Sales: CRM assistant

• Within minutes of a call or meeting, the salesperson gets draft notes, actions, and a follow-up email, built from the transcript and the account's history.
• Proposed CRM updates (new contacts, stage, next step, close date) appear as a list to accept, edit or reject. Nothing changes in the CRM until the salesperson confirms it.
• Before any contact is suggested for marketing or a call list, a rules check in code looks at the contact type, the recorded lawful basis, opt-outs, and TPS and CTPS status.
• Drafts only use prices, products and terms from the approved price book and templates. Anything else is flagged for the salesperson and, where needed, their manager.
• Objections or opt-outs heard on a call are flagged so they reach the suppression list the same day.
• Managers see fuller, more current records, and salespeople get back several hours a week.

• ICOPECR: email marketing to businesses
  →

  Companies, LLPs and similar bodies are corporate subscribers: you can email them marketing without consent if you say who you are and offer an opt-out. Sole traders and some partnerships are individual subscribers, treated like consumers, so you need consent or the soft opt-in. The ICO says to treat them as individuals if you're unsure. The CRM holds a contact type for every organisation, and the check runs in code.

• ICOPECR: marketing calls, TPS and CTPS
  →

  Live marketing calls must be screened against the TPS and the CTPS, because sole traders and some partnerships register with the TPS, plus your own do-not-call list. A registered number can only be called with that person's specific consent to your calls. Automated marketing calls need specific consent to automated calls. The assistant never dials anyone, and never puts a registered number on a call list without recorded consent.

• ICOPECR enforcement after the Data (Use and Access) Act 2025
  →

  Since 5 February 2026, PECR fines can reach UK GDPR levels. The ICO's PECR and business-to-business marketing guidance is under review following the Act, so contact rules are kept as data owned by marketing operations, easy to update.

• ICOUK GDPR: lawful basis and the right to object
  →

  A named person at a business is still a person: UK GDPR applies to their details and call notes. The Act names direct marketing as an example of a legitimate interest, but you still need a legitimate interests assessment, and PECR applies on top. The separate 'recognised legitimate interests' basis covers a short list of public-interest purposes, not marketing. Anyone can object to direct marketing at any time, and that is absolute.

• ICO / Home OfficeRecording and transcribing calls
  →

  Recording a call relies on the Investigatory Powers Act 2016 business regulations and a UK GDPR lawful basis. The other party is told at the start that the call is recorded and transcribed, and can ask for it not to be. Transcripts and AI notes are personal data: they're in scope of subject access requests, kept for a set period, and processed in UK regions.

• Contract law / CMAWhat a salesperson promises
  →

  A price, date or term in an email can bind you. The assistant drafts only from the approved price book and templates, and a person sends anything else. If your team also sells to consumers, the CMA's guidance on AI agents (March 2026, updated October 2026) says a business is responsible for what its agent does, as it would be for an employee.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• Every organisation in the CRM has a contact type (company, LLP, sole trader, partnership, public body), owned by sales operations and checked during discovery.
• Marketing operations owns the suppression lists and contact rules, with change control, and the DPO signs off any change.
• A standard call opening tells the other party the call is recorded and transcribed, with a simple way to say no.
• A monthly review of a sample of drafts and proposed updates, including tests designed to tempt the assistant into promising discounts or dates.
• A named owner for the price book, the template library and each prompt.
• Salespeople trained before go-live: what the assistant can't see, why it won't promise things, and how to report a bad draft.

1. 2–3 weeks

   Discovery

   Time study of admin work, review of CRM data quality and contact types, map the suppression data, and agree the call recording notice.

2. Gate · must be true to passBaseline agreed, contact types and suppression sources confirmed, DPIA and legitimate interests assessment started, legal involved.

3. 4–6 weeks

   Pilot

   One sales team. Notes and proposed CRM updates only; follow-up drafts stay in drafts. Compare with what salespeople would have written.

4. Gate · must be true to passDraft acceptance within agreed limits, zero rule breaches and zero unapproved commitments in testing, and DPO sign-off.

5. 4–6 weeks

   Production

   Roll out to all sales teams, add follow-up drafts and approved templates, with monitoring, support and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan and training in place.

7. Ongoing

   Scale

   Add account planning summaries and pipeline reviews, then reuse the pattern for account management and customer success.

8. Gate · must be true to passEach new capability passes the same pilot gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   A follow-up draft promises a discount or delivery date that was only discussed.

   How the design avoids it

   Drafts use only the price book and approved templates, anything else is highlighted, and a person sends every free-text email.

2. 2

   Goes wrong

   The CRM doesn't know which customers are sole traders, so marketing rules are applied to the wrong people.

   How the design avoids it

   Contact types cleaned up in discovery, and anyone unknown is treated as an individual subscriber, as the ICO advises.

3. 3

   Goes wrong

   Salespeople accept every proposed update without reading, and errors pile up in the CRM.

   How the design avoids it

   Acceptance rates monitored, sample reviews, and small, specific proposals that are quick to check.

4. 4

   Goes wrong

   Recording starts quietly, and the other party was never told.

   How the design avoids it

   A standard opening line, a visible recording indicator, and no transcript produced for a call without the notice.

5. 5

   Goes wrong

   Transcripts and AI notes are kept forever, and a subject access request turns up years of them.

   How the design avoids it

   Set retention for audio, transcripts and drafts, searchable by person, agreed with the DPO before go-live.

1. Under way
   The ICO is reviewing its PECR and direct marketing guidance after the Data (Use and Access) Act

   Its business-to-business, telephone marketing and lawful basis pages all say they're under review. Keep the contact rules as data owned by marketing operations, so a change in guidance is a configuration change, not a rebuild.

2. 2026–2027
   The ICO's code of practice on AI and automated decision-making

   Regulations in force since May 2026 require the ICO to produce a statutory code. If you add lead scoring or prioritisation, it's profiling: keep it advisory, explainable, and never the only reason someone is excluded.

3. Ongoing
   Agent and assistant platforms are changing fast

   Bedrock Agents closed to new customers on 30 July 2026, and Amazon Q Business on 31 July 2026. Keep the assistant's tools behind your own APIs, so the runtime can change without rewriting the CRM integration.

4. Late 2026–2028
   The Cyber Security and Resilience Bill

   Medium and large managed service providers come into regulation, with faster incident reporting. Expect your CRM and AI suppliers to face new duties, and update contracts and supplier assurance to match.