Powered by
MOMENTUM
MEDIA
Business process outsourcing (BPO) has been used by large companies for decades, built on a simple logic: move high‑volume, rules‑based work to specialist providers to reduce cost and shift operational risk. But does that logic hold up when agentic AI systems are capable of executing multi-step process flows, making decisions, and interacting with enterprise systems independently? writes Caitlin Whale.
Companies (and their advisers) are now assessing how to balance efficiency and risk for outsourced services: is it through outsourcing, internally managed agentic AI, or a hybrid model combining AI efficiencies with the traditional benefits of BPO?
In each case, the implementation challenge is significant. In my experience advising clients on outsourcing arrangements – from initial scoping through transition, BAU governance and exit – the hardest part is never the contract. It is the exercise of understanding the company’s requirements and documenting the process, how it is performed, who makes decisions and what a good outcome looks like. AI implementation requires similar discipline. There is also a cost dimension often missing from early business cases: ongoing governance, incident management, maintenance and retraining need to be factored into any comparison between AI-based and outsourced delivery.
The first path – bringing services back in-house to be performed by agentic AI – appeals to companies seeking greater control and reduced cyber security risks.
The practical benefit depends heavily on how the AI is designed. In-house deployment only delivers accountable and verifiable outputs if the AI’s decision making is transparent and auditable. Companies need to assess the impact of this on related processes and implement internal oversight for the AI.
It also means that the risk of errors shifts back to the company, which will be responsible for the outputs generated by AI. This differs from an outsourcing model, where the supplier is contractually liable for errors in the service.
The second path leverages existing continuous improvement commitments, which require suppliers to identify opportunities to improve service delivery and reduce costs. AI is an obvious candidate. Implementing AI within an existing outsourcing arrangement avoids the need to transition services or build internal AI capability from scratch. It keeps the provider accountable for delivery outcomes while shifting the implementation burden and cost to the provider.
However, introducing AI compounds one of outsourcing’s ongoing challenges: transparency in decision making. A customer will then need reporting obligations covering AI decision making as well as supplier performance. This is necessary to address legislative requirements to notify certain automated decision making to affected individuals, as well as to ensure accountability and explainability of the operation of the AI.
Incorporating AI also impacts liability, and suppliers may resist liability for errors if AI is introduced. Customers can resist those changes provided that the contract properly addresses the realities of AI-driven improvements. No AI solution is infallible, and the service should be scoped not just as delivery of technology but as a managed service with appropriate oversight and governance.
The third option acknowledges that technology is not always the answer. Services that are complex, require professional experience and judgement, or are highly variable continue to require a human solution. Embedded outsourcing and product-oriented delivery models allow organisations to augment their teams with specialised expertise or leverage a cross-functional pod of experts for specific projects. These models deliver outsourcing benefits for higher-value work that has historically had to be performed in-house and which, for now at least, remains best delivered by human beings.
In each of these scenarios, cyber security issues require attention. Remote worker fraud – where threat actors use stolen or synthetic identities to take jobs at outsourced service providers and access client systems – is an increasing risk of services that are performed remotely. An in-house AI agent operating within a company’s own environment can help secure sensitive information and systems. Bringing services in-house may address data sovereignty concerns. However, as many AI platforms depend on offshore hyperscaler infrastructure, companies still need to be cognisant of foreign law implications.
The future of outsourcing
None of this means that outsourcing is being displaced as a model. High-volume, rules-based processes – the traditional core of BPO – face the most direct disruption from AI. But there are categories of service where the human element remains important: complex or contextual judgement, relationship-sensitive work, and processes requiring clear accountability structures. Embedded outsourcing models, where provider staff work alongside the client’s own teams, and pod outsourcing, where specialists deliver product or project-specific services, are likely to grow as a result. They address the oversight and governance challenges that pure offshore delivery creates and accommodate hybrid AI and human workflow design.
All of these options raise legal questions that do not yet have settled answers. What does an appropriate SLA look like for AI-delivered processes? How should liability be allocated for AI errors? How should audit and explainability requirements be embedded? These are governance questions as much as technology questions, and there is no market standard for how they should be addressed. Technology lawyers need to engage with them when the commercial model is being set, and not just when contracts are negotiated.
Caitlin Whale is a partner with Baker McKenzie.
Want to see more stories from trusted news sources?
Make Lawyers Weekly a preferred news source on Google.
Click here to add Lawyers Weekly as a preferred news source.
