Outlook
How to read the customer data platform outlook from dated UK evidence and buyer scenarios
A guide to reading the customer data platform outlook through dated UK evidence, buyer scenarios and recheck triggers, without market forecasts.
The customer data platforms outlook for an England buyer is uncertain, but it is not unknowable. Current evidence points to changes in AI use, data law, regulator guidance and security practice. No England CDP market data exists. The evidence does not prove that a supplier can perform a particular task or predict what buyers will purchase in 2027.
Four labels apply. An observed fact is a dated record of something already measured or in force, and an announced change is a formal plan whose future status still needs checking. A buyer scenario is a possible operating condition, not a prediction, and a forecast is a sourced projection with its publisher, population, method and uncertainty intact.
No qualifying direct forecast of England CDP demand was found in sources reviewed on 6 September 2026.
What to take away
- The DUAA data protection provisions are in force, but ICO technology guidance remains under development.
- AI use in UK businesses is broader than CDP use and does not measure CDP adoption.
- Keep five evidence layers separate to avoid hiding uncertainty in automated summaries.
- Skills England AI foundation skills is a benchmark, not a forecast of CDP jobs.
Keep the buyer journey narrower than the label
The working journey is an England membership service receiving an authorised account record, deciding whether two records belong to the same person, applying a verified correction and suppression state, and exporting an approved audience to a named destination. That journey gives the outlook a real unit of analysis.
Five evidence layers kept separate
- Raw source events and provenance
- Identity decisions and confidence
- Rights, corrections, suppression, deletion
- Analytical or supplier outputs
- Destination action and record
A CRM record, warehouse or lake, identity-resolution process, consent or preference service, tag or other device storage or access technology, analytics service, activation tool, clean room and managed integration are different functions. A supplier may bundle several. The bundle name says nothing about collection authority, match accuracy, permission to contact someone, accessibility, security or exit.
The buyer should keep five evidence layers separate:
- raw source events and their provenance;
- identity decisions, confidence and disputed states;
- rights, corrections, objections, suppression and deletion;
- analytical or supplier-generated outputs;
- destination action and its later operational or financial record.
Collapsing those layers creates an apparently tidy profile while hiding uncertainty. That is particularly risky when an automated summary or segment becomes an input to a consequential decision.
Dated evidence from ONS, DUAA and ICO
UK business AI use is broader than CDP use
The Office for National Statistics published Artificial intelligence in UK businesses: 2023 to 2026 on 20 July 2026. It draws on the voluntary Business Insights and Conditions Survey and covers selected UK industries.
For example, the release reports that 9% of UK businesses had used at least one AI technology in 2023. The article says its headline AI measure groups several technologies, does not distinguish light user use from embedded production adoption, and remains a developing measurement area.
That is observed UK evidence about AI in businesses. It is not evidence of CDP adoption, an England buyer population or a 2027 purchase. A procurement team can use it to justify asking whether AI now appears in a proposed data workflow, but not to fill a market model.
The ONS UK business: activity, size and location dataset contains regional tables for VAT and PAYE based enterprises. It can describe a bounded business population. It cannot identify which organisations operate a CDP, need identity resolution or have an approved budget. Do not multiply those counts by an assumed adoption percentage.
The DUAA baseline has moved, while guidance work continues
The ICO's DUAA page for organisations was updated on 19 June 2026 to state that all the Act's data-protection provisions are in force. This is a current UK legal baseline, not a forecast.
At the same time, the ICO's technology guidance plan records work on automated decision-making, agentic AI and smart-data topics at different stages. Those entries are announced publication intentions. They are not final guidance and should be rechecked rather than quoted as settled future rules.
Since 29 April 2026, the ICO's storage and access technologies guidance has carried final status. It is relevant where a journey uses tags, pixels or similar technologies. It does not make later identity joining or activation lawful by itself.
Bounded uses of AI in the journey
AI is not one function. A buyer might consider generated data-dictionary notes, classification suggestions, duplicate triage, anomaly detection or a draft explanation for a human reviewer. Each is a buyer scenario until the exact system, input, output and controlled test are documented.
The ICO's AI and data protection risk toolkit says it is intended to help organisations reduce risks to people's rights and freedoms. The page also says the guidance is under review because of the DUAA. Use it as an evidence agenda, not a current legal conclusion.
For any proposed task, record:
- the authorised source fields and prohibited inputs;
- the model, prompt, rules and version;
- the expected output and uncertainty representation;
- the human who may accept, correct or reject it;
- the people affected and the route to challenge or correction;
- logs that support investigation without retaining unnecessary personal data;
- an accessible manual route and a tested rollback.
The NCSC's secure operation and maintenance guidance for AI systems calls for monitoring behaviour and inputs and treating changes to data, models or prompts as changes that can alter system behaviour. This supports versioned testing and rollback. It does not certify a supplier or prove output accuracy.
Three scenarios for a 2027 decision
Scenario A: controlled assistance remains narrow
Assumption: the buyer allows AI only to draft documentation or flag records for human review. The source system remains authoritative; production joining and activation rules stay deterministic and versioned.
Leading indicators include correction rates by reason, unsupported explanations, changed model versions and reviewer overrides. The data owner pauses the task if an output cannot be traced to its inputs or the accessible manual route fails.
Evidence that would disconfirm the scenario is an approved need for autonomous action or evidence that even the assisting task creates unacceptable error or rights risk.
Scenario B: identity automation expands
Assumption: a supplier or buyer proposes probabilistic matching or inferred attributes inside the membership journey. The affected unit is an identity decision, not a dashboard total.
Before release, test similar people who must remain separate, an evidenced duplicate, stale fields, a disputed attribute, correction, objection, suppression and deletion. Compare the machine route with the current manual control. If false joins, unexplained confidence or failed propagation breach buyer-set limits, the journey owner returns to the previous version.
Thresholds remain blank until qualified reviewers approve the test design.
Scenario C: destination and supplier dependencies change
Assumption: a destination changes its interface, a subprocessor changes, an export loses fields or a supplier alters an AI component. An announcement alone does not establish the effect on the configured journey.
The procurement owner tracks contract notices and the technical owner repeats the fictional fixture. The privacy owner reassesses roles and transfers where facts changed. The business continuity owner proves an isolated export and restore. A failed restore, incomplete suppression export or missing audit trail triggers containment rather than a hurried migration.
Skills follow tasks, not fashionable titles
Skills England's AI foundation skills for work, published on 28 January 2026 and marked as applying to England, is a benchmark for basic technical, non-technical, responsible and ethical use of simple AI tools. It does not forecast CDP jobs.
Capability requirements come from evidence: define event and identity states, inspect provenance, test corrections, review privacy and PECR questions, and control access. Design accessible administrative tasks, read contracts, reconcile destination outputs, and decide when to stop.
One person may perform several functions, but authority and independent challenge still need recording. Do not convert a general skills report into a headcount, salary or shortage claim.
A practical outlook register
Use a register that makes revision cheap. Each row should contain the label, source date, geography, affected function, confidence, leading indicator, decision consequence, owner and next check.
| Item | Evidence label | Affected function | Owner | Recheck trigger |
|---|---|---|---|---|
| DUAA data-protection provisions | Observed current legal status | Whole data journey | UK legal and privacy reviewers | Legislation or ICO guidance changes |
| ICO ADM guidance update | Announced guidance work | Profiling and significant decisions | Privacy reviewer | Final guidance is published |
| AI-assisted duplicate triage | Buyer scenario | Identity resolution | Data steward | Model, input or error pattern changes |
| Destination interface change | Buyer scenario until notified | Activation and export | Destination owner | Contract or technical notice arrives |
| England CDP market growth | Unresolved | Procurement context | Research owner | A direct comparable dataset appears |
Decision and publication gates
For 2027 planning, keep production activation off until the buyer can show authority for each source, explains identity decisions, carries correction and suppression through destinations, restricts and revokes access, and inspects logs. Perform accessible administrative tasks, restore an export, return to a known version.
Production activation gates
- Show authority for each source
- Explain identity decisions
- Carry correction and suppression through
- Restrict and revoke access
- Inspect logs
- Restore an export and known version
The Department for Science, Innovation and Technology's AI Cyber Security Code of Practice, published 31 January 2025, offers voluntary security principles and an implementation guide. It is guidance, not proof the gates passed.
The next buyer step: choose one decision in the membership journey, complete the outlook register and approve one reversible fictional-data test; if evidence cannot identify a safe, useful change, keeping the current process is valid.
Before you act
- Separate raw events, identity decisions, rights, outputs and destination actions.
- Check ICO guidance status before treating announced changes as settled rules.
- Document the exact AI task, inputs, outputs and human review route.
- Test identity decisions with similar people, duplicates and disputed attributes.
- Confirm supplier and destination dependencies with contract notices and fixtures.
- Verify that an accessible manual route and tested rollback exist.
Common questions
What evidence supports the CDP outlook for an England buyer?
The article says current evidence points to changes in AI use, data law, regulator guidance and security practice. None of it measures an England CDP market, proves supplier performance or predicts 2027 purchases.
How should a buyer treat the ICO technology guidance plan?
The plan records work on automated decision-making, agentic AI and smart-data topics at different stages. Those entries are announced publication intentions, not final guidance. The article says they should be rechecked rather than quoted as settled future rules.
What does the NCSC guidance require for AI systems?
The NCSC secure operation and maintenance guidance calls for monitoring behaviour and inputs and treating changes to data, models or prompts as changes that can alter system behaviour. This supports versioned testing and rollback. It does not certify a supplier or prove output accuracy, according to the article.
In this guide
- Scoping AI tasks inside a customer data platform before anyone approves oneScope CDP AI applications for one England data journey, with human authority, provenance, rights, security, accessibility and rollback controls.
- Customer data platforms market outlook: evidence limitsThis customer data platforms market outlook sets official UK figures on data handling and AI use against the missing market size, plus buyer scenarios.
- Five customer data platform failure scenarios to rehearse before they happenUse five observable CDP risk scenarios for an England data journey, with triggers, affected records, owners, fallbacks, recovery proof and review points.
