AI consultancy UK buyers can check: procurement routes, ICO guidance and supplier due diligence

The ICO's guidance on AI and data protection explains how UK data protection law applies to AI systems. It was last updated on 15 March 2023 and is under review because of the Data (Use and Access) Act, so read it as a map, not a current ruling. It covers:

• Accountability and governance, including data protection impact assessments.
• Transparency, lawfulness, accuracy and fairness, including bias and Article 22 on automated decisions.
• Security and data minimisation, and individual rights.
• An AI and data protection risk toolkit and a glossary.

The ICO and the Alan Turing Institute also co-badge guidance on explaining decisions made with AI, in three parts for compliance teams, technical teams and senior management. A firm that works on UK systems should be able to say which of these it has used on a past project, and show you the impact assessment template it uses. Ask for it before you sign, not after the build starts.

The ICO defines a restricted transfer as sending or making personal information accessible to a separate organisation outside the UK. It says every restricted transfer needs one of three routes:

• UK adequacy regulations, which the ICO calls the most efficient route.
• Appropriate safeguards such as the IDTA or the international data transfer addendum, with a transfer risk assessment.
• An exception, used only where neither of the above applies.

If no route applies, the ICO says the transfer must not go ahead. When a supplier works from outside the UK, or relies on model providers that process data elsewhere, ask which route covers each flow and get it in the contract. Our AI vendor due diligence checklist covers the supplier side.

Public or private, the contract should cover five things. The ICO guidance points to accountability and governance, including data protection impact assessments, so ask who writes the assessment and who signs it off.

• Who owns the code, prompts and evaluations, and from which commit.
• Which entity acts as processor, and the terms it signs.
• Which model providers and subprocessors see personal data, and where.
• A handover clause with a runbook and a change shipped by your own people.
• An exit point at each milestone.

A firm that works well should not mind any of these. Use the AI project scope of work checklist to turn them into sections, and ask the firm to put the answers in the order of its own proposal so you can compare like with like. Treat a refusal to write any item down as a reason to keep looking.

Digiton is an AI consulting firm that builds AI agents and custom AI software and takes systems built with Claude, Cursor or Lovable into production. The company is registered in Tallinn, Estonia, and works from Lisbon. There is no UK office or UK entity. The entry step is a 25-minute scoping call.

• For agents and workflows, see AI agent development.
• For larger builds, see custom AI development.
• For a system that exists and is not holding up, see production engineering, where we read the real repository and give you a scorecard across ten layers with evidence for each.

It is a poor fit where a tender requires a UK-registered supplier, for a board strategy deck, or for regulated advice. For the wider checklist, see how to choose an AI consulting firm and enterprise AI for UK teams.