Outsourcing Spotlight - Autumn 2023

For outsourcing service providers, AI offers major new opportunities to improve efficiency and profitability.  For customers, meanwhile, outsourcing offers the possibility of accessing cutting- edge AI tools and expertise in deploying them, both of which may well be difficult to replicate in-house.  But none of these benefits come without risk.  In this section, we focus on 2 key questions:

1. To what extent does AI raise new risks, compared with other software-based technologies?
2. Where is the debate on regulation heading and how can businesses involved in outsourcing minimise their exposure to future regulatory risk?

New risks – or familiar risks but in a new context?

Many outsourcings rely heavily on technology – and both suppliers and customers will already be familiar with the key risks and how to mitigate them.   Many of the same risks arise with the deployment of AI.  Just as for other tech-enabled outsourcings, the provisions of the outsourcing contract dealing with intellectual property rights, data and data protection risks, liability, the commercial model and exit will continue to be key areas of focus for an AI-enabled outsourcing, but we've identified below some additional points to watch out for where AI tools are deployed.  

If the relevant data is personal data, it will be necessary to ensure compliance with data protection legislation.  Again, this is not a new risk - but processing personal data using AI may require additional Data Protection Impact Assessments to be carried out and measures relating to transparency and the legal basis for processing (such as consent or legitimate interests) to be revisited, particularly if individuals might not expect their data to be processed using AI.  Additional considerations will also apply if the AI involves automated decision-making that has a legal or similarly significant effect on individuals (e.g. AI screening CVs as part of an HR outsourcing).

As ever, it's crucial to prepare for the end of the relationship right at the beginning of it.  On exit, there will be similar "lock-in" risks to those that apply for other proprietary software tools - the service provider may be unwilling to provide information or license its AI tool to a replacement provider – but there may be additional issues with data migration to consider in this context as well.  It may not be possible to provide training data (e.g. belonging to third parties) to a replacement provider, nor to extract customer data that is held in a data lake.  It will be important to mitigate these issues in the contract.   

As with any software-based solution, AI poses risks if it does not produce accurate, reliable results – and there is sometimes a tendency to assume that computers are more reliable than is in fact the case (for an extreme example, see our briefing on the Post Office's reliance on data from its flawed Horizon computer system to prosecute sub-postmasters for alleged fraud).  Once again, this is not a new risk – but it is arguably more acute with AI because even some AI vendors admit that they do not yet fully understand how their own technology produces the results that it does.   Before relying on AI tools, businesses will want to know, for example:

• whether the original data on which the AI was trained was itself reliable (which is not something that has typically needed to be considered with software in the past);
• whether its outputs can be trusted;
• whether there have been any independent evaluations of the tool's reliability and accuracy;
• the extent to which the service provider is prepared to accept liability for errors caused by AI;
• what remedies the service provider will offer if outputs are wrong, given that the workings of AI are often not transparent (and establishing a root cause for incidents could be difficult in such circumstances).

The service provider, on the other hand, may look for a greater allocation of responsibility   between the parties for the AI solution - for example, to be able to rely on "relief"/"excusing cause" provisions if the services are negatively impacted by customer-provided training data that is of a substandard quality. 

There are also some risks with AI which businesses have not typically had to devote much attention to in the past when evaluating other types of software tools.  These include:

• Bias and discrimination: Where AI is being used to assist in decision-making processes relating to individuals (e.g. when processing insurance claims or credit card applications), there is an increased risk compared with other types of software that it may exhibit bias.  This in turn could give rise to breaches of the Equality Act 2010, such as its provisions prohibiting discrimination in the supply of goods or services. 
• Intellectual property: While the focus traditionally is around the ownership and licensing of IP in the software tool itself, for generative AI used in outsourcing, it will also be important to address IP rights in the AI's output.  As with other types of software, customers will typically want some form of contractual protection against third parties claiming that their intellectual property is being infringed.  However, in the past, that risk has come primarily from competing software vendors claiming that their technology has been copied in some way or utilised without permission.  With AI, as we explain in this article, the more significant challenge may come from holders of copyright in the data on which the AI product has been trained – potentially "tainting" the outputs of the AI.  Lastly, if AI is being used to interact with other third party software tools, check that third party licences support such use (e.g. if they are licensed on the basis of human users, additional licences may be required for use by AI).   

Linking prices to inflation

From the supplier's perspective, it may be attractive to link price rises directly to inflation through indexation clauses, with a view to ensuring that charges enable recovery of increasing costs  – but which index should you use?    Our short guide to indexation clauses looks at the possibilities in more detail but key takeaways include the following:

Outsourcing contracts will often have different liability caps for different heads of loss – for example, it is now common to see separate caps for liability arising from breaches of data protection obligations.   But whether or not you have several caps addressing different types of loss, you also need to consider whether each of those caps are designed to cover the entire duration of the contract - or whether they should effectively "reset", perhaps for each year of the contract or in relation to each separate incident giving rise to loss.  If this is not clear, you run the risk of getting into disputes over how much is actually recoverable. 

Our recent briefing discusses two cases – Drax v Wipro (2023) and Royal Devon v ATOS (2017) where there was confusion over whether the contract was intended to operate with single or multiple caps.  The key takeaways are as follows

Whilst cybersecurity is likely to be a concern in relation to almost any technology-driven outsourcing, certain sectors and activities are required by the Network and Information Systems (or NIS) regime to take specific measures to ensure the resilience of their operations.  At present, these include:

• Providers of essential services in the transport, energy, water, health and digital infrastructure sectors; and
• Certain digital service providers, notably cloud computing services.

The current NIS regimes in the EU and the UK essentially require in-scope organisations to adopt appropriate security measures to protect against cyber threats, including monitoring, auditing and testing, together with specific procedures to report and respond to security breaches.  But as we explain below, the scope of NIS is widening in both the EU and the UK – which is likely to bring more outsourcing operations into its ambit. Alongside this, the obligations on in-scope organisations are also expected to increase.  This may have implications for costs and in some cases could require changes to service provision (e.g. introduction of 2 factor identification and other enhanced security measures when accessing services).

In the EU, the new NIS regime will require in-scope entities to implement "appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which those entities use in the provision of their services".  These measures must be taken in connection with a list of specified matters, such as incident handling, business continuity, supply chain security, encryption, access control, the use of multi-factor authentication, and vulnerability handling and disclosure.  The new regime will also impose responsibilities on “management bodies” of essential and important entities to approve cybersecurity measures and supervise their implementation; management may also be held liable (as well as temporarily banned) if the organisation does not comply with cybersecurity requirements. 

By contrast, the UK – which has yet to publish the full detail of its proposed changes – is likely to take a more flexible, outcomes-focussed and risk-based approach. Competent authorities responsible for regulating each sector will continue to set the cybersecurity measures which regulated entities will have to implement.  But both regimes contain measures designed to require in-scope entities to take more account of vulnerabilities in their supply chain – so even though an outsourced activity or outsourcing service provider may appear not to be in scope, it could be drawn into the net because of its position in a wider supply chain.

What do the proposed changes to the UK's data protection regime mean for outsourcing arrangements?  Expectations of significant change were raised by rhetoric from Government Ministers suggesting that the existing EU-derived regime, known as UK GDPR, would be replaced "with our own business and consumer-friendly, British data protection system".  However, the Data Protection and Digital Information (no.2) Bill does not represent a dramatic departure from UK GDPR (and the basic framework of the current regime will largely be retained).  The main reason for this is that if the UK diverged too much from the EU approach, it would risk losing the benefit of the European Commission's adequacy decision, which makes it substantially easier to transfer personal data between the UK and EEA Member States than would otherwise be the case.

Our briefing contains more detail on the proposed changes, but the key takeaways for those involved in outsourcing arrangements are as follows:

Finally, outsourcing service providers which are reliant on processing operations outside the EEA should note the Information Commissioner's Office (ICO) revised guidance on international transfers of personal data.  It has also introduced a new tool to undertake transfer risk assessments (TRA). A TRA is required where there is a restricted transfer of data outside the UK (not covered by UK "adequacy regulations") that relies upon an "appropriate safeguards" mechanism in Article 46 of the UK GDPR, such as standard contractual clauses.

The ICO's proportionate, risk-based approach to TRAs is welcome, and organisations, particularly those with an exclusively UK focus, may now choose to follow the ICO's approach over that of the European Data Protection Board. For more detail, see our briefing.

In May 2023, the UK Government announced that it was planning to make certain changes to TUPE – which is almost invariably a significant issue in relation to outsourcings, in-sourcing or changes of service provider.  Under TUPE, the employees working wholly or predominately in the business or service which is transferred, or outsourced/insourced, automatically become employed by the buyer of the business, or the new supplier of the service, on their existing terms and conditions. Both the old and new employer have to provide information to their employees about the transfer and consult them about any measures they plan to take in connection with the transfer.

There are two areas in which TUPE transfers could be made easier in practice, relating to employee information and consultation and harmonising employment terms. The Government has announced that it will be making certain post Brexit changes in respect of employee information and consultation (see below) – but perhaps disappointingly from a business perspective, there is no indication it intends to make any changes in respect of harmonising terms.

As noted above, another aspect of TUPE which often causes difficulty in an outsourcing context relates to harmonising employment terms.  This issue is not covered by the current TUPE consultation and the Government has not given any indication that it is considering this.   However, if it were looking to make further changes to the detail of TUPE (as it is now free to do following Brexit), then harmonisation of terms would in our view be worth exploring.  The issue is as follows:

Employers will frequently want to harmonise employees' terms post-transfer, for various reasons including employee relations and simplifying administration.  However, any change in terms by reason of the TUPE transfer will be void, even if the employee agrees to the change. An exception applies for certain changes (for economic, technical or organisational reasons) but only if the changes involve a change in employee headcount or roles, which harmonisation rarely does. If employers had greater scope to agree changes post TUPE transfer, including changing terms solely for harmonisation, then this would be highly beneficial for businesses which inherit employees on a change of service provider or an insourcing.

After several years of relative quiet in terms of employment law legislative proposals, the UK Government has now put forward a number of changes which may have significant implications for outsourcing arrangements:

Harassment:  new duties on the way

The Government plans to introduce a new positive duty on employers to take reasonable steps to prevent workplace sexual harassment.  The duty will be enforceable by the Equality and Human Rights Commission, under its existing powers, and will be backed up with a statutory code of practice detailing the steps employers should take. Employers who fail to take reasonable steps to prevent sexual harassment could also face an uplift in compensation if an employee brings a successful claim.

Originally the new legislation on sexual harassment included a new duty on employers to prevent all forms of harassment of staff by third parties, but this was removed as the legislation progressed through Parliament.  This duty would have applied to all types of harassment, not just sexual harassment.  In an outsourcing context, this would have made customers liable for harassment of their employees by outsourced service providers;  meanwhile, service providers would have been liable for harassment of their employees by their customer.  Although this new duty now seems unlikely to come in, it may still prompt businesses to consider whether they wish to address this issue in contracts in any event, for two reasons:

• First, even without the new third party harassment laws there are still circumstances in which employers may be liable if their staff is harassed by someone outside the organisation.
• Second, employers are increasingly seeking to improve the measures they have in place to protect their staff, given the increasing focus on ESG and high profile harassment cases recently in the media.

The Government is introducing a new right for certain workers to request a more predictable working pattern.  This will apply where:

• the worker has at least 26 weeks' service and there is lack certainty in terms of the hours, days, or times of work, or
• they are on a fixed contract of 12 months or less.

In these cases, the worker could make an application to their employer to vary their terms and conditions to provide more certainty.

Employers would have to follow a set procedure when considering such requests and only reject a request on specified business grounds (similar to a flexible working request).  In practice, the new right will capture many casuals and zero hours workers, as well as agency workers and those on short fixed-term contracts. The proposal is contained in the Workers (Predictable Terms and Conditions) Act, but there is no date for implementation yet.

To date, outsourcing in the financial services sector has mainly been regulated through the imposition of obligations on regulated financial services providers, which are typically the customers in an outsourcing relationship.  Such firms are required to notify regulators of material outsourcings and ensure that appropriate practical and contractual safeguards are in place.  However, as a general rule, businesses actually providing the outsourced services have not so far been regulated in the UK (unless they themselves required authorisation for the activities they were performing).

Under the framework of the Financial Services and Markets Act 2023, the Treasury – in consultation with financial services regulators – has the ability to designate certain third party providers of services to the financial sector as "critical" and therefore subject to certain regulatory requirements.  A discussion paper was issued in 2022 with a consultation expected later this year.  For more detail, see our briefing.

We regularly advise both customers and suppliers on outsourcing transactions in a broad range of sectors.  Recent examples include: