AI at volume, on free tools, with customer data.
Retailers use AI in service, marketing and operations at high volume — and more than half rely on free-to-use tools, carrying customer data, card data and brand risk with them.
of retail AI adopters rely on free-to-use tools (ONS via WatchPro, 2026, secondary)
of retail adopters report operational improvement; 25% personalisation (ONS via WatchPro, 2026, secondary)
of AI-adopting UK firms use it in marketing, the most common use (DSIT, 2026)
Accountability stays with a named person.
CMA (March 2026): “UK consumer law applies whether decisions are made by people or by AI.” The ICO’s automated-decision rules apply to any AI that ranks, prices or refuses a customer, and the Online Safety Act reaches consumer-facing chatbots.
Regulator statements summarised from the published guidance; see the sources on the Problems page. This supports compliance; it is not legal advice.
- Customer service chat and contact centre
- Product content, campaigns and personalisation
- Returns, refunds and complaints handling
- Demand forecasting and stock
- Customer and card data in free tools
- Unreviewed AI copy in market
- Service bots that promise what policy does not allow
Contact and Comms with guardrails and a veto. Growth for marketing at scale with brand and claims rules enforced. Gateway metering by channel so cost per interaction is known. Managed accounts to replace free tools.
Four agents, trained for this sector.
The rules, as controls.
- Consumer Rights Act 2015
- CMA guidance on agentic AI and consumers (Mar 2026)
- PECR and ASA CAP Code
- PCI DSS
- UK GDPR and DUAA
Issues detected · needs attention first
| Issue | Rule | Severity | Owner | Status |
|---|---|---|---|---|
| Payroll file uploaded to an external AI tool | R-15 | High | HR Director | Blocked · reviewed |
| 31 personal AI accounts found in Sales | R-02 | High | Head of Sales | Migrating · 27 done |
| Customer data in a prompt without redaction | R-01 | High | Ops lead | Redacted · 0 left |
| Premium model used for internal drafts · 412 requests | R-07 | Medium | Engineering lead | Rerouted |
| CRM "AI assist" running without a DPIA | Policy | Medium | Head of Sales | DPIA in progress |
| Agent attempted an external email | R-12 | Low | S. Reid | Held · approved |
| Job | Owner | RAG | Effort | Cost to date | Forecast | Actual | Variance | Return / yr | Status |
|---|---|---|---|---|---|---|---|---|---|
| Migrate personal accounts to managed | IT Director | 12 d | £4,200 | £6,000 · 20 d | £4,200 · 12 d | −£1,800 · −8 d | risk | Done | |
| Route everyday tasks to standard tier | FD | 3 d | £900 | £1,200 · 4 d | £900 · 3 d | −£300 · −1 d | £58,400 | Done | |
| Payroll upload block (R-15) | HR Director | 1 d | £300 | £300 · 1 d | £300 · 1 d | 0 | risk | Done | |
| Collections letters via Comms agent | Head of Collections | 18 d | £11,600 | £14,000 · 25 d | — | on track | £96,000 | In progress | |
| KYC document checks | Head of Onboarding | 9 d | £5,100 | £9,000 · 15 d | — | on track | £61,000 | In progress | |
| Contact-centre adviser assist | Head of CS | 26 d | £19,800 | £16,000 · 20 d | — | +£3,800 · +6 d | £142,000 | At risk · vendor delay |
Effort, cost and return are recorded against each job as it happens. Done means the job is solved in production with its owner’s sign-off, not that a licence was bought.
From this sector.
Can a service bot be stopped from making promises?
Yes. Rules define what it may offer; anything outside is held for a person. Every conversation is in the ledger.
Where does our data go?
Nowhere new. Everything runs inside your own cloud account. Nothing routes through GenWA's infrastructure. Sensitive data is removed before a request leaves your environment.
Find out where your AI stands. Then decide.
Under a minute, an upload, or a visit. Something for the board either way.