and the advertising rules set out the sign-off checks.
Hold these papers before you sign
- Problem statement agreed by marketing, legal and finance.
- Evidence log with dated notes of what each supplier showed.
- Scored sheet with the scorer's name, the date and the evidence each score rests on.
- Written provenance, consent and retention answers for any broker data.
- Sub-processor list received before signature.
- The three clauses agreeddeletion on exit, model-change notice, exit assistance.
- ICO registration entry checked against the uses you are buying.
Common questions
Do private companies need a formal procurement process?
No law forces one. The evidence file protects the budget decision, and a small team can run the same four steps on a single page.
How long should selection take?
Long enough to score two or three options properly. For most marketing teams that means a few weeks, not a few days.
What usually makes a selection fail?
A rubric written after the demos. By then the loudest presentation has set the terms, and data questions arrive too late to change the shortlist.
Can we start with one tool and expand?
Yes, if the first contract has clean exit and export terms. Otherwise you are expanding inside a tool you cannot leave.
