FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Debt advice firms
Debt advice firms can use AI on client data, but files often hold financial and health information about vulnerable people. New UK GDPR rules also restrict solely automated decisions using special category data, and a leak or misuse can harm clients and the firm.
Part of: AI in Debt advice firms
In short
Debt files contain detailed financial data and often health and family information, which is special category data under UK GDPR. Since 5 February 2026, Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025, require safeguards for significant decisions taken solely by automated means, and Article 22B restricts using special category data for them. Sending data to AI suppliers, including offshore, needs proper contracts and transfer checks. A breach usually engages cyber cover first, while a negligence claim for bad advice sits with PI, depending on the wordings.
A typical debt advice file includes bank statements, income and benefits, every creditor, household details and, often, information about mental or physical health, disability or family crisis. The FCA notes in CONC 8.2.8G that most debt advice customers are vulnerable to some degree. This combination makes debt data among the most sensitive any professional firm holds.
AI increases the number of places that data goes: open-banking connectors, transcription services, letter drafting tools, chatbots and analytics. Each is a new processor, a new storage location and a new route for error or attack.
Automated decisions. Section 80 of the Data (Use and Access) Act 2025 inserted Articles 22A to 22D into UK GDPR, in force from 5 February 2026. Where a significant decision about a person is taken solely by automated means, the firm must provide safeguards: information about the decision, and the ability to make representations, obtain human intervention and contest it. Article 22B restricts such decisions where they are based on special category data, such as health information.
General UK GDPR duties. Lawful basis, transparency, data minimisation, security, processor contracts and international transfer rules all apply. The ICO's AI guidance covers fairness, accuracy and accountability in AI systems.
FCA expectations. The FCA's good-practice page says firms remain responsible for outsourced AI and should keep auditable records. Vulnerability policies under CONC 8.2.7R also shape how health information is gathered and used.
Illustrative scenario: an adviser pastes a client's case notes, including a mental health diagnosis, into a public generative AI chatbot to help draft a letter. The firm has no contract with the provider and does not know where the data is stored or whether it is used for training. The client later learns of this and complains to the firm and the ICO.
Other common failure points include:
Harm from a debt data incident can be acute. Exposure of a client's debts or health to a partner, employer or creditor can affect their safety and wellbeing, not just their privacy, and vulnerable clients may be targeted by fraudsters using leaked details. Claims for distress, as well as financial loss, are possible.
A data breach usually engages cyber insurance first, covering incident response, notification, restoration and some third-party liability, depending on the policy. PI wordings often exclude or limit data and cyber losses. A claim that a client received negligent advice because an AI tool processed their data wrongly may sit with PI, subject to the wording. ICO fines are commonly uninsurable or excluded. Make sure the two policies fit together without a gap; see cyber insurance and AI risks and GDPR fines and PI.
Apex arranges PI for debt advice firms, and a broker can check that a data incident involving an AI supplier would not fall between the two. See the AI in debt advice hub and does PI cover AI errors.
Possibly, with a lawful basis, a condition for special category data and appropriate safeguards. Since 5 February 2026, Article 22B restricts solely automated significant decisions based on special category data, so keep a person involved in decisions that affect the client.
A decision with no meaningful human involvement. If a person genuinely reviews the output and can change the outcome, it is not solely automated. A rubber-stamp check may not be enough, so record what the reviewer considered.
Only if the firm has approved the tool for client data, with a processor contract covering storage, training use and deletion. Many public tools are not suitable for special category data, so a firm policy and approved alternatives are the safer route.
Usually cyber responds first to a data breach, depending on the wording. PI often excludes or limits data losses but may respond to a negligence claim about advice. Check both policies together for gaps.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
