Three questions to ask a UK AI marketing vendor before signing

What to take away

Why three questions beat a long vendor questionnaire

Most AI marketing tools questionnaires run to forty rows. Vendors answer them with links to a trust page and a security badge. Procurement managers then file the response and move on.

Three questions work better because each one exposes a commercial commitment. Data processing terms, training and exit are where the money and the legal risk sit. Everything else, such as uptime or support hours, is negotiable later.

The three also map onto the documents you can actually enforce. A signed data processing agreement, a training clause, and a termination and deletion schedule are all contract terms. A questionnaire answer is not.

UK buyers have a further reason to narrow the list. The Information Commissioner's Office sets out controller and processor duties that shape what a vendor contract must contain, so you are testing compliance rather than collecting trivia. The ICO's controllers and processors guidance is the reference to hold against any answer you receive.

A short list also survives the sales process. Long questionnaires get passed to a solutions engineer who leaves. Three questions go to the account director, the lawyer and the data protection officer, and the answers come back signed.

If you want a wider set of checks before you reach this stage, our vendor due diligence walkthrough covers the groundwork.

What the three questions are

Each has a follow-up. Ask for the document, not the summary. Ask for the setting, not the assurance. Ask for the deletion certificate, not the policy.

Question one: what do your data processing terms say?

The Data processing terms question is the first because it fixes the roles. Under UK GDPR, the marketing team using the tool is normally the controller and the vendor is the processor. That matters when a client complains or a regulator asks.

Ask for the current data processing agreement before the pricing call. Check that it names the processing purpose, the categories of personal data, the retention period and the sub-processors. A generic agreement that covers every customer is a warning sign.

Sub-processors are where UK deals go wrong. Many AI marketing tools route queries through a technology provider, a cloud host and an analytics service. Each one is a sub-processor, and each needs to be listed with its location.

International transfers need a mechanism. If a sub-processor sits outside the UK, the agreement should reference the UK International Data Transfer Agreement or the addendum to the EU standard contractual clauses. Ask which one, and ask for the transfer risk assessment.

The clauses to read aloud

A vendor that will not sign your own data processing terms is telling you something. It may be fine for a small pilot and wrong for a client campaign with personal data in it.

This is also where commercial contracts repay a slow read, because the data terms and the liability cap are usually in different schedules.

Question two: do you train models on our client data?

The Model training on client data question is the one vendors answer vaguely. "We may use aggregated data to improve our services" is not an answer. It is a permission you have just granted.

Ask three things. Does the vendor train on inputs and outputs? Is training on by default for your account tier? Can it be turned off per workspace, and is that in the contract?

Marketing data is unusually sensitive here. Input logs can contain customer names, email addresses, campaign performance figures and unreleased creative. Training on that material can surface it to another customer.

The ICO's artificial intelligence guidance sets out the data protection expectations for AI tools, including transparency and the lawful basis for processing. Use it to test whether the vendor's answer holds up.

Get the answer in writing with a named control. "Training is disabled by default on business plans and can be confirmed in the workspace settings" is usable. "We take privacy seriously" is not.

Example: the two answers

A mid-market retailer in Manchester asked two shortlisted AI marketing tools the same question. Vendor A replied that training was off by default, named the workspace toggle, and offered a contract clause confirming it. Vendor B replied that data "may be used to improve quality" and pointed to a privacy policy.

The retailer ran a two-week pilot with both. Vendor B's terms would have required a legitimate interests assessment and a client notification for every campaign. Vendor A needed no change to existing client contracts. The pilot cost was identical. The decision was not.

Question three: what happens at exit and data deletion?

The Exit clause question is the one buyers skip, then regret. AI marketing tools accumulate data: query history, audience segments, tuning adjustments, dashboards and integrations. Leaving means getting that out and getting it deleted.

Ask for the deletion timeline in days, and ask what proof you receive. A written confirmation is standard. A deletion certificate or a third-party attestation is better for regulated clients.

Ask about export formats. If the vendor only exports CSV summaries, you lose the segment logic and the configuration behind it. That is the work you paid for.

Check the notice period and the wind-down. A thirty-day termination right is useless if deletion takes ninety days and the subscription auto-renews before it starts.

Exit checklist

Exit terms are also a pricing question. A vendor that charges for data export at exit has priced your lock-in, and you should compare that figure across the shortlist rather than the monthly fee alone.

Reading answers against UK GDPR and CMA guidance

You now have three written answers. The next step is checking them against the UK framework, not against the vendor's confidence.

Start with the roles. The ICO's controllers and processors material explains what a processor may and may not do, including acting only on documented instructions. If the vendor claims it can use your data for its own product development, it is stepping outside that role.

Then check the AI-specific expectations. Transparency, lawful basis, data minimisation and accuracy all apply to marketing tools just as they do to any processing. An answer that cannot name the lawful basis for training is incomplete.

Consumer protection sits alongside data protection. The Competition and Markets Authority has a role in digital markets and consumer protection, and its consumer enforcement guidance covers unfair commercial practices. That matters if the tool automates pricing, urgency messaging or personalised offers to consumers.

The CMA itself is worth knowing as an institution, not just its guidance. Its digital markets work shapes how large platforms behave, which feeds into the tools built on top of them.

Two more UK bodies touch this work. The Advertising Standards Authority applies the advertising codes to campaign creative produced with any tool, and the rules on misleading claims apply in full. Ofcom regulates online safety duties that can reach user-generated content in campaign platforms.

Where vendors commonly fall short

None of these is fatal on its own. Together they suggest a vendor that has not been through a serious UK procurement before.

Turning answers into a scored decision

Score the three answers before you score the product. A simple weighted sheet keeps the decision defensible when a stakeholder prefers the demo they liked.

Give data processing terms the heaviest weight if you handle client personal data at scale. Give training terms the heaviest weight if your campaigns contain unreleased or commercially sensitive material. Give exit the heaviest weight if you expect to change tools within two years.

Score each answer on evidence, not sentiment. A signed agreement scores higher than a policy link. A named toggle scores higher than a verbal assurance. A deletion certificate scores higher than a promise.

Scoring sheet

Run the same sheet across every shortlisted vendor. A supplier comparison without weightings tends to reward whichever demo was slickest, which is how teams end up with tools they cannot leave.

If you are still building the shortlist, our selection checklist sets out what to gather before the scoring stage.

Keep the completed sheet with the signed agreement. If a regulator or a client asks how you chose the tool, the sheet is your answer, and it takes ten minutes to complete.

Common questions