AP capture, matching, approvals and posting into your UK ledger.
AI automation agency for UK businesses
Scenox is an AI automation agency and consultancy for UK businesses. We design, build and run AI workflows and agents for finance, operations, support and sales. For UK teams, that means systems built around UK GDPR as amended in 2025, PECR rules for calls and messages, Making Tax Digital record-keeping, and UK ledgers such as Xero and Sage.
The rules below are why a UK build looks different from a US one: where people stay on automated decisions, which calls a voice agent may make, and how finance data moves between systems.
UK rules that shape an AI buildChecked 15 October 2026
- Data protection law
- UK GDPR and DPA 2018, amended by the Data (Use and Access) Act 2025
- Regulator
- Information Commission (still known as the ICO), since 30 Sept 2026
- Solely automated decisions
- Allowed with safeguards, including human intervention on request
- Marketing calls
- Screen against TPS and CTPS; recorded or synthetic voice needs specific consent
- VAT records
- Making Tax Digital: digital records and digital links, no manual copying
- E-invoicing
- All VAT invoices as e-invoices from April 2029
UK rules that change how we build AI automation
Most of these are not about AI as such. They are data, marketing and tax rules that decide where an agent may act alone.
| Rule | What it says | What it means for the build |
|---|---|---|
| Automated decisions (UK GDPR as amended) | Significant decisions based solely on automated processing are allowed on most lawful bases, if you give information, let people make representations, offer human intervention and let them contest the decision. | Any agent that approves, declines or prices for an individual gets a review route to a named person and a logged reason for each decision. |
| Special category data | Solely automated decisions using special category data stay limited to explicit consent or substantial public interest. | We keep health, biometric and similar data out of automated decision steps unless your basis is documented. |
| International transfers | Transfers outside the UK need adequacy regulations, or safeguards such as the IDTA or the UK Addendum with a transfer risk assessment. | We record which model and hosting providers see personal data, and in which country, so your transfer basis is clear before launch. |
| Data protection fee | Organizations that process personal data pay the regulator a fee unless exempt. Tiers start at £52 a year. | Your organization stays the controller. An automation project can change whether an exemption still fits, so check it. |
| PECR marketing calls | Live calls must not go to TPS or CTPS numbers without consent. Automated calls playing recorded material need prior consent to that type of call. | Outbound voice agents for marketing are scoped against consent records first. See the next section. |
| PECR enforcement | Fines now reach UK GDPR levels, up to £17.5 million or 4% of global turnover, and unconnected calls can count. | Dialler logic, retry limits and suppression lists are tested before any outbound campaign runs. |
| Making Tax Digital for VAT | VAT records are kept in compatible software, and data moves between programs by digital link with no manual transfer. | Our finance automations post to the ledger by API. We do not add steps where someone copies figures between files. |
Scroll sideways to see every column.
AI voice agents and outbound calls under PECR
UK voice work splits cleanly into calls people make to you and calls you make to them. The rules for the two are very different.
Inbound calls: the common case
An AI receptionist answering your own customers, booking appointments or taking a maintenance request is not direct marketing. UK GDPR still applies to what it records and stores, so callers hear who you are and how the call is used.
Outbound marketing with a synthetic voice
The ICO has said an AI-generated greeting synthesized from a call handler's voice falls within the automated calling rules, and needs specific consent. We treat any outbound marketing call with a synthetic voice the same way.
Live outbound calls
Calls made by your staff with AI support (call notes, suggested answers, CRM updates) follow the live-call rules: screen against TPS, CTPS and your own do-not-call list, and never withhold your number.
Recording and transcripts
ICO guidance says to tell people you are recording a call and why, ideally with a recorded message. We put that line at the start of every call flow and keep transcripts only as long as you need them.
Our position on UK cold calling
We do not build voice agents that cold call UK numbers for marketing. A synthetic voice makes it an automated call under PECR, and the consent bar for those is high. The ICO has not yet published guidance on fully conversational AI calls, so we take the cautious reading.
What we do build: answering and booking lines, callbacks a customer asked for, service and reminder calls that carry no marketing, and AI support for your human callers.
Finance automation and Making Tax Digital
MTD sets how VAT data moves. UK e-invoicing, due in 2029, will set how invoices themselves move.
What the rules require
- All VAT-registered businesses keep digital records and file VAT returns through MTD-compatible software
- Data moves between programs by digital link; copy and paste does not count
- MTD for Income Tax applies to sole traders and landlords over £50,000 from April 2026, over £30,000 from April 2027 and over £20,000 from April 2028
- All VAT invoices for B2B and B2G sales must be e-invoices from April 2029, on a decentralized model
- The government has named Peppol as the core interoperability network for UK e-invoicing
How we build for it
- Supplier invoices are captured, coded and posted into Xero, Sage or QuickBooks through their APIs, which keeps the digital link intact
- VAT codes are applied by rule, and anything unusual is queued for your finance team
- Each posting is logged with its source document, so your VAT records can be traced back
- Supplier master data (VAT numbers, legal names, addresses) is cleaned now, which is the groundwork e-invoicing will need
- For accounting firms, client bookkeeping for MTD for Income Tax can run on the same intake and coding workflow
The UK systems we connect to
UK finance and operations teams tend to run a cloud ledger plus a CRM and a helpdesk. We work inside the tools you already pay for.
Xero
Bills, invoices, bank transactions and contacts, with VAT rates applied from your own settings.
Sage
Sage Intacct for multi-entity groups, with dimensions and approval rules kept as they are.
QuickBooks Online
Bills, expenses and vendor records for smaller teams and accounting firm clients.
Dynamics 365 Business Central
Purchase invoices, sales documents and VAT posting setup for mid-sized companies.
HubSpot and Salesforce
Lead routing, follow-ups and record updates, with consent and suppression fields respected.
Helpdesks and telephony
Zendesk, Intercom and SIP or cloud telephony for support and voice workflows.
Choosing an AI automation agency or AI consultancy in the UK
Questions worth asking any UK provider, including us. The answers should be specific and in writing.
- 1
Who is controller and who is processor?
You should stay the controller. The provider should sign an Article 28 processor contract before it sees personal data.
- 2
Where does the data go?
Ask for the list of model and hosting providers, the country each one is in, and the transfer mechanism for each.
- 3
How do people challenge a decision?
For any automated decision about an individual, ask to see the review route, the reason that is logged and who handles it.
- 4
What is the PECR position?
For voice and messaging, ask how consent and TPS screening are checked before anything is sent or dialled.
- 5
Does it keep MTD digital links?
Finance automations should post by API or file import, never by someone copying figures between systems.
- 6
What happens after launch?
Ask who monitors accuracy, who handles incidents and what the monthly report contains. A build without a run phase drifts.
Related pages
The solutions, blueprints and ERP guides this work connects to.
Inbound answering and booking lines, with recording notices built in.
How we read and write bills, invoices and contacts in Xero.
AP automation with dimensions and approvals in Sage Intacct.
Bills and vendor records for smaller teams and accounting firms.
Reconciliations, accruals and the close checklist, stage by stage.
Accounting and law firm workflows, including client document intake.
What a workflow audit delivers, using a fictional AP example.
Questions from UK teams
Is automated decision-making with AI legal under UK GDPR?
Yes, with safeguards. Since the Data (Use and Access) Act 2025, significant decisions based solely on automated processing are allowed on most lawful bases, as long as you tell people about the decision, let them make representations, offer human intervention and let them contest it. Special category data has tighter limits. The ICO is updating its guidance on this.
Can an AI voice agent make cold calls in the UK?
Not without specific consent if it uses a recorded or synthetic voice. Under PECR, automated marketing calls that play recorded material need prior consent to that type of call, and the ICO has said a synthesized greeting counts. We do not build cold-calling voice agents for UK numbers. Inbound lines and requested callbacks are a different case.
Do callers need to be told an AI call is recorded?
ICO guidance says you must tell people you are recording a call and why, and a recorded message at the start is good practice. Our call flows open with who you are and how the call is used, and transcripts are kept only for the period you set.
Does AP automation break Making Tax Digital digital links?
It should not. HMRC's VAT Notice 700/22 requires data to move between programs by digital link once it is in your software. Our finance automations post directly into Xero, Sage, QuickBooks or your ERP by API, so there is no manual copy step in between.
When does e-invoicing become mandatory in the UK?
The government has said all VAT invoices must be issued as e-invoices from April 2029, for B2B and B2G sales where VAT is due, on a decentralized model with Peppol as the core network. Consumer sales are excluded. An implementation roadmap is due at Budget 2026.
What is the difference between an AI consultancy and an AI automation agency?
A consultancy usually stops at strategy and recommendations. An automation agency builds and runs the systems. We do both for a given workflow: an audit that measures it and recommends whether to automate, then the build, then monitoring once it is live.
Official sources
Checked on 15 October 2026. Rules and dates change, so confirm the current text with the publisher or your adviser before you act on it.
- [1]Data protection
GOV.UK
UK GDPR and the Data Protection Act 2018 apply in the UK, with the regulator handling advice and complaints.
- [2]Information Commission succeeds the ICO as UK's data protection regulator
GOV.UK, 30 September 2026
The Information Commission took over the ICO's functions on 30 September 2026 with the same role and powers.
- [3]Data (Use and Access) Act 2025: plans for commencement
GOV.UK, updated 12 October 2026
Royal Assent on 19 June 2025 and the commencement dates for the data protection changes.
- [4]The Data (Use and Access) Act 2025: summary of the changes to data protection
ICO
The new rules for solely automated decisions, the required safeguards and the special category data limits.
- [5]Guidance on AI and data protection
ICO
The regulator's AI guidance, marked as under review after the 2025 Act.
- [6]
- [7]International transfers: a guide
ICO
Adequacy, the IDTA and UK Addendum, and transfer risk assessments.
- [8]Is the restricted transfer covered by adequacy regulations?
ICO
Which countries have UK adequacy, including the US only through the UK Extension to the Data Privacy Framework.
- [9]Telephone marketing (Guide to PECR)
ICO
TPS and CTPS screening for live calls, and specific prior consent for automated calls with recorded messages.
- [10]Innovation advice: previously asked questions (PECR)
ICO
An AI-synthesised greeting in a marketing call falls within the automated calling rules and needs specific consent.
- [11]What are the rules on live direct marketing calls?
ICO
Never withhold your number on marketing calls, and the TPS registration timing.
- [12]Data (Use and Access) Act factsheet: Privacy and Electronic Communications Regulations
GOV.UK
PECR enforcement aligned with data protection law, and fines for calls that do not connect.
- [13]One year on: marking the 12-month commencement of the Data (Use and Access) Act
ICO, 23 June 2026
PECR fines can now reach £17.5 million or 4% of global turnover.
- [14]Monitoring workers: specific considerations, including call recording
ICO
Tell people you are recording a call and why, ideally with a recorded message.
- [15]Less than one week to go for MTD
HMRC on GOV.UK, 28 March 2022
All VAT-registered businesses use Making Tax Digital for VAT from April 2022.
- [16]VAT Notice 700/22: Making Tax Digital for VAT
HMRC on GOV.UK
Digital records, functional compatible software and the digital links requirement.
- [17]Check if you're eligible for Making Tax Digital for Income Tax
HMRC on GOV.UK, updated 26 March 2026
The £50,000, £30,000 and £20,000 thresholds from April 2026, 2027 and 2028.
- [18]Promoting electronic invoicing across UK businesses and the public sector: consultation response
HMRC and HM Treasury on GOV.UK, 26 November 2025
Mandatory e-invoicing for VAT invoices from 2029, B2B and B2G scope, a decentralized model and a roadmap at Budget 2026.
- [19]HMRC transformation roadmap: progress update 2026
HMRC on GOV.UK, updated 27 July 2026
E-invoicing for all VAT invoices from April 2029.
- [20]Tax update 2026: simplification, modernisation and fairness (summary)
HM Treasury on GOV.UK, updated 23 June 2026
Peppol as the core interoperability network for UK e-invoicing.
Tell us which UK workflow you want to hand over.
A 30-minute call with an engineer. We will tell you what a system could do for that workflow, and which of the rules above it touches.
What happens next
- 1
Strategy call
We learn how the workflow runs today and what a good outcome would be.
- 2
Workflow audit
We map the process and measure where a system would save the most time.
- 3
Proposal
A written scope, timeline and fixed price for your first system. No obligation to build.