FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Insurance brokers
Brokers can use AI on client and claims data only if they meet UK GDPR, the new automated decision rules and FCA outsourcing duties. Broking files are full of personal and special category data, so a careless upload can become both a data breach and a regulatory issue.
Part of: AI in insurance brokers
In short
Broking data includes health information, criminal convictions, financial details and claims histories. Putting that data into a generative AI tool, or using it to automate underwriting or claims decisions, engages UK GDPR, the Data (Use and Access) Act 2025 changes in force from 5 February 2026, and FCA outsourcing rules under SYSC 8. The FCA's October 2026 page says firms remain responsible for outsourced AI. A data incident may fall under cyber insurance, a negligence claim under PI, and fines are often uninsurable, so the cover position needs checking.
Client data flows into AI tools in obvious and less obvious ways. Staff paste client emails into a chatbot to draft replies. Claims files are summarised by a generative model. Call recordings go to a transcription service. Underwriting and pricing engines process health, motoring convictions and claims history. Platform providers may use data to train or improve their models unless the contract says otherwise.
The 2024 Bank of England and FCA survey found about one third of AI use cases in financial services were third-party implementations, so much of this data leaves the broker's own systems.
Before client data goes into any AI tool, a broker should know where the data is stored and processed, whether it is used to train the provider's models, who can access it, how long it is kept, how it is deleted and what happens if the provider fails or changes its model. The CII Digital Ethics Companion advises testing data suppliers' compliance claims rather than accepting them. The FCA's October 2026 page lists relying on untested vendor assurances and having no exit options as poor practice.
Illustrative: an account handler pastes a client's medical history and claims correspondence into a free generative AI chatbot to draft a summary for an insurer. The tool's terms allow the provider to use inputs to improve its service. The client later learns of this through a subject access request and complains. The firm must assess whether a personal data breach occurred, consider reporting to the ICO and explain itself to the client.
A different issue arises if an automated claims or underwriting tool uses health data to make significant decisions without the safeguards the new UK GDPR provisions require.
Data incidents involving AI sit across two policies. Cyber insurance commonly responds to breach response costs, notification and some liabilities; see cyber insurance for insurance brokers. PI may respond where a client alleges a professional failing caused it loss, such as confidential information being mishandled in the course of broking, subject to any data or cyber exclusion. ICO fines are often uninsurable or excluded. See GDPR and data breach cover within PI for how the two interact.
See also AI call notes, AI pricing under delegated authority and the insurance broking AI hub.
Apex arranges PI and cyber insurance for insurance brokers, and can review how the two policies fit together for incidents involving AI tools and client data.
Yes, if they have a lawful basis, appropriate contracts and security, and suitable due diligence on the provider. Special category data such as health information needs extra care. Free consumer tools that use inputs for training are usually unsuitable for client data.
The Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A to 22D, fully in force from 5 February 2026. They set safeguards for solely automated significant decisions and restrict such decisions based on special category data.
It may be either or both. Cyber insurance commonly covers breach response and some liabilities, while PI may respond to a client's claim of professional failing. Exclusions in each policy decide where the boundary falls, so check both wordings together.
Yes. SYSC 8.1.6R keeps the firm responsible for outsourced functions, and the FCA's October 2026 page lists relying on untested vendor assurances and having no exit options as poor practice.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
