How should a GEO buyer control supplier conflicts and information barriers?

Treat conflicts and information access as operating controls

A GEO supplier may see strategy, analytics, unpublished content, product plans, customer questions, technical findings and approved organisation facts. A buyer should not rely on a general promise of confidentiality or assume that every same-market engagement is automatically unacceptable. It should identify the real interests and information flows, decide what is material, and test the controls that make the proposed engagement safe and fair.

GOV.UK's current Procurement Act guidance distinguishes actual, potential and perceived conflicts and requires covered public procurements to identify, review and mitigate them. The Supplier Code of Conduct also expects suppliers to protect sensitive information and mitigate real, potential and perceived conflicts. These public-sector duties do not automatically apply to every private purchase, but they provide a useful evidence standard for a proportionate GEO supplier review.

Create one six-part conflicts and information-barrier record

Complete the record before sensitive access is granted and keep it current through delivery. For every row, name the supplier owner, buyer decision owner, evidence location, status, review date and next trigger. Record a specific fact or uncertainty rather than a blanket declaration that no conflict exists.

Ask for evidence before granting access

Give the supplier a bounded description of the proposed scope, markets, information and systems, then ask it to identify relevant interests and overlaps. Evidence might include a conflict register template, team allocation, access design, subcontractor list, confidentiality commitments, tool and data-use register, change process and a redacted example of a completed review. Confidentiality may limit names, but it should not prevent a useful description of the risk and control.

Classify each item as actual, potential, perceived, not identified or not yet verifiable. The Procurement Act guidance requires conflicts to be kept under review; a one-time declaration is therefore a weak operating model. Define triggers such as a new client, changed ownership, staff transfer, new AI tool, expanded data access, new sub-processor or change in the buyer's market.

• Separate the people who disclose a conflict from the buyer role that decides its materiality and mitigation.
• Use the same evidence request and decision criteria for comparable bidders.
• Record perceived conflicts as well as proven ones; the appropriate response may be explanation and transparency rather than exclusion.
• Set an expiry or review date for every exception and mitigation.

Test the information barrier, not its label

An 'ethical wall' or 'separate team' is only a label until the supplier shows how identities, repositories, permissions, devices, exports, collaboration channels and reusable material are controlled. Use least access for the agreed purpose, separate restricted work where proportionate, prevent unapproved reuse, and keep an appropriate audit trail. Include temporary staff, subcontractors and automated tools in the map rather than testing employees alone.

Where the engagement involves personal data, the buyer should determine its controller-processor position and obtain specialist advice. ICO guidance says a controller-processor contract must cover documented instructions, confidentiality, appropriate security, subprocessors, end-of-contract handling, and audits and inspections. Its security guidance also emphasises managing, limiting and controlling access, appropriate authentication and authorisation, and an audit trail.

• Select one restricted information set and verify that only the named roles can open, export, change or share it.
• Check whether prompts, uploaded files and outputs may be retained, reused or used to train an AI or other tool.
• Test one joiner, role change and leaver so that access follows current responsibility rather than historic convenience.
• Ask the supplier to demonstrate the alert, decision and remediation path for an attempted or accidental cross-client disclosure.

Make a proportionate, reviewable decision

Do not convert every market overlap into an unlimited non-compete condition. Define the decision or information at risk, assess likelihood and consequence, and choose the narrowest control that produces acceptable evidence. Options may include a different reviewer, a separate delivery team, restricted repositories, removal of a data field, buyer-controlled access, delayed work, an independent check, or declining the conflicting activity.

Record who approved the decision, what evidence was considered, which controls must remain true and what event forces another review. If the supplier cannot provide a sufficient safeguard, the record should make the unresolved risk visible and connect it to pause, remediation, reassignment or exit. A signed declaration without an operating test should not be treated as complete evidence.

Ask SALIENS for a controlled GEO engagement

SALIENS provides GEO audits, AI visibility monitoring, content and technical improvements, and ongoing GEO delivery. A scoped engagement can include a conflicts register, information and access map, named responsibilities, English and Simplified Chinese review, tool and data-use boundaries, source-linked evidence, change triggers and buyer acceptance checks.

Email info@oxfordintelligence.co.uk with your website, markets and languages, proposed scope, sensitive information and systems, relevant market overlaps, internal decision owners and procurement timetable. SALIENS is operated by Oxford Intelligence Limited. These controls support accountable delivery but do not guarantee crawling, indexation, AI mentions, citations, rankings, traffic or enquiries. This guide is a procurement framework, not legal, data-protection, employment or commercial advice.