Aipedia: Insolvency practitioners

Debtor and creditor data in AI tools

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Insolvency practitioners can use AI on case data only in ways that respect the Code's confidentiality duties and UK GDPR, which in practice means approved enterprise tools, not personal accounts. Data incidents usually engage cyber cover first and PI second.

Part of: AI in Insolvency practitioners

In short

Data security and confidentiality is the top barrier to AI adoption among insolvency professionals, cited by 54% in R3's 2026 survey. The Insolvency Code of Ethics confidentiality duties (R104.3 to R104.6, R316.1) apply to anything put into an AI tool, and UK GDPR adds protections for special category data and solely automated decisions. R3 warns consumer tools may reuse data and personal accounts create compliance risk. Incident costs usually fall to cyber cover, while third-party claims may sit with PI, cyber or both.

Why data is the top concern

Insolvency case files hold some of the most sensitive data any profession handles: company accounts and contracts, director and employee personal data, bank statements, and for individuals, details of income, debts, family circumstances and health. R3's August 2026 report found data security and confidentiality was the top barrier to AI adoption, cited by 54% of respondents.

The same report found generative AI is "mostly used individually and informally". That combination, sensitive data and informal use, is where most confidentiality incidents start.

The duties that apply

The Insolvency Code of Ethics sets the professional duty:

R104.3 and R104.4: prohibited uses and disclosures of confidential information.
R104.6: a continuing duty of confidentiality.
R316.1: a further confidentiality requirement in Part 3 of the Code.
R321.1, 115.1 A6 and 116.2 A3: decide whether a tool is appropriate, with oversight and staff training reducing the threat.
R103.2: staff must be trained and supervised, which includes how they use AI.

Data protection law applies alongside. UK GDPR requires a lawful basis, transparency and appropriate security, and gives special protection to special category data such as health information. Where any significant decision about an individual is made solely by automated means, Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 from 5 February 2026, require safeguards; see IVA onboarding. The IPA also lists guidance on GDPR (2018) and data and information security on its regulation guidance page, though its titles and file links appear mismatched, so check the document you open.

Consumer versus enterprise tools

R3 found that consumer AI tools may expose or reuse client data, and that enterprise tools licensed under a business agreement are the most cited alternative. It also flagged unauthorised personal AI accounts as a compliance risk.

Consumer tools may retain prompts, use them for training or store them outside the firm's control. Pasting a debtor's statement of affairs into one is a likely breach of confidentiality.
Enterprise tools typically offer contractual protections on retention and training, but still need configuring, access controls and a data protection impact assessment where appropriate.
Personal accounts used for work bypass all of this and leave no firm record.

Illustrative scenario: a case administrator uses a personal AI account to summarise a bankrupt's medical evidence for a hardship decision. The account's history is later exposed in an unrelated breach of the provider. The firm cannot say what was uploaded, the individual complains to the ICO and the RPB, and the firm faces notification costs and a claim for distress.

Cyber versus PI cover

A data incident usually involves two kinds of cost. First-party costs, such as forensic investigation, legal advice on notification, informing affected people and restoring systems, usually fall under cyber insurance. Third-party claims, for breach of confidence or data protection compensation, may fall under PI, cyber or both, depending on the wordings. Fines and penalties are commonly uninsurable or excluded. See cyber insurance and AI risks, data breach cover within PI and GDPR fines and PI.

Some PI wordings contain cyber or data exclusions, and R3 found practitioners already unsure how PI treats AI. Checking how the two policies fit together avoids a gap.

Practical controls

Publish an approved tools list and prohibit personal AI accounts for case data.
Use enterprise agreements that restrict retention and training, and record the settings.
Minimise data: redact names and identifiers where the task allows.
Treat health and vulnerability information as off-limits for general AI tools.
Carry out a data protection impact assessment for new AI processes.
Apply the same rules to document review providers and creditor chatbots.

How Apex helps

Apex arranges PI for insolvency practitioners, and a broker can review how PI and cyber cover respond to an AI-related data incident. See the PI guide for IPs and the insolvency practitioners hub.

Sources

Frequently asked

Can I put debtor or creditor data into a generative AI chatbot?

Only into a tool the firm has approved, with contractual controls on retention and reuse, and only as much data as the task needs. Consumer tools and personal accounts risk breaching the confidentiality duties at R104.3 and R104.4 and UK GDPR.

Is an enterprise AI tool automatically safe for case data?

No. Enterprise agreements typically improve protections, but the firm still needs to configure access, decide what data is appropriate, assess data protection risks and train staff. The IP remains responsible for confidentiality.

Does PI or cyber insurance cover an AI data leak?

Usually cyber cover deals with incident response and notification costs, while third-party claims may fall under PI, cyber or both depending on the wordings. Some PI policies exclude cyber or data events, so check how yours fit together.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.