FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Actuaries
Actuaries should put member, policyholder or health data only into approved AI tools, for a purpose that fits how the data was collected, with confidentiality protected by contract. Actuarial work runs on large volumes of personal data, so one careless upload can become a serious breach.
Part of: AI in Actuaries
In short
Pension member records, policyholder files and claims data are personal data, and health data used in mortality, underwriting or claims work is special category data. The Actuaries' Code says members should respect confidentiality, and the IFoA data science and AI guide stresses confidentiality, consent for the purpose data is used, and care with third-party generative AI tools. From 5 February 2026, UK GDPR Articles 22A to 22D set safeguards for solely automated significant decisions, which matters where actuarial models drive pricing, underwriting or benefit decisions. A breach can lead to client claims, regulatory scrutiny and IFoA complaints; how it is insured depends on PI and cyber wordings.
Actuaries handle some of the most sensitive data any profession sees: dates of birth, salaries and family details for whole pension schemes; policyholder histories; and medical information used in underwriting, claims and mortality models. AI tools make it easy to move that data somewhere it should not go. A spreadsheet pasted into a generative AI chatbot to help write a formula, a data extract uploaded to a coding assistant, or a vendor platform that sends data to a sub-processor abroad can each take personal data outside the controls the client agreed to.
Depending on the work, an actuary or consultancy may act as a processor for trustees or insurers, or as a controller in its own right, for example in some scheme actuary roles. The role matters for who has to do what, and the engagement terms should say which applies.
Illustrative scenario: a junior analyst at a consultancy wants help writing a data-cleansing script. They paste a few hundred rows of a pension scheme's member data, including names and dates of birth, into a free generative AI chatbot to show it the structure. The tool's terms allow it to retain inputs. The trustees' data processing agreement prohibits transfers to unapproved sub-processors. The consultancy has to tell the trustees, who must consider their own reporting obligations, and the trustees question whether the firm's controls can be trusted with the next valuation.
Other scenarios: health data used in a model for a purpose the data subjects were not told about, a vendor AI platform that hosts data outside agreed locations, and an automated decision on an underwriting or benefit case without the required safeguards. See AI for pension scheme data and AI experience and claims analytics.
A client claim for breach of confidentiality or data protection duties may fall within actuarial PI, depending on the wording; PI policies may include civil liability for breach of confidence, but some exclude or limit data-related loss, especially where caused by a cyber event. Costs of responding to the breach itself, such as investigation and notification, are more commonly covered by cyber insurance. Regulatory fines are generally not insurable. See GDPR and data breach cover within PI, data breach liability for professional firms and combining cyber and PI.
Apex arranges PI for actuarial firms; a broker can check how your PI treats confidentiality claims and where cyber cover may fill the gap. See the AI in actuarial work overview.
Only into a tool the firm has approved, under terms that protect confidentiality and fit the data processing agreement with the client. The IFoA guide says care should be taken with third-party generative AI tools because of privacy risks. Public chatbots are usually unsuitable for personal data.
From 5 February 2026, UK GDPR Articles 22A to 22D, inserted by the Data (Use and Access) Act 2025, set safeguards for solely automated decisions with significant effects. Where actuarial models drive automated pricing, underwriting or benefit decisions, clients will need those safeguards in place.
It depends on the wording. Client claims for breach of confidence may fall within PI, but some policies exclude or limit data-related loss, and breach response costs are usually a cyber insurance matter. Fines are generally not insurable. A broker can review both policies together.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
