AQE AI Deployment Qualification

Before you buy an AI tool, ask the supplier these ten questions

A free request any UK small business or charity can send to an AI supplier before signing up. Ten questions mapped to UK GDPR and ICO guidance. The supplier answers on this page.

Free, no accountSame answers, same resultSelf-declared, not an audit

Why ask

If an AI tool will handle personal data about your customers, beneficiaries, staff or volunteers, UK GDPR says you may only use a supplier that provides "sufficient guarantees" that it will protect that data properly. The ICO's guidance on AI goes further: it expects you to do your own due diligence before you buy, and to choose a different tool if you cannot confirm the supplier is compliant.

Most small organisations never ask. This request gives you the ten questions to ask, in plain English, and a record of the answers.

The answers are self-declared, so treat the result as a list of documents to ask for, not as proof.

How it works

  1. You create a request link above and send it to your supplier from your own email.
  2. Your supplier answers 10 questions on this page about the evidence they hold.
  3. You both get the same result: what is available, what is partly available and what is missing, with the rule behind each item and a fingerprint so anyone can check it was not changed.

The 10 questions

  1. What the tool decides: A plain description of what the tool does and any decisions it makes or influences about people. UK GDPR Art 28(3)(f): assisting with Articles 32 to 36, including the DPIA
  2. Who is responsible for the data: A clear statement of whether the supplier acts as processor or controller for your data. ICO guidance on AI and data protection: accountability and governance
  3. Using your data only as instructed: Confirmation that your personal data is used only on your documented instructions, and not for the supplier's own purposes such as training, unless you agree. UK GDPR Art 28(3)(a)
  4. Where the data goes: Where personal data is stored and processed, including any transfers outside the UK. UK GDPR Art 28(3)(a)
  5. Security: A description of the security measures in place. UK GDPR Art 28(3)(c) and Art 32
  6. Help with people's rights: How the supplier helps you respond when someone asks to see, correct or delete their data. UK GDPR Art 28(3)(e)
  7. Information for your DPIA: The information you need to complete a Data Protection Impact Assessment. UK GDPR Art 28(3)(f) and Art 35
  8. Proof of compliance: Willingness to share the information needed to demonstrate compliance, and to allow audits. UK GDPR Art 28(3)(h)
  9. Automated decisions: If the tool makes significant decisions about people on its own, how people are told and how they can get a human to look again. UK GDPR Art 22C (in force 5 February 2026)
  10. Leaving the service: How you can get your data back and switch provider if you need to. ICO guidance on AI and data protection: be able to switch to another provider

Sources

Sources checked 8 October 2026. This tool helps you ask for evidence. It is not legal advice, an audit or a certification, and the answers are the supplier's own.