Aipedia: Claims management companies

AI DSARs and data requests to lenders

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

CMCs can use AI to generate subject access requests and analyse what lenders send back, but the firm is responsible for the data and for the accuracy of the evidence it extracts. Errors weaken claims and invite data protection complaints.

Part of: AI in Claims management companies

In short

AI lets claims firms send DSARs in bulk and extract dates, figures and mis-selling indicators from returned documents. That creates risks of duplicate or unauthorised requests, misread evidence and vendor data handling problems. As controller of claim data, a CMC must handle it lawfully, accurately and securely, and the FCA market study covers how consumer data is acquired and used. A claim that misread evidence cost a consumer may fall within PI if held; data protection liability may sit in PI or cyber depending on the wording.

How CMCs use AI with DSARs and lender data

Many financial services claims start with a data subject access request (DSAR) to a lender or insurer on the consumer's behalf. AI now drives both ends of that process. CMCs generate DSARs in bulk from sign-up data, then use AI tools to read what comes back: statements, agreements, affordability records and call notes. The tools extract dates, figures and indicators of possible mis-selling, which then feed the complaint letter. The volume this allows is the attraction, and also the source of most of the problems.

Volume and quality concerns

Bulk DSARs place a heavy load on the firms receiving them, and requests generated without care can be duplicated, sent to the wrong organisation or made without clear authority from the consumer. On the way back, AI extraction can misread scanned documents, confuse accounts or miss relevant pages. The FCA's claims management market study covers the acquisition and use of consumer data by professional representatives and lead generators, and the Ombudsman has separately raised the quality of AI-assisted material from representatives. For the parallel issue in data protection practice, see AI-generated DSARs.

The duties that apply

Data protection as controller: when a CMC holds and analyses a consumer's data to run their claim, it is responsible for that data under UK GDPR. That means a lawful basis, keeping data accurate and secure, using it only for the purposes the consumer was told about, and not keeping it longer than needed. The ICO's AI guidance applies where AI tools process it.
Automated decisions: if extracted data drives a solely automated decision to reject a claim, Articles 22A to 22D of UK GDPR may apply (DUAA 2025 s.80).
Consumer Duty: acting in good faith and avoiding foreseeable harm, in PRIN 2A.2, includes not sending inaccurate evidence in the consumer's name.
Outsourced tools: the FCA's good-practice page says firms remain responsible for outsourced AI services. If a vendor processes the data, data protection contracts and security checks are needed too.

What can go wrong

Illustrative scenario. A CMC's AI tool extracts the wrong credit limit history from a lender's DSAR response because two accounts appear in the same file. The complaint letter relies on the wrong figures, the lender rejects it on the facts, and the case is referred to the Ombudsman, where the error undermines the firm's credibility. Meanwhile the extraction vendor has retained copies of the data in another country without the CMC's knowledge, and the consumer, unhappy with the outcome, complains about how their data was handled.

How PI usually responds

Where a consumer suffers a loss because evidence was misread and their claim was weakened, PI may respond if held, subject to the policy terms. Data protection claims sit in a grey area: some PI wordings cover civil liability for breach of confidentiality or data protection, others exclude it or push it to cyber cover. Regulatory fines are commonly not covered. Our pages on GDPR cover within PI and Data Protection Act civil claims explain how the policies usually split.

Practical controls

Get and record specific authority from the consumer for each DSAR.
De-duplicate requests before sending.
Sample-check AI extractions against the source documents, especially figures and dates.
Run due diligence on AI vendors: data location, retention, security and sub-processors.
Delete data you no longer need for the claim.
Pair this with AI document review controls and screening safeguards.

How Apex helps

Apex arranges PI for claims management companies, and a broker can explain where a data handling claim would sit between PI and cyber cover. See AI in claims management.

Sources

Frequently asked

Is a CMC a data controller for the data it gets back from lenders?

When it holds and uses a consumer's data to run their claim, a CMC will usually be responsible for that data under UK GDPR and must handle it lawfully, accurately and securely. Take advice on your specific arrangements, particularly where law firms or vendors are also involved.

Can AI be used to read DSAR responses?

Yes, but the firm is responsible for the accuracy of what it extracts and relies on. Check figures and dates against the documents, and make sure any AI vendor meets data protection requirements on location, retention and security.

Should a CMC tell consumers that AI reads their documents?

Yes, in substance. Privacy information should explain how the firm uses the consumer's data, and the FCA's good-practice page encourages telling consumers how AI is used and its limits. Clear disclosure also helps if a consumer later questions how their evidence was handled.

Does PI cover a data protection claim against a CMC?

It depends on the wording. Some PI policies cover civil liability for breach of data protection or confidentiality; others exclude it or leave it to a cyber policy. Fines from the regulator are usually outside cover.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.