FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Data protection consultants
Consultants assessing an AI supplier must establish what the vendor does with the client's data, where it goes and whether the contract meets Article 28. If a vendor the consultant approved later leaks or reuses data, the client may question the diligence.
Part of: AI in Data protection consultants
In short
Clients buying AI tools rely on their data protection consultant to check the vendor. The key questions are whether the vendor uses customer data to train or improve its models, where data is stored and accessed, which sub-processors are involved and whether the contract contains the Article 28 terms: processing only on documented instructions, confidentiality, security, sub-processor controls, help with rights requests, deletion or return and audit rights. If a vetted vendor later suffers a breach or reuses data, the client may claim the diligence was negligent. PI usually responds to such claims, subject to the wording and the scope agreed.
A client wants to roll out an AI note-taker, a document summariser or a customer service chatbot, and asks its consultant whether the supplier is safe to use. The consultant reviews the vendor's privacy documentation, security certifications, data processing agreement, sub-processor list and transfer mechanisms, and often a questionnaire. With AI suppliers there is an extra layer: whether prompts, uploaded files and outputs are retained, used to train models or reviewed by the vendor's staff, and whether the client can switch that off.
Regulators are asking the same questions. On 8 October 2026 the ICO reported that ten foundation model developers had made, or committed to make, changes including clearer transparency information and stronger ways for people to exercise their rights. Some business AI tools may be built on those models, so the upstream terms matter too.
Article 28(1) requires controllers to use only processors providing sufficient guarantees of appropriate technical and organisational measures. Article 28(3) requires a binding contract that sets out the processing and obliges the processor to:
Where a vendor uses customer data to train its own models, that use may fall outside the controller's documented instructions, and the vendor may be acting as a controller for that purpose. The analysis depends on the contract and the facts, and it should be in the advice.
Illustrative scenario: a consultant approves an AI transcription service for a healthcare client, relying on the vendor's standard data processing agreement. The consultant does not spot that the vendor's terms allow it to use de-identified recordings to improve its service, or that support staff outside the UK can access transcripts. Months later the vendor has a security incident affecting transcripts. The client faces complaints and an ICO enquiry, and asks why its consultant approved the supplier.
Not every vendor failure is the consultant's fault. A competent review can still be followed by a breach the consultant could not have foreseen. The issue in a claim is whether the review met the standard expected, given what the consultant was asked to do.
A claim that vendor due diligence was negligent is usually within a PI policy's civil liability cover, subject to its terms. Two points matter in practice. First, the scope of the engagement: a light-touch contract review is different from a full assessment, and the advice should say which it was. Second, contractual promises: warranties that a vendor is "compliant" can go beyond the duty of care, and some policies limit cover for liability assumed under contract. Claims by data subjects against processors are explained in Article 82 compensation and processors.
Apex arranges PI for data protection consultants. A broker can review how your policy treats vendor assessments and contractual warranties; see the data protection consultants' AI hub.
Article 28(3) requires terms covering processing only on documented instructions, staff confidentiality, security, sub-processor rules, help with rights requests and compliance, deletion or return of data at the end, and information and audit rights. AI-specific points such as model training should be addressed expressly.
It may be a processor for the service and a controller for its own training use, depending on the contract and what it actually does. The point should be analysed for each vendor rather than assumed.
Not automatically. A claim would need to show that your diligence fell below the standard of a reasonably competent consultant and that this caused the client's loss. Clear scope and dated records are the best defence.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
