Voice AI vendor due diligence checklist for FCA-regulated firms

A supplier due diligence checklist for AI voice agent vendors: what to ask, what evidence to accept and which answers should stop the deal.

The short answer

Ask for documents, not descriptions, and then test the agent yourself. The core evidence pack is the vendor's certificates and audit reports with entity, scope and dates; its data processing agreement and sub-processor list; an export of everything the agent can say; a sample call record; its change, resilience and exit commitments; and references from your sector. The firm stays accountable for calls made on its behalf: under CONC 1.2.2R it must take reasonable steps to ensure that others acting for it comply with CONC, and the FCA's October 2026 publication on AI lists untested vendor assurances as an area for improvement.

How to use this checklist

• Send the questions in writing. Use the twelve areas below as your questionnaire and ask for the evidence listed, not a yes or no.
• Score the evidence. Mark each area as evidenced, partly evidenced or missing. Treat a missing answer on data protection, on what the agent can say or on records as a stop until it is resolved.
• Weight it to your use case. Outbound collections makes area 8 essential. Taking card payments makes area 7 essential.
• Test before you sign. Written answers describe the service. Your own test calls show it.

The checklist: 12 areas

1. Company, contracting entity and regulatory status

• Ask. Which legal entity will we contract with, who owns it, and which entity holds the certifications and reports you are relying on? Is the vendor authorised or registered with the FCA or any other regulator, and for what?
• Evidence. Companies House or equivalent record, group structure, regulatory register entries where relevant, trade association memberships.
• Red flags. Certificates or reports issued to a different entity from the one you contract with; regulatory status described in a way that suggests your own obligations are reduced.

2. Information security

• Ask. Which certifications and independent reports cover the service you are buying, and for which period?
• Evidence. ISO/IEC 27001 certificate showing the certified entity, scope and an accredited certification body; SOC 2 Type II report with the audit period, the auditor's opinion and any exceptions; summary of the latest independent penetration test with remediation status; Cyber Essentials Plus certificate where relevant.
• Red flags. "Aligned with" or "working towards" presented as certified; a Type I report offered in place of Type II; a scope that excludes the product or its hosting; logos on a website instead of documents.

3. Data protection

• Ask. Will you act as our processor, or as a sub-processor? Which sub-processors touch audio, transcripts or customer data, and where? How long is each type of data kept? Is any of our data used to train or improve models?
• Evidence. A data processing agreement meeting UK GDPR Article 28, including audit and inspection rights; a sub-processor list with locations and the notice you get of changes; the transfer mechanism for any restricted transfer; a retention schedule by data type; a breach notification commitment; input for your data protection impact assessment, including how health information volunteered on calls is handled.
• Red flags. No sub-processor list; your data used for training by default; retention described as "as long as necessary"; resistance to audit rights.

4. AI governance and model risk

• Ask. Which models does the agent rely on for speech recognition, understanding and voice, who provides them and where are they hosted? What happens to prompts and audio at the model provider? How are model changes tested and notified? How is accuracy measured across accents, ages and line quality?
• Evidence. A model and provider inventory; the ISO/IEC 42001 certificate and scope, if held; a change management procedure with regression testing; accuracy results against a defined test set; contract terms for notice of significant model changes.
• Red flags. The vendor cannot name its model providers; model updates go live without notice or regression testing; accuracy figures with no test set or denominator.

The FCA describes contractual notice of significant model changes and tested contingency plans as good practice. For what each AI standard does and does not prove, see AI governance standards for voice agent buyers.

5. What the agent can say and do

• Ask. Which parts of the call use generated text, including fallbacks? Can we export and approve every response before go-live? Which actions can the agent take in our systems? How does the journey handle identity verification, third parties and representatives, vulnerability, disputes, mental capacity concerns, debt advice, Breathing Space, complaints and requests for a person?
• Evidence. An export of the full response library; a journey map showing every state and exit; a list of system actions and the rule that triggers each; scripted test calls for each scenario.
• Red flags. "The model is instructed not to" as the main control; no way to export what the agent can say; actions the model can trigger without a rule-based check.

See how to stop a voice agent hallucinating on a regulated call and does AI debt collection comply with FCA CONC 7?

6. Records and audit

• Ask. For any call, can you show what the customer said, how it was understood, which rule selected each response, which approved version was spoken and what was written back to our systems? How long are records kept, and can we export them in bulk?
• Evidence. A full record of one of your own test calls; retention settings; the export format; access controls and logs of who viewed records.
• Red flags. A transcript is the only record; records cannot be exported; retention cannot be set to your policy.

See what a full audit trail should contain.

7. Payments

• Ask. If the agent takes or initiates card payments, which entities sit in the card data flow, and which PCI DSS Attestation of Compliance covers each? How are card details kept out of recordings and transcripts?
• Evidence. A data flow diagram; a current Attestation of Compliance for each entity in the flow; a description of the controls that keep card data out of recordings and transcripts.
• Red flags. "PCI compliant" with no Attestation of Compliance; reliance on a payment partner's attestation for parts of the flow it does not cover; card numbers or security codes in transcripts.

8. Outbound calling

• Ask. How are calling windows, attempt limits and suppression checks enforced before each dial? Which caller ID is presented? How do you stay within Ofcom's persistent misuse policy on abandoned and silent calls?
• Evidence. Dialling rule configuration; the suppression process; the caller ID policy; abandoned call reporting. Where any call includes marketing, PECR and Telephone Preference Service screening apply as well.
• Red flags. Limits managed by your team outside the platform; a withheld caller ID, or one customers cannot call back.

9. Operational resilience

• Ask. Where is the service hosted, how does it fail over, what are the recovery time and recovery point objectives, and when was disaster recovery last tested? What happens to live calls if a model provider or telephony carrier fails?
• Evidence. Hosting regions; a summary of the business continuity and disaster recovery plan; recovery objectives in the contract; the latest disaster recovery test result; a map of critical dependencies.
• Red flags. No tested recovery plan; a single region with no failover; dependencies the vendor cannot name.

For firms in scope of SYSC 15A, AI dependencies, including externally hosted models, belong in severe but plausible scenarios.

10. Fourth parties

• Ask. Which of your suppliers are critical to the service, such as cloud, telephony, speech and model providers? How do you assess them, and do the security and data protection terms you give us flow down to them?
• Evidence. A critical supplier list; the vendor's own supplier assessment process; flow-down clauses.
• Red flags. Critical services used on consumer or free-tier terms; no flow-down of data protection obligations.

11. Commercial and financial resilience

• Ask. How is the company funded, what insurance does it carry, and which comparable clients can we speak to?
• Evidence. Latest accounts or confirmation of funding; certificates of insurance for professional indemnity or technology errors and omissions, and for cyber, showing insurer, limits and expiry; references in your sector with results that state the denominator, baseline and period.
• Red flags. No references in regulated sectors; insurance limits far below your exposure; results with no denominator.

12. Exit

• Ask. If we leave, what do we get back, in what format and how quickly, and what is deleted? What happens to the wording and journey designs we approved?
• Evidence. An exit plan; data return and deletion commitments with timelines; contract terms on ownership of journey designs and approved wording; transition support.
• Red flags. No exit plan; no confirmation of deletion; data returned in a form you cannot use.

What should you test before you sign?

• Every scenario in area 5. Run scripted calls through each one, including a customer who presses for a discount that does not exist.
• Speech under real conditions. Call with different accents, background noise and a poor line, and count the misheard answers and how the agent handled them.
• The route to a person. Ask for a person mid-call, in and out of hours, and check what happens when nobody answers.
• The record. Pull the records for your test calls and reconstruct one as if it were a complaint.
• A change. Ask the vendor to walk you through how a recent model or journey change was regression tested and released.

Which red flags should stop the deal?

• Logos and claims instead of certificates and reports.
• No export of what the agent can say.
• Generated text on regulated parts of the call, with prompt instructions as the main control.
• No sub-processor list, or training on your data by default.
• A transcript as the only record.
• No notice of model changes and no right to test before release.
• "PCI compliant" without an Attestation of Compliance for each entity in the flow.
• No exit plan.

How do you keep due diligence current?

Review the vendor at least once a year, and again when it changes a model, a sub-processor or a hosting region, when a certificate or report expires, after a material incident, or when complaints about the agent rise. Keep the evidence pack with dates so you can show what you checked and when.

How does MEGA.AI answer this checklist?

MEGA.AI is a vendor too, so this section sticks to what is in place today. Ask us for the evidence behind each line.

• Independent assurance. ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certifications, a SOC 2 Type II report and Cyber Essentials Plus, with PCI DSS validation in progress. Details are on the MEGA.AI Trust Center.
• Penetration testing. Independent testing of the web application in 2026 by a CREST-certified provider found no critical or high vulnerabilities, and every finding was fixed and retested.
• Data protection. Every client contracts under a signed agreement and data processing agreement, with MEGA.AI as processor, or as sub-processor where the client itself collects on behalf of a creditor. UK and EEA client data is stored and processed in the UK.
• Model hosting. The language model used for UK traffic is hosted in MEGA.AI's own Microsoft Azure UK South environment, and Microsoft does not retain or review prompts.
• What the agent can say. Only wording the client approved before the call, in a journey the client designed. Language models classify what the customer said; they do not write the replies.
• Records. A recording, transcript, step-by-step phase log and flags for every call, and a downloadable contact report for each customer.
• Payments. Today MEGA.AI sends a secure payment link by SMS through the client's payment platform, or transfers the customer to the client's payment line. In-call card capture will not be released until MEGA.AI's PCI DSS compliance has been validated.
• Regulatory status. MEGA.AI is not authorised by the FCA. MEGA.AI Limited is a supplier member of the Credit Services Association.

Frequently asked questions

What is the difference between a supplier questionnaire and due diligence?

A questionnaire collects the vendor's answers. Due diligence checks them against documents and tests the agent's behaviour. The FCA's concern about untested vendor assurances sits in the gap between the two.

Does using a vendor move responsibility for the calls?

No. The FCA says firms can outsource AI services but remain responsible for them. See who is accountable when an AI voice agent harms a customer.

Is an ISO/IEC 42001 certificate enough to approve an AI vendor?

No. It shows the vendor runs an independently audited AI management system within the certificate's scope. It does not show that your journey behaves correctly with your customers, so you still test.

How often should we review an AI voice agent vendor?

At least once a year, and on trigger events such as a model change, a new sub-processor, a hosting change, an incident or rising complaints.

Which areas matter most for collections?

What the agent can say and do, records, outbound calling limits and the handling of vulnerable customers, because that is where conduct risk under CONC 7 and the Consumer Duty sits. See how AI voice agents should handle vulnerable customers.

About MEGA.AI

MEGA.AI provides deterministic voice AI for inbound and outbound customer calls at regulated enterprises in lending and collections, banking, utilities, telecommunications and insurance. Every response the agent can give is approved by the organisation before deployment, with live data inserted only into permitted fields, and every call leaves a record that traces each step back to the approved journey. MEGA.AI is certified to ISO/IEC 27001, 27701 and 42001, is audited under SOC 2 Type II and holds Cyber Essentials Plus; its PCI DSS assessment is in progress. Current certificates are listed on the Trust & compliance page.

Book a briefing to go through this checklist against MEGA.AI's evidence and run your own test calls.

Sources

• FCA, AI in financial services: good practice and areas for improvement (19 October 2026, updated 20 October 2026)
• FCA Handbook, CONC 1.2 (CONC 1.2.2R)
• ICO, What does it mean if you are a processor?
• Ofcom, Persistent misuse policy statement
• ICO, Telephone marketing under PECR
• PCI Security Standards Council, FAQ 1576

This checklist is general information for supplier due diligence, not legal advice. Last reviewed: November 2026.