Not in a public AI tool. A declaration carries commercial values, consignee details, tariff codes and contract terms that a competitor would pay for, and pasting it into a consumer service puts it outside your control. Run the model on hardware you own instead, so the paperwork stays on your network.
Is it safe to put customs declarations into AI tools?
Not if the tool is a public AI chatbot. A declaration is a commercial document before it is a compliance document, and pasting one into a consumer service moves your client's trade terms onto infrastructure you do not run and cannot inspect.
The question is less about AI than it looks. Strip the word "AI" out and you are asking whether it is acceptable to send a customer's invoice values, supplier identity and contract terms to a third party you have not assessed, without telling them. Put that way, most forwarders already know the answer. The reason it keeps happening is that a chat box does not feel like a data transfer. It feels like a notepad. It is not a notepad.
There is a version of this that keeps the exposure inside your own control, and it is the version where the model runs inside your own network on hardware you own. Same capability, different location. The document never leaves the building, so there is nothing to disclose, nothing to renegotiate with your insurer, and nothing to explain to a client who reads your contract carefully.
What commercially sensitive data sits inside a declaration?
Nearly everything a competitor would want. A single import declaration can carry the invoice value, the currency, the incoterm, the commodity code, the net and gross mass, the country of origin, any preference claim, the supplier, the consignee, freight and insurance costs, and the procedure codes that tell an informed reader exactly which relief or regime you are using. HMRC sets out what a full import declaration requires in its guidance on making a full import declaration, and the field list alone is instructive reading for anyone who treats this paperwork as administrative noise.
Take six months of those for one importer and you can reconstruct their landed unit cost, their supplier concentration, their seasonal volumes and a fair estimate of their margin. You can undercut them on a tender without ever seeing their price list. The same is true of a bill of lading set, and of the terminal and haulage paperwork around it: shipper, consignee, notify party, container counts, ports, dates. Individually dull. In aggregate it is a customer list with volumes attached.
This is why customs data confidentiality is not a data protection footnote. Most of the exposure here is commercial, and commercial exposure does not have a regulator who fines you. It has a client who leaves.
What happens to a document pasted into a public AI tool?
It is transmitted to the provider, processed on their systems, and what follows depends entirely on which account you are using. Consumer tiers and business tiers of the same product behave differently on retention, on whether content can be used to improve the service, and on which staff can review material for safety or abuse purposes. The person pasting the declaration almost never knows which tier they are on.
Two consequences matter more than the retention terms themselves.
The first is contractual. As a forwarder you hold your client's paperwork under a duty of confidence, usually reinforced by an explicit confidentiality clause. Handing it to a processor your client has never approved breaches that duty whether or not the provider ever looks at it, and whether or not UK GDPR is engaged. You do not get to decide unilaterally who sees your customer's terms.
The second is evidential. If a client asks in eighteen months which of their documents were processed, by whom, and what the system did with them, browser history is not an answer. On your side there is no record at all.
Does a UK data region solve the problem?
It answers a geography question, not a control question. A UK region tells you which building the disk sits in. It does not tell you who can read the data, what is retained and for how long, whether support engineers can reach it during an incident, whether it is replicated elsewhere for resilience, or whether you can prove any of those answers to a client or an auditor.
Location and control get conflated constantly in procurement. The useful test is not "where is it" but "who could read this if they chose to, and would I know". On a hosted service the honest answer is that the operator could, under some circumstances, and no, you would not know. On a machine you own, in a rack you control, both halves of that answer change.
The ICO's guidance on AI and data protection is worth reading for the accountability point rather than the technology: the organisation deploying the system is the one that has to account for it. Outsourcing the processing does not outsource that.
How do private knowledge bases handle declarations and bills of lading?
By retrieving from them rather than being trained on them, which is the distinction most buyers are never offered. A retrieval system indexes your documents locally, finds the relevant passages when someone asks a question, and passes those passages to the model as context alongside the question. The model's weights are unchanged. Nothing is absorbed or memorised, and there is nothing to unlearn when a client offboards: you delete their index.
That matters practically. A query such as "which consignments from this supplier claimed preferential origin" can be answered against your own files, with the answer pointing at the specific documents it came from, so the person reading it checks the source rather than trusting a summary. Retrieval that cites its sources is auditable. A model that has swallowed your archive is not.
On document ingestion I will be precise, because this is where suppliers overclaim. A local OCR runtime has read scanned PDFs in our controlled tests. Extraction and ingestion integration into the Mickai Sovereign Intelligence Operating System (SIOS) is still being completed. If your declarations and bills of lading arrive as scans and phone photographs, which in this trade many of them do, ask any supplier including us to demonstrate ingestion on your own documents on your own hardware before you sign anything. A demonstration on clean synthetic paperwork tells you nothing about a smudged fax of a packing list.
What should a freight forwarder ask an AI supplier?
Ask seven questions, and hold out for specific answers rather than reassuring ones: where inference runs, what leaves the network, what is retained, who can read your content, whether it works offline, whether you can verify its records yourself, and what happens at termination.
Where does inference actually run, on which machine, in which building. What leaves our network, named item by item, including telemetry and licence checks. What is retained, where, and for how long. Can your support staff read our content, and is that access logged somewhere we can see. Does the system keep working if we pull the internet cable for a week. Can we export a record of what the system did and verify it ourselves, using tools that are not yours. And at the end of the contract, what happens to the indexes, the models and the logs.
If a supplier cannot answer the offline question, the system is not private, whatever the brochure says. If they cannot answer the verification question, you are being asked to take their word for it, which is the habit you were trying to break.
How do you prove what the AI did with a declaration?
With a signed record you can check without the vendor's help. Every consequential action in SIOS is sealed in the Open Audit Record under ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024. An auditor exports the record, verifies the signatures offline with a public key, and does it using tools that are not ours.
The honest word for this is tamper-evident, not tamper-proof. Nothing stops someone with sufficient access from altering a stored record. What the signature does is make the alteration fail verification, so the attempt surfaces instead of passing quietly. That is a weaker claim than the usual marketing and a more useful one, because it is the claim that survives an auditor testing it.
Alongside the record sits the approval gate. Consequential actions wait for a named person to approve them, so a classification change or a submitted declaration carries a human name, a timestamp and the documents that informed the decision. The declarant remains responsible for accuracy, which is where customs law puts responsibility anyway. The record simply lets you show your working.
For the record on who is saying this: Mickai LTD is a UK company, Companies House 17166618, holding 104 filed UK patent applications carrying 2,340 claims. SIOS runs on hardware the customer owns, is offline capable, and ships with 63 studios in total, 14 production-ready at launch and 49 in development, drawing on 50 specialised models. The closed beta is open and one regulated company is onboarding as a design partner. The partner and its sector stay unnamed, which is rather the point.
None of this is an argument against the companies building the compute and the cloud layer. They are building genuinely useful infrastructure, and for non-regulated workloads renting it remains the sensible choice. The argument is with the assumption underneath it: that a regulated business must rent its intelligence, ship its clients' documents offsite, and take a vendor's word for what happened to them afterwards. For customs paperwork, that assumption does not hold.
Frequently asked questions
Can we use AI to check tariff classifications?
Yes, as a second opinion rather than the decision. Classification is a legal judgement and the declarant carries it. A useful system suggests candidate commodity codes, shows the wording it relied on and names its source document, then waits for a qualified person to approve. Treat an unreviewed automated code as an unfiled draft, not an answer.
Does HMRC approve AI tools for preparing customs declarations?
There is no HMRC approval or certification scheme for AI features in declaration software. HMRC publishes information about software that works with the Customs Declaration Service, which is a question of technical compatibility rather than endorsement of anything a tool does with AI. Legal responsibility for the accuracy of a declaration stays with the declarant.
Is customs data personal data under UK GDPR?
Partly. Most fields are commercial, but contact names, driver details, signatures and identifiers tied to a sole trader are personal data, so UK GDPR applies alongside your duty of confidence to the client. Treat both as live. The ICO's guidance on AI and data protection covers the accountability expectations when a system processes that material.
Can we use AI on scanned paper shipping documents without a cloud service?
Local OCR runtimes work offline, and in our own controlled tests a local OCR runtime has read scanned PDFs. Our extraction and ingestion integration into SIOS is still being completed, so do not take a slide deck as evidence. Ask any supplier, including us, to run it on your own scans on your own hardware.
What should be in a customs AI supplier contract?
Name where inference runs. List every item that leaves your network, telemetry and licence checks included. Set retention and deletion terms, name sub-processors, state whether support needs remote access and how it is logged, require audit records you can export and verify without the supplier's tools, and say what happens to indexes and models at termination.
Related briefings
Procurement and defence
- Buy AI Through G-Cloud and Government Frameworks: Guide
- AI Disclosure in Public Sector Tenders: What's Required?
- AI Bid Evaluation in Public Procurement: Is It Lawful?
- AI for Procurement Contract Review: Is It Allowed?
- AI Supplier Contract Clauses: A UK Buyer's Checklist
UK AI regulation
- Is There a UK AI Act? How the UK Regulates AI Today
- AI Cyber Security Code of Practice: Who It Applies To
Part of a series of 60 briefings on deploying and governing AI in UK regulated organisations, archived with a DOI at 10.5281/zenodo.22975756.
Evaluating AI for a regulated organisation? Mickai runs on hardware you own, offline. Consequential actions wait for a named person to approve them, and what the AI did is sealed into a signed record an auditor can check without us. Applications for the invitation-only closed beta are open. Apply for the closed beta.
Written by Micky Irons, founder and chief executive of Mickai LTD.
Top comments (0)