SearchSubscribe

P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Compliance and Regulation

Guardian: AI scores Co-op Legal Services calls on more than 50 aspects; the Co-op calls it a support tool

The Guardian reports that Co-op Legal Services uses AI to score probate calls on more than 50 aspects and send pass or fail results to managers; the Co-op calls it a support tool. UK law allows monitoring; lawfulness turns on what is not stated: notice, impact assessment and use of the scores.

By Parminder Kumar Sharma · · 20 min read

A dark desk with an open silver laptop and a plain graphite call-centre headset lying in front of it. The laptop screen shows a tall list of eight blank rounded rows, each with a small dot at the left and a small blank pill at the right, with no writing anywhere. Nobody is in the room.

Several hours or seven: the Guardian's page gives both, and the Co-op says AI lets it review all conversations

The Guardian's report of 8 October 2026 gives two figures for how long one Co-op Legal Services worker is watched by the system. The text says several hours a day. A picture caption on the same page says seven hours a day, which is 420 minutes (derived). Each is attributed to an unnamed worker, and the page does not say whether it is the same person or what their contracted day is. The one company-sourced claim about scale is a phrase, not a number: the Guardian quotes the managing director of Co-op Life Services as saying the AI lets the company "review all customer conversations". On its own authority the Guardian adds that a model from OpenAI has been trained to assess more than 50 discrete aspects of each call and to give pass and fail scores to managers.

What that does not establish. It does not establish that anything unlawful has happened. The ICO says in terms that data protection law does not prevent monitoring workers, and it names quality control and training as reasons to monitor business calls. It does not establish what the hours mean: no call volumes or contracted hours are given. And it is not the Co-op's own account: the OpenAI link, the 50 aspects, the percentage and the sales purpose are the Guardian's reporting, resting on one outlet and one anonymous source, and the Co-op's quoted statements name no model or vendor. The Co-op says it does not recognise the criticism and that the AI is a support tool, not a decision-maker. A score is not a decision, and nothing here says a law has been broken. This briefing does not say so.

Why it still matters. Three things the Guardian does not report decide whether this is ordinary quality control or regulated profiling: whether callers are told, whether an impact assessment came first, and what a manager may do with a fail score. The UK rules on automated decisions were rewritten on 5 February 2026, 245 days before the report (derived), and the Guardian says the system was introduced in the last couple of months, so it began under the new rules. The ICO's workplace monitoring guidance carries an under-review notice, and its page on automated tools still summarises the old Article 22.

What is reported, what the Co-op says, and what neither says

The table keeps apart what the Guardian reports on its own authority, what the Co-op is quoted as saying, and what no source states. The Guardian is the only source for the system itself, and the Co-op disputes the framing.

Reported on 8 October 2026 and not stated, from the Guardian article and the Co-op statements quoted in it

  1. Topic
    What it does
    Reported, and by whom
    Guardian: AI models record, analyse and give a percentage score to calls between agents and callers seeking advice on probate, wills and estates
    Not stated
    How the percentage is built; whether the model reads audio or a transcript
  2. Topic
    Model and vendor
    Reported, and by whom
    Guardian: a model from OpenAI, trained to assess more than 50 discrete aspects of each call
    Not stated
    Whether the Co-op confirms OpenAI; the 50 aspects; who processes the data and where
  3. Topic
    What managers get
    Reported, and by whom
    Guardian: pass and fail scores, used to analyse employee performance
    Not stated
    Whether scores feed pay, progression, discipline or targets
  4. Topic
    Purpose
    Reported, and by whom
    Co-op: a support tool, not a decision-maker, a key aspect of quality assurance. Guardian: used in part to identify ways to boost sales
    Not stated
    Whether sales was given to staff or callers as a purpose
  5. Topic
    Scale
    Reported, and by whom
    Managing director of Co-op Life Services: AI allows review of all customer conversations. Guardian: introduced in the last couple of months, dozens of staff
    Not stated
    The number of staff; the share of calls scored
  6. Topic
    Time watched
    Reported, and by whom
    Guardian: an unnamed worker, several hours a day (text); an unnamed employee, seven hours a day (caption)
    Not stated
    Whether it is the same person; contracted hours; whether that is typical
  7. Topic
    Notice and consultation
    Reported, and by whom
    Guardian: a worker says they are being watched, unlike occasional listening for compliance
    Not stated
    Whether staff were consulted or callers told on the call
  8. Topic
    Impact assessment, lawful basis, retention
    Reported, and by whom
    Nothing in the Guardian's piece or the Co-op's quoted statements
    Not stated
    All three, and where the data is held
  9. Topic
    Criticism and reply
    Reported, and by whom
    Anonymous worker: oppressive and dystopian. A union national officer: unaccountable systems should not manage people. An HR professional body adviser: the office is becoming more like a factory
    Not stated
    Co-op: does not recognise the criticism; says its probate advisers are highly engaged

The hours row is the one place where the Guardian's own page disagrees with itself. The Guardian also links the report to its 28 September piece on AI scoring of teachers at a training company, a separate employer not examined here.

Support tool, quality assurance, surveillance: three labels, and none is a control

The Co-op says support tool and quality assurance. The Guardian's headline says surveillance and its whistleblower says dystopian. None is a legal category and none changes what the law asks. The ICO makes the point about documents: "Excessive monitoring set out in a policy does not make it lawful, just because it is documented." A friendly name works the same way. What counts is the purpose, the lawful basis, whether people are told, whether a risk assessment came first, and what happens to the score.

The test the Co-op's phrase invokes. Since 5 February 2026, Article 22A of the UK GDPR says a decision is "based solely on automated processing if there is no meaningful human involvement in the taking of the decision", and is a significant decision if it has a legal or similarly significant effect on the person. Article 22C then requires safeguards for decisions that meet both limbs: information, a way to make representations, human intervention and a way to contest. "Not a decision-maker" is a claim about the human-involvement limb, and it can be true. But the ICO's AI guidance says a decision does not escape the rules just because a human has "rubber-stamped" it, and warns of automation bias, where people rely on a system's output and stop using their own judgement. The ICO's draft says ad hoc spot-checking is not enough, because some decisions will never be checked.

The automated decision test applied to what is reported, using the three factors in the ICO draft guidance on Article 22A

  1. Factor
    A decision about a person (profiling counts)
    On the Guardian's account
    The system scores workers' calls and managers analyse performance with the results. Article 4(4) names performance at work as an aspect profiling evaluates. Our reading: scoring an adviser's call is profiling of the adviser
    Not established
    What the pass mark is set against; whether callers are profiled too
  2. Factor
    A significant decision: legal or similarly significant effect
    On the Guardian's account
    Not reported. The ICO draft lists employment circumstances and reputation among effects that can be significant
    Not established
    Whether any score has changed pay, progression, discipline or targets
  3. Factor
    Solely automated: no meaningful human involvement
    On the Guardian's account
    Co-op: a support tool, not a decision-maker. Managers receive the scores
    Not established
    What a manager does with a score; whether managers overrule it; whether anyone records that

If the second or third row comes out no, Articles 22A to 22C do not apply. That does not make the scoring unregulated: Articles 5, 6, 13 and 35 apply to any processing of personal data, and the ICO's monitoring guidance applies in full. A cleared automated decision test is the start of the analysis, not the end.

The Co-op's side, fairly stated. Quality monitoring of calls is ordinary: the ICO's own worked example is a call centre that monitors helpline calls for training and quality control, where workers know through a policy and customers are told during calls. The Co-op's managing director is quoted saying human judgement stays central. If scores are one input among several and managers use them for coaching, that is defensible. The Guardian does not report the evidence either way.

One call, five places where the rules have a say

The diagram follows one call through the system as the Guardian describes it and marks the rule that applies at each step. It draws nothing that no source states; where the sources are silent the box says so.

A vertical flow of five boxes from a caller to the worker. Each box gives what the Guardian reports, the rule that applies, and what is not stated: callers told, call recorded, AI model scoring on more than 50 aspects, a manager receiving the score, and what happens to the worker. The not-stated items include whether callers are told, any impact assessment, what managers do with a fail score, and any effect on pay.
Drawn from the Guardian report of 8 October 2026, the Co-op client privacy notice read the same day, the ICO guidance on monitoring workers, UK GDPR Articles 22A to 22C and 35, and the 2018 interception regulations. The Co-op's real process is not public.

Two of the five checks must happen before any call is scored: telling the people affected, and the impact assessment. Article 35 requires the assessment "prior to the processing", and Article 13 requires information "at the time when personal data are obtained". The Guardian is silent on both.

The rules changed 245 days ago, and the regulator's guidance is still catching up

The dates matter because the system is, on the Guardian's account, new. Day counts run to 8 October 2026 (derived) from S.I. 2026/82, S.I. 2026/1015, section 164A and the ICO and SRA pages.

Dates from legislation.gov.uk, the ICO and SRA pages and the Guardian, with days before 8 October 2026 (derived)

  1. Date
    29 Jan 2026
    What changed or was published
    S.I. 2026/82 made, bringing the main data protection changes into force
    Days before
    252
  2. Date
    5 Feb 2026
    What changed or was published
    Articles 22A to 22D in force. The "logic involved" duty in Articles 13 and 15 now attaches to automated decisions covered by Article 22C
    Days before
    245
  3. Date
    31 Mar 2026
    What changed or was published
    ICO publishes updated draft guidance on automated decision-making for consultation
    Days before
    191
  4. Date
    29 May 2026
    What changed or was published
    ICO consultation on the draft closes; the draft is not final
    Days before
    132
  5. Date
    19 Jun 2026
    What changed or was published
    Controllers must facilitate and acknowledge complaints from data subjects (section 164A, Data Protection Act 2018)
    Days before
    111
  6. Date
    About Aug 2026
    What changed or was published
    Guardian: the Co-op system introduced "in the last couple of months"
    Days before
    about 60
  7. Date
    17 Aug 2026
    What changed or was published
    SRA publishes its warning notice on misuse of AI
    Days before
    52
  8. Date
    30 Sep 2026
    What changed or was published
    The Information Commission replaces the Information Commissioner
    Days before
    8

Two details need a flag. First, the duty to give "meaningful information about the logic involved" in Article 13(2)(f) and Article 15(1)(h) now attaches only to automated decisions subject to the Article 22C safeguards. For call scoring that stops short of a solely automated significant decision, that duty does not apply. A worker or caller can still ask for their data, the purposes, recipients, transfers and retention. Second, the ICO's pages are in flux. Its monitoring guidance is marked under review, and the page on automated tools still describes the old Article 22 and its three permitted routes. The replacement is a draft that the ICO says will inform a statutory code of practice on AI and automated decisions. Treat the guidance as the regulator's current reading, not settled law. The regulator is now the Information Commission, though its website still uses the ICO name.

What the ICO and the UK GDPR expect of an employer that adopts call scoring

None of this is specific to the Co-op. It is what the ICO's guidance and the UK GDPR say to any employer that records and scores calls. In the ICO's wording, must means law and should means what the ICO expects.

  • Lawful basis. Article 6 requires one. The ICO says consent is not usually appropriate in employment because of the imbalance of power. Legitimate interests is the likelier route and needs a documented three-part test: purpose, necessity and balancing. The Co-op's client notice gives it as the basis for recording calls; the basis for scoring staff is not stated anywhere we found.
  • Telling workers. Employers must inform workers about monitoring and about changes to it. We found no public staff notice.
  • Telling callers. On calls the ICO says employers must tell callers that the call is recorded, and why, and that a recorded message is good practice. The 2018 interception Regulations authorise recording for monitoring only if all reasonable efforts have been made to inform users of the system. Article 13 adds purposes, legal basis, recipients, transfers outside the UK and retention.
  • Impact assessment first. The ICO's AI guidance says that in the vast majority of cases AI use is likely high risk and needs one. Its high-risk list includes any profiling of individuals on a large scale, and innovative technology including AI when combined with another criterion. It treats employees as potentially vulnerable and gives monitoring that may cost workers money, such as performance management, as high risk. Its rule of thumb is that two of nine criteria usually signal a DPIA. On the Guardian's account three are engaged: evaluation or scoring, systematic monitoring and innovative technology. That is our reading, not an ICO finding, and it says nothing about whether the Co-op did one. It should cover callers as well as staff.
  • Proportionality. The ICO says it is not usually proportionate to monitor or record the content of calls in all cases, while allowing monitoring for training or quality control. The assessment should show that less risky alternatives were considered.
  • Accuracy and bias. The ICO says analytic tools can make incorrect inferences about workers and workers should be able to see, explain and challenge results. Where the thing scored is subjective, apparent accuracy can reflect what human labellers thought rather than objective truth. Our reading: a score for something like empathy is that kind of target. The Co-op is quoted speaking of empathetic guidance; the Guardian does not say empathy is one of the 50 aspects.
  • Consultation. Employers should seek and document the views of workers or their representatives unless there is good reason not to.
  • Retention. Monitoring data must not be kept longer than necessary. The Co-op's client notice says call recordings are kept up to three years; no period is stated for transcripts, scores or supplier copies.
  • Suppliers and transfers. The ICO says employers should not assume a purchased package complies, need a processor contract, and gives a US-hosted monitoring application as an example of a restricted transfer needing safeguards. The Co-op's notice says it may transfer data where providers are hosted outside the UK and names no provider. Whether this system moves data out of the UK is not stated.
  • Stress. The ICO says excessive monitoring is likely to undermine workers' privacy and mental wellbeing and damage trust. The Guardian cites the International Labour Organization, but its quoted sentence comes from an April 2026 ILO working paper by one author, whose disclaimer says the views are the author's and who concludes "preliminarily". That is evidence of a concern, not an ILO position.

The Co-op's published client notice lists four reasons for recording calls, and does not mention AI

We read the client privacy notice of Co-operative Legal Services Limited on 8 October 2026. It is a notice for clients, prospective clients and third parties, not for staff, and we found no public staff notice. The company's own pages say Co-op Legal Services is a trading name of it.

What the Co-op Legal Services client privacy notice (version 3.0 2026, undated) says about calls, read 8 October 2026

  1. Topic
    Recording calls
    What the notice says
    Calls may be recorded for quality monitoring, training, complaints and disputes, and colleague protection
    What it does not say
    AI analysis, scoring or sales performance
  2. Topic
    Lawful basis
    What the notice says
    Legitimate interests, for recording calls
    What it does not say
    The basis for scoring staff or any AI processing
  3. Topic
    Retention
    What the notice says
    Call recordings kept up to 3 years, then permanently deleted
    What it does not say
    Retention of transcripts, scores or supplier copies
  4. Topic
    Suppliers
    What the notice says
    Third-party technology providers, including cloud providers, for hosting, sharing, transfer, analysis or storage
    What it does not say
    Any provider's name, or that call data goes to one
  5. Topic
    Transfers
    What the notice says
    May transfer data outside the UK where providers are hosted there, with safeguards
    What it does not say
    Which countries, providers or mechanism
  6. Topic
    Automated decisions
    What the notice says
    Says it does not currently decide about people solely by computer system
    What it does not say
    Anything about staff; the statement sits in a client notice

The call paragraph is essentially unchanged since an Internet Archive capture of 4 May 2025: the same four purposes, basis and three years, apart from "required by law" becoming "required or permitted by law". The notice has since gained other sections, and the two that touch technology are generic paragraphs on third-party technology providers and on using information for "development and testing" of systems. Neither mentions calls or AI. A notice is not the only place callers are told: a recorded message could carry the AI point, and we cannot hear it. Whether a sales or AI use falls inside "quality monitoring" is for the Co-op to answer; this briefing does not decide it.

Co-op Legal Services is SRA-regulated; the SRA's August notice covers confidentiality and accuracy, not staff scoring

The SRA register lists Co-operative Legal Services Limited as a licensed body, licence 567391, granted on 16 April 2012, licensed for probate activities among others. The Co-op Legal Services website says the same, so the firm's conduct falls under the SRA's Codes as well as data protection law.

On 17 August 2026 the SRA published a warning notice, Misuse of AI. It names two concerns: false citations from AI hallucinations, and client confidentiality. It says client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place, should not train models unless explicitly authorised, and should not be kept longer than necessary. It cites paragraph 6.3 of both Codes, which requires firms to keep the affairs of current and former clients confidential, and paragraph 2.1 of the Code for Firms on governance.

What the notice does not do. It does not mention staff monitoring, call recording or call scoring, and does not say any firm has breached it. Whether it bites here depends on facts the Guardian does not give: whether callers are clients (paragraph 6.3 speaks of current and former clients, and the Co-op's notice says a person given advice during an enquiry has client protections), whether recordings or transcripts leave a controlled environment, and whether the supplier may train on them.

What to do, in the order worth doing it

Three readers, three lists, drawn from the ICO's guidance and the statute. This is not legal advice, and the ICO guidance is under review, so check the current page.

Take this with you

If you are an employer considering call scoring

  • Write the purpose in one sentence and test it against a less intrusive method such as sampled human review or aggregated team reports.
  • Choose and document the lawful basis. Do not rely on staff consent. For legitimate interests, keep the assessment.
  • Complete an impact assessment before any call is scored, with your data protection officer's advice recorded. Cover callers as well as staff, and seek staff views.
  • Decide in writing what a score may be used for. Coaching is one purpose; pay, discipline and sales targets each need their own justification. Never let a score alone trigger an outcome.
  • If any outcome could rest on a score without a person genuinely weighing it, apply the Article 22C safeguards. Record who reviewed, with what authority, and how often they overrule the model.
  • Test accuracy before launch and at intervals, including for accents, speech differences and reasonable adjustments. Record that a judgement score, such as empathy, is an opinion.
  • Tell staff before go-live. Tell callers on the call that it is recorded and why, and update the privacy notice to name AI analysis and every purpose.
  • Fix supplier terms: a processor contract, no training on call data unless you authorise it, where it is processed, a transfer mechanism, and separate retention for audio, transcripts and scores.
  • Set a complaints route that acknowledges within 30 days, a named reviewer, and a date to review or stop.

Take this with you

If you are a worker whose calls are scored

  • Ask your employer in writing which calls are recorded, what the system scores, who sees the results and what they are used for.
  • Make a subject access request for your recordings or transcripts, every score and result, comments sent to managers, and the purposes, recipients, transfers and retention. The clock is one month, extendable by two if complex, and the employer need only make a reasonable and proportionate search.
  • Ask in writing whether any decision on pay, discipline, progression or targets has been taken on a score with no genuine manager review. If so, Article 22C gives you information about the decision, representations, human intervention and a way to contest it, and Article 15 entitles you to meaningful information about the logic involved. If not, ask for the purposes and how scores are used.
  • If the basis is legitimate interests, you can object on grounds relating to your situation. The employer must stop unless it shows compelling grounds.
  • Complain to the employer first. Since 19 June 2026 it must acknowledge within 30 days and respond without undue delay. Then you can complain to the ICO.
  • Ask your union representative whether the union was consulted and whether any agreement covers how scores are used. Keep dated notes of what you were told.

Take this with you

If you are a customer calling a firm that records and analyses calls

  • Listen for the recording message. If there is none, ask whether the call is recorded, why, and whether it is analysed or scored by AI.
  • Read the privacy notice for the purposes, lawful basis, recipients, transfers outside the UK and retention. A notice that lists reasons for recording but never mentions AI analysis is a prompt to ask.
  • Ask in writing for a copy of the recording and any transcript or analysis of your call. Your right of access applies, although a firm may withhold some material, for example where legal professional privilege applies.
  • Ask how long the recording and any transcript are kept, and whether the firm's supplier may use them to train a model. If the firm relies on legitimate interests, you can object.
  • If the firm does not answer within a month, complain to the firm, which must acknowledge within 30 days, and then to the ICO. For legal advice you received, the Legal Ombudsman and the SRA are further routes.

Two earlier briefings bear on the asking. Spain fined Securitas Direct because people were told to use a chargeable line for access and objection, so the channel for rights requests is part of the duty. And Claude's voice-training toggle has no published retention period, the same gap the customer list asks about: how long a recording of your voice is kept.

The question that exposes the gap

The Co-op calls the system a support tool and says human judgement stays at the heart of the work. Both claims can be tested with one question, put to the employer in writing: how many times since the system began has a manager overruled a score, and where is that recorded? If the answer is a number and a record, the label describes a process. If the answer is none, or nobody counts, the label is carrying a weight the record does not.

Key facts

Sources

  1. PrimaryEmployment practices and data protection: monitoring workers, the main page (dated 16 June 2026 in its metadata, marked under review because of the Data (Use and Access) Act), read in full. Lawful basis, transparency, DPIA, purpose limitation, accuracy, retention, consultation, suppliers and transfers, covert monitoring, access and objection.ICOaccessed 2026-10-08
  2. PrimaryThe monitoring guidance page on methods of monitoring (dated 17 August 2026), read in full. The section on telephone calls: not usually proportionate to record content in all cases, quality control and training, and the duty to tell callers.ICOaccessed 2026-10-08
  3. PrimaryThe monitoring guidance page on solely automated tools (dated 16 June 2026), read in full. It still summarises the pre-2026 Article 22 and is marked under review.ICOaccessed 2026-10-08
  4. PrimaryDraft guidance on automated decision-making including profiling (updated 31 March 2026, page dated 2 September 2026), read with its subpages on what the UK GDPR says, the safeguards, rights and impact assessments. Meaningful human involvement, spot-checking, significant effects.ICOaccessed 2026-10-08
  5. PrimaryThe consultation page for the draft: opened 31 March 2026, closed 29 May 2026. Used to establish that the draft is not final.ICOaccessed 2026-10-08
  6. PrimaryWhen do we need to do a DPIA, read in full: Article 35(3), the ICO list of ten processing types, the nine criteria, the rule of thumb of two, employees as potentially vulnerable.ICOaccessed 2026-10-08
  7. PrimaryThe ICO list of processing operations likely to result in high risk, read in full: large-scale profiling and innovative technology including AI.ICOaccessed 2026-10-08
  8. PrimaryGuidance on AI and data protection, accountability and governance chapter (updated 15 March 2023), read in full: DPIAs for AI in the vast majority of cases, less risky alternatives, controllers and processors, outsourcing.ICOaccessed 2026-10-08
  9. PrimaryGuidance on AI and data protection, individual rights chapter, read in full: human oversight, rubber-stamping, automation bias.ICOaccessed 2026-10-08
  10. PrimaryGuidance on AI and data protection, accuracy and statistical accuracy chapter: subjective targets and what apparent accuracy can reflect.ICOaccessed 2026-10-08
  11. PrimaryThe ICO public page on decisions made without human involvement (dated 30 September 2026, marked under review), read in full. Used for the complaint route and the observation that it still describes the old test.ICOaccessed 2026-10-08
  12. PrimaryUK GDPR Article 22A as substituted by the Data (Use and Access) Act 2025 section 80: the definitions of solely automated and significant decision. In force 5 February 2026 per the page's commencement note.legislation.gov.ukaccessed 2026-10-08
  13. PrimaryUK GDPR Article 22C, the safeguards: information, representations, human intervention and contest. Articles 22B and 22D were also read.legislation.gov.ukaccessed 2026-10-08
  14. PrimaryUK GDPR Article 35: an impact assessment prior to the processing; Article 35(3)(a) and the contents in 35(7).legislation.gov.ukaccessed 2026-10-08
  15. PrimaryUK GDPR Article 13 as amended: information at the time data are obtained, and Article 13(2)(f) now limited to automated decision-making subject to Article 22C.legislation.gov.ukaccessed 2026-10-08
  16. PrimaryUK GDPR Article 15 as amended: Article 15(1)(h) on automated decision-making and Article 15(1A) on a reasonable and proportionate search.legislation.gov.ukaccessed 2026-10-08
  17. PrimaryUK GDPR Article 4(4), the definition of profiling, which names performance at work.legislation.gov.ukaccessed 2026-10-08
  18. PrimaryData (Use and Access) Act 2025 section 80, automated decision-making, with the commencement note: in force 5 February 2026 by S.I. 2026/82.legislation.gov.ukaccessed 2026-10-08
  19. PrimaryThe Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, made 29 January 2026: regulation 2(j) brings section 80 into force on 5 February 2026; regulations 3 and 7 on the complaints duty from 19 June 2026.legislation.gov.ukaccessed 2026-10-08
  20. PrimaryThe Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, made 10 September 2026: the Information Commission replaces the Information Commissioner on 30 September 2026.legislation.gov.ukaccessed 2026-10-08
  21. PrimaryData Protection Act 2018 section 164A: controllers must facilitate complaints, acknowledge within 30 days and respond without undue delay.legislation.gov.ukaccessed 2026-10-08
  22. PrimaryThe Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, regulations 3 and 4: the lawful authority for monitoring communications and the condition of reasonable efforts to inform users. Investigatory Powers Act 2016 sections 3 and 46 were also read.legislation.gov.ukaccessed 2026-10-08
  23. PrimaryClient privacy notice, version 3.0 2026, undated, read in a browser on 8 October 2026: the call recording paragraph, legitimate interests, three years, providers, transfers, and no mention of AI, scoring or sales.Co-op Legal Servicesaccessed 2026-10-08
  24. PrimaryWebsite footer: trading names of Co-operative Legal Services Limited, company number 05671209, authorised and regulated by the SRA under 567391.Co-op Legal Servicesaccessed 2026-10-08
  25. PrimaryRegister of licensed bodies entry for Co-operative Legal Services Limited, licence 567391, granted 16 April 2012, with probate activities.Solicitors Regulation Authorityaccessed 2026-10-08
  26. PrimaryWarning notice, Misuse of AI, published 17 August 2026, read in full: hallucinations and client confidentiality, paragraph 6.3 of both Codes. It does not address staff monitoring or call scoring.Solicitors Regulation Authorityaccessed 2026-10-08
  27. PrimaryILO Working Paper 170, AI Systems at Work: A Changing Psychosocial Work Environment (April 2026): the source of the sentence the Guardian attributes to the ILO. The paper's disclaimer says the views are the author's.International Labour Organizationaccessed 2026-10-08
  28. Reported byThe pointer and the only source for the system itself: "Dystopian: Co-op becomes latest firm to put staff under AI surveillance", published 10:00 BST and last modified 11:04 BST on 8 October 2026, read in full. Used for what is reported, the Co-op statements quoted in it, the several-hours text and the seven-hours caption. One outlet and one anonymous source.The Guardianaccessed 2026-10-08
  29. Reported byThe 28 September 2026 report on AI scoring of teachers at a training company, to which the Guardian links the Co-op report. Read for context only; the briefing is about the Co-op.The Guardianaccessed 2026-10-08
  30. Reported byCapture of the same notice on 4 May 2025, compared line by line with the current version: the call paragraph is essentially unchanged.Internet Archiveaccessed 2026-10-08

Share this briefing

Know someone who owns this problem? Send it to them.

LinkedInXWhatsAppEmail

Related briefings

The briefing, in your inbox

Practitioner analysis of cyber and AI security news. No vendor noise.

How often

Every new briefing in one email, at 7am, or at 7am, 12:30pm and 6pm. Nothing is sent when nothing is new. Unsubscribe any time.