Outlook
Part of How to build a subscription commerce outlook with triggers and owners
Why subscription commerce AI applications need a compliance plan first
Subscription commerce AI applications can cut churn and speed up service, but consent and advertising rules still bite. Here is what to check before you buy.
What to take away
What to take away
- The ICO's guide to the Privacy and Electronic Communications Regulations sets out the consent rules that apply to electronic marketing, cookies and similar technologies, and it is the document your AI vendor brief should be checked against.
- UK GDPR, alongside the Data Protection Act 2018, is the law behind those consent rules, and high-risk AI uses need a Data Protection Impact Assessment (DPIA) before they go live.
- The Advertising Standards Authority publishes its rulings in a searchable database, so you can see how claims about automated or personalised subscription offers have been judged before.
- The rulebook the ASA applies is the CAP Code, the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing.
- The Competition and Markets Authority accepts reports about market problems from businesses as well as consumers, which matters if an AI pricing or ranking tool distorts how subscribers choose.
- The Digital Markets, Competition and Consumers Act 2024 gives the CMA new subscription-contract rules and stronger market inquiry powers.
- Most AI applications in subscriptions sit in four placesacquisition scoring, retention prompts, service handling and pricing tests.
- Each of those four carries a different compliance trigger, so a single blanket policy will not cover them.
Where AI actually sits in a subscription business
Four AI jobs, different risks
Scoring model
- Job
- Ranks leads
- Data
- Lead data
- Rule
- Marketing
- Team
- Growth
Churn model
- Job
- Flags renewal risk
- Data
- Billing history
- Rule
- Privacy
- Team
- Retention
Support assistant
- Job
- Drafts replies
- Data
- Subscriber messages
- Rule
- Consent
- Team
- Support
Pricing engine
- Job
- Tests offers
- Data
- Cohort offers
- Rule
- Competition
- Team
- Pricing
Treat those as separate projects. They touch different rules, different data and different teams. A churn model reading billing history is not the same risk as a chatbot writing to a lapsed subscriber.
For a wider view of how these jobs fit together across the sector, our trends and outlook analysis maps the changes worth planning around.
The consent question comes first
Any AI tool that sends a message to a subscriber is doing electronic marketing. The ICO's guide to the Privacy and Electronic Communications Regulations explains the consent and cookie rules that apply, and it should shape your vendor questions rather than sit in a folder.
Consent is only one part of the picture. UK GDPR, alongside the Data Protection Act 2018, governs how you process subscriber data, and it requires a named lawful basis for each AI use, a Data Protection Impact Assessment (DPIA) before any high-risk processing, retention limits, processor contracts with your vendors and a transfer check where personal data leaves the UK.
The ICO's guidance on AI and data protection works through those steps, and it is a better starting point than a vendor's security page.
Consent questions before production
- What data does the tool read?
- What does it send, and to whom?
- Where is the consent record kept?
- Can the record survive an audit?
If the answer to any of those is vague, the tool is not ready for production. Consent records need to survive an audit, not just a demo.
Claims and rulings are public
The ASA rulings database is the practical evidence base for advertising risk. Search it for subscription, trial and cancellation wording before you sign off a campaign.
The rulebook behind those decisions is the CAP Code, the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing, which the ASA enforces; broadcast advertising falls under the BCAP Code. A claim about price, savings or cancellation terms has to satisfy it whether a human or a model wrote it.
AI makes claims easier to generate and easier to get wrong. A model that rewrites offer copy at scale can produce variations nobody reviewed. That is a compliance problem, not a marketing win.
Set a rule: any AI-generated claim about price, savings or cancellation terms needs a named human approver.
Market conduct is a live risk
Automated pricing and ranking can distort competition in ways subscribers cannot see. The CMA accepts reports about competition or market problems from businesses, and the process for telling the CMA about a market problem is worth knowing before you assume a rival's tool is harmless.
The Digital Markets, Competition and Consumers Act 2024 is the statute to watch. It carries the CMA's new subscription-contract rules — pre-contract information, renewal reminders and straightforward cancellation — and it sharpens the CMA's market inquiry powers. If a report suggests a market is not working, the CMA can open a market study and, where the evidence warrants it, make a market investigation reference.
This is not about accusing anyone. It is about having a route if a supplier's algorithm shapes the market in a way that disadvantages you.
Before and after a compliance-led rollout
Before
- Vendor brief
- Feature list, price, timeline
- Copy approval
- Marketing signs off
- Pricing tests
- Run by the growth team alone
- Retention prompts
- Sent on model output
- Support drafts
- Published directly
After
- Vendor brief
- Data map, consent basis, audit trail
- Copy approval
- Marketing plus a named compliance owner
- Pricing tests
- Logged, reviewed, with a competition check
- Retention prompts
- Sent only where consent is recorded
- Support drafts
- Reviewed before sending
Skills and ownership
The bottleneck is usually people, not software. Someone has to own consent records, someone has to own claim approval, and someone has to own the pricing log. Our skills forecast for England sets out which roles are likely to be hardest to fill.
For example, a team paying £400 a month for a retention tool still needs a named owner for its consent basis. The licence does not supply that.
What would change this view
Watch three triggers. A new ICO enforcement notice touching automated messaging. An ASA ruling on AI-generated offer copy. A CMA update on algorithmic pricing in consumer markets.
Those are the things to watch; enforcement is already visible. The ICO publishes action against unlawful electronic marketing, and the ASA's rulings database already carries decisions on subscription, trial and cancellation wording.
Any of those would move this from planning to action. Until then, the practical step is a one-page register listing every AI tool, the data it reads, and the consent basis it relies on.
Common questions
Does an AI tool need its own consent record?
No. The consent sits with your business, not the vendor. You need a record showing what the subscriber agreed to and when, and you need it to cover the message the tool sends.
Can we use AI to rewrite cancellation wording?
You can draft with it, but a human should approve anything a subscriber reads about cancellation. Wording like that is where advertising and contract rules overlap.
What if a supplier's pricing algorithm looks anti-competitive?
Businesses can report competition or market problems to the CMA. Gather dates, screenshots and the effect on your margins before you submit anything.
How often should the register be reviewed?
Quarterly is workable for most operators. Review sooner if you add a tool, change a data source or launch a new retention campaign.
