Evidence human review on bulk and API routes, or add it where missing

Confirm that dismissals, acceptances and rejections are recorded with user and time

Create a retention map for AI inputs, outputs and logs; confirm hosting location; limit debug logging

Add a release rule: update EV-01 and EV-12 before any change to an AI feature goes live

Affects: All answers citing EV-01 or EV-12

Confirm the exact data fields sent to Vendor B

Approve and roll out the AI acceptable-use policy with short staff training

Add AI-specific scenarios to the incident response procedure

Seek contractual notice of model, rules, terms or hosting changes from both AI providers

Define accuracy monitoring for tax-code suggestions and document extraction

Obtain a specialist assessment of EU AI Act classification and PendlePay's role for each feature

Make AI vendor review a standard step before engaging new AI providers

Document the release-testing process for AI features