← All resources

Outsourcing B2B appointment setting: 10 clauses to check

Published October 13, 2026 · 8 min read · CyberNovaLabs.io

An appointment setting contract is decided on ten clauses, not on a day rate. France has banned consumer cold calling without prior consent since 11 August 2026 and Bloctel no longer exists; the EU AI Act transparency duties have applied since 2 August 2026. Here are the ten clauses, and the calling regime of all four countries.

The short answer

Outsourcing B2B appointment setting is decided on ten clauses, not on a day rate: the written definition of a qualified appointment, the nature of the undertaking, the pricing model, four data protection clauses, country-by-country compliance, the use of artificial intelligence, then duration and exit. Two of those ten changed in 2026. In France, commercial telephone canvassing has been prohibited without the consumer's prior consent since 11 August 2026, and the Bloctel service ceased to exist on that date^[2]. The transparency obligations of the EU artificial intelligence regulation have applied since 2 August 2026^[7]. A contract drafted in 2025 no longer describes the law in force.

B2B appointment setting: the calling rules differ across the four countries

The contract must name the countries in scope and the regime applied in each; otherwise the risk stays with the client.

None of this reduces to "it is allowed in B2B". A sole trader or a professional called on their personal line is precisely the grey area the contract must settle in writing, before the first campaign rather than after a complaint. For the data protection framework applied to prospecting, see our guide to B2B prospecting and the GDPR.

Clauses 1 to 3 — what you are actually buying

Clause 1 is the one that costs most when it is missing. "Appointment" is not a unit of measurement: an identified decision-maker, a stated need, an accepted slot and a date within thirty days do not describe the same thing as a call accepted by an intern. Write the criteria before launch, and name the person who arbitrates a disputed appointment. Our qualified appointment checklist is a starting point.

Clause 2 separates serious providers from the rest. Appointment setting is a best-efforts duty: the provider commits to the setup, the calling cadence, the file worked and the reporting, not to the number of signatures. A contract promising a volume of "guaranteed" appointments moves a commercial risk onto a clause that cannot carry it.

Clause 3 settles the pricing model. The two common models, pay per appointment and retainer, can only be compared on the cost of an appointment that is actually useful, never on the headline price.

An illustrative assumption, to be replaced with your own figures: a retainer of 2,000 € for one month with no unit price, twelve appointments billed of which nine were attended and compliant, gives 222 € per useful appointment; the same retainer with six compliant appointments gives 333 €. The choice of model is set out in our comparison of paying per appointment or on retainer. To work out how many appointments your funnel needs, see how many B2B meetings it takes to sign one client.

Clauses 4 to 7 — the data, and who answers for it

A provider calling your prospects processes personal data on your behalf. The European regulation only allows the use of a processor providing "sufficient guarantees to implement appropriate technical and organisational measures"^[1]. Four clauses follow, and they are not negotiable in the sense that they are written into the text.

Clause 4: the roles. The contract designates who is controller and who is processor. Until that is written down, each party assumes it is covered by the other.

Clause 5: the mandatory content. The processing agreement sets the subject matter, duration, nature and purposes of the processing, and provides that the processor processes the data "only on documented instructions from the controller", ensures the confidentiality of authorised staff, takes the required security measures, respects the conditions for engaging another processor, assists in responding to data subject requests, assists in ensuring compliance with security obligations, deletes or returns the data at the end of the services, and makes available "all information necessary" for audits^[1]. These are points (a) to (h) of article 28(3): read them one by one in the draft contract, not as a block.

Clause 6: sub-processing. The processor must obtain "prior specific or general written authorisation" before engaging another processor, and must give notice of any change^[1]. In practice, this is the clause that decides whether your file ends up in a call centre you did not choose.

Clause 7: the end and the incidents. At the end of the services, data is deleted or returned^[1]: say which of the two, in what format and within what deadline. In the event of a breach, the processor notifies the controller of "any breach" as soon as it becomes aware of it, and the controller notifies the authority "without undue delay and, where feasible, not later than 72 hours"^[1]. If your provider gives itself five working days to warn you, your 72 hours are gone before you know anything.

Clauses 8 and 9 — country compliance and AI in the loop

Clause 8. The contract lists, country by country, the regime applied, the lists checked before calling, the hours respected and the evidence retained. Two concrete points: in Belgium, deduplication against the "Do Not Call Me" list is an obligation^[3]; in France, proof of consent, where it is required, must be producible — the contract must say who holds it, you or the provider^[2].

Clause 9. If a voice agent or a generative assistant sits in the chain, transparency stops being a matter of courtesy. The transparency obligations of the EU artificial intelligence regulation have applied since 2 August 2026, and the principle retained is that the person should be made aware they are interacting with a machine^[7]. The contract must say whether an agent calls, what it announces, what is recorded, for how long and who answers for it. Call recording follows the same logic: purpose, retention period, information given to the person.

Clause 10 — duration, exit and reversibility

The last clause is the least read and the most binding. Belgian law is the most explicit of the four countries here: since 1 December 2020, the Code of Economic Law treats as unfair any clause creating "a manifest imbalance between the rights and obligations of the parties", sets out a blacklist of four clauses that are unfair in any event and a greylist of eight clauses presumed unfair unless proven otherwise, and declares any unfair clause "prohibited and void", the contract remaining binding if it can survive without it^[4]. Two greylist entries bear directly on an appointment setting contract: tacitly extending or renewing a fixed-term contract "without specifying a reasonable notice period for termination", and binding the parties "without specifying a reasonable notice period for termination"^[4].

Questions to ask before signing:

• What duration, what notice period, and is renewal tacit or express?
• Who owns the file being worked, and what do you get back on exit: contacts, call history, refusal reasons, in what format?
• Does exclusivity cover a sector, a territory, a named list, and for how long?
• Does a non-solicitation clause apply to prospects, to signed clients, or to both?
• What is the liability cap, and does it match a plausible loss?
• Who keeps the compliance evidence after the contract ends, and for how long?

If you prospect in several countries, add the question that is almost always missing: which of the provider's entities places the calls, from which country, and which authority supervises it — Autoriteit Persoonsgegevens in the Netherlands, the Data Protection Authority in Belgium, the CNIL in France, the CNPD in Luxembourg.

At CyberNovaLabs.io

CyberNovaLabs.io books B2B appointments in the Netherlands, Belgium, France and Luxembourg, in Dutch, French and English. Qualification criteria are written and agreed before the first call; the undertaking is a best-efforts duty, with no minimum term; billing is per appointment or on retainer, quoted on request. The setup is described on our B2B appointment setting page, and for Belgium on our appointment setting in Brussels page.

Send us your draft contract and we will answer clause by clause. Book a thirty-minute call.

Sources

1. CNIL — RGPD, chapitre 4 (article 28 « Sous-traitant », article 33 « Notification d'une violation »)
2. Service-public Entreprendre — Démarchage téléphonique : les nouvelles règles depuis le 11 août 2026 (loi n° 2025-594 du 30 juin 2025, art. 13 ; décret n° 2026-662 du 23 juillet 2026)
3. Do Not Call Me ASBL — liste « Ne m'Appelez Plus » (Belgique)
4. Code de droit économique belge, articles VI.91/3 à VI.91/6 — texte consolidé (Justel, SPF Justice)
5. ACM — Vanaf 1 juli strengere regels voor telemarketing: alleen nog maar als klant toestemming heeft gegeven
6. Guichet.lu — Pratiques commerciales réglementées et interdites (Luxembourg)
7. Commission européenne — Regulatory framework for AI : dates d'application et obligations de transparence
8. CNIL — RGPD, chapitre 3 (article 21 « Droit d'opposition »)

Read next