When to run packaging marketing vendor due diligence

What to take away

When a vendor check becomes necessary

Adding AI to design or personalisation

A supplier offering AI-generated pack artwork or personalised copy is handling brand assets and often customer data. Ask which model sits behind the feature and whether your own inputs train it. Check how long the supplier keeps any image or prompt you upload, and whether a subcontractor outside the UK can see it.

The BSI guidance on AI standards sets out governance ideas such as accountability and transparency that you can put straight into a brief. If the vendor cannot map the feature to any recognised framework, record that as a gap.

For information security, ask whether a supplier holds ISO/IEC 27001 certification and check that its scope covers the service you are buying. ISO/IEC 42001 is a named AI management-system standard; record the framework and version the supplier claims to use, and ask for evidence rather than treating a claim of alignment as certification.

Changing platform, agency or data flow

Moving platforms is the second common trigger, because artwork files, print specifications and audience data tend to travel together. Our guide to packaging marketing software selection in England explains how to compare systems before you commit, which sharpens the questions you put to a supplier.

A change of agency can matter just as much when the new team inherits your accounts and templates. Ask for the migration plan in writing, including who exports the files and who deletes the old copies. Where two suppliers overlap for a month, agree in writing who holds the master artwork file and who answers for print errors.

Treat a change in subcontractors, hosting locations or access to customer data as a fresh data-flow checkpoint, not merely a routine platform update.

What changes when the check is documented

Before: evidence scattered across threads

Evidence often sits in chat messages, old slide decks and a spreadsheet nobody owns. When a claim or a complaint surfaces, someone spends a day rebuilding the history from screenshots. Buyers then negotiate from memory rather than from a record.

After: one file per vendor

Build one folder per supplier. Keep the signed agreement, data processing terms, the standards the vendor claims to follow, and any campaign results you were shown.

Where personal data is involved, assess the supplier’s role and the data processing terms against the UK GDPR and the Data Protection Act 2018. Use the ICO’s guidance on contracts between controllers and processors; where relevant, check the ICO’s data protection fee register, bearing in mind that some organisations are exempt and a listing is not proof of compliance.

Name the person who maintains it and date the last update on the folder itself. Also note what the file does not cover, so any gap stays visible at the next review.

For UK companies, use the Companies House register to check the supplier’s legal identity and status, and review its filed accounts and confirmation statements. The ONS business statistics can add sector-level context, but they do not verify an individual supplier.

How to run the check without stalling the project

Give each item an owner and a date

Split the list into what you can verify yourself and what only the supplier can provide. Company records, contract terms, technical claims and past results each need a named owner. Two or three items per person is realistic. Log each deadline next to the launch date in the same tracker, not in a separate document.

The IPA report The Crisis in Creative Effectiveness covers advertising effectiveness and consumer insight. If a vendor claim sits on the critical path to a launch, put it in the project plan rather than a side note.

Test the relationship on a small brief

A first brief tells you more than a reference call. Watch how the vendor handles amendments, version control and a rejected proof. Ask for the working file and the exported artwork.

Budget a small print run or a single campaign, so a failure stays cheap. If you are still assembling a shortlist, our tools and supplier guide for 2027 covers selection and procurement in one place.

Common questions

How soon should the check start?

Before you brief creative work or sign anything containing a data clause. A short review at shortlist stage costs far less than a rescue job close to launch.

Do smaller suppliers need the same checks?

The depth changes, the categories do not. A sole trader still needs clear data terms, a complaints route and a named person you can call.

What if a vendor will not share evidence?

Treat silence as a finding. Note what you asked for, when, and what came back, then decide whether the remaining risk suits the project.

How often should the file be reviewed?

At renewal, and whenever the supplier adds a feature that touches your data. A dated note in the folder is usually enough.