Using AI in Customer Relationships
Before your chatbot talks to another customer — there are three things you need to know.
A practical compliance guide for small businesses using AI tools that interact with, score, or make decisions about customers. Covers chatbots, AI-personalised marketing, automated decision tools, and CRM platforms — with the three templates you need to deploy them lawfully.
Most SME website chatbots are unlawful.
A chatbot that does not identify itself as AI, collects customer names and enquiries, and operates without a Privacy Notice covering it is almost certainly in breach of Articles 13 and 14 UK GDPR.
This is also the most common type of complaint the ICO receives about small business AI use.
This guide covers every type of customer-facing AI — from chatbots to scoring tools — with the exact disclosures, DPA checks, and templates you need to operate each one lawfully.
3 things most small business owners don’t know.
Your chatbot is probably not legally disclosed
Every chatbot must identify itself as AI before collecting any personal data. It must be covered in your Privacy Notice by name. Most SME chatbots on free or basic accounts have neither. This is enforceable from day one.
AI decisions about customers trigger Article 22
If an AI tool influences who gets a quote, who gets approved, or who gets prioritised, Article 22 UK GDPR may apply. The customer has the right to human review — and you must tell them AI was involved. Most SMEs using referencing or scoring tools have no process for this.
Your CRM and email platform need DPAs
HubSpot, Mailchimp, Klaviyo, and every similar platform processing customer data on your behalf is a data processor under Article 28. Most business accounts include a DPA — but most owners have never confirmed it is in place.
Four Types of Customer Facing AI
Highest riskAI scoring, referencing & decision tools - Tenant referencing, credit screening, applicant ranking, AI quote engines
Article 22 thresholdWebsite chatbots & virtual assistants - Tidio, Intercom, Drift, HubSpot Chat, custom GPT-based chatbots
Transparency & DPA, AI-personalised marketing & email - Mailchimp AI, Klaviyo, ActiveCampaign, HubSpot with AI features
Transparency & DPA, AI customer service & CRM - AI ticket triage, AI-drafted responses, CRM with predictive features, sentiment analysis
Everything included in this guide
Four types of customer-facing AI — chatbots, AI marketing, scoring tools, and CRM, with the specific obligations for each
Article 22 framework — when it applies, what it requires, and how to comply, with a completed worked example
Three ready-to-use templates — Chatbot Disclosure Notice, AI Privacy Notice section, and Article 22 Decision Log
DPA verification table — HubSpot, Mailchimp, Klaviyo, Intercom, Tidio, and Zendesk: account required, where to find it, data location
Customer retention schedule — chatbot logs, AI decision records, marketing lists, and financial records, with the legal basis for each period
Customer-Facing AI Tool Register — log every tool, its DPA status, its Article 22 flag, and the date last reviewed
Completed worked example — Marcus Reid (Reid Property Services) shows compliant chatbot deployment, Article 22 referencing compliance, and a completed AI Tool Register
AI Safe Starter Pack — the foundational seven documents, included free with this guide
Recommended Pathways
SME: Using AI in Customer Relationships — £67
The profession-specific guide with the Article 22 Decision Log, chatbot disclosure notice, and a week-one action plan built around the highest-risk gaps for businesses with customer-facing AI.
Compliance Bundle — £149
Both SME guides plus the Legal Pack and Companion Guide — the complete compliance infrastructure for a small business that wants documented legal agreements, a breach response plan, and internal accountability from day one
Both SME Guides — £109
Using AI in Customer Relationships plus Managing AI Across Your Team — recommended for SMEs whose AI exposure covers both customer-facing tools and internal staff use, which applies to most small businesses
Full Suite Bundle — £189
All three tiers — the complete compliance infrastructure including the Risk & Data Pack, which covers AI marketing liability, deepfake risk, and wearable device data for businesses using AI in customer-facing roles. Website Compliance Pack, DPA volumes 1&2