FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: IT consultants and developers
From 5 February 2026, developers building automated decision systems must design in the UK GDPR Article 22C safeguards: information, representations, human intervention and a way to contest. If a client is later found non-compliant, it may say the system you built made compliance impossible.
Part of: AI in IT consultants and developers
In short
Section 80 of the Data (Use and Access) Act 2025, in force from 5 February 2026, inserted new Articles 22A to 22D into the UK GDPR on automated decision-making. Where significant decisions about people are made by automated means, Article 22C requires safeguards: giving individuals information about the decision, letting them make representations, enabling human intervention and allowing them to contest it. The client is usually the controller and carries the legal duty, but developers who build credit, HR or eligibility engines without these features may face claims. Technology PI usually responds to negligent design, subject to the wording.
IT consultancies build systems that decide or heavily shape outcomes for people: credit and affordability checks, CV screening and shift allocation, tenant referencing, insurance eligibility, benefit or grant triage, and fraud flags that block accounts. Increasingly these include machine learning models or large language models alongside rules. The developer designs the data flows, scoring logic and user interface; the client decides how decisions are used and communicates them to individuals.
Section 80 of the Data (Use and Access) Act 2025 inserted Articles 22A to 22D into the UK GDPR, and the commencement regulations brought them into force on 5 February 2026. Article 22C sets out the safeguards that must accompany significant decisions based solely on automated processing. In practical design terms, the system must support four things:
The ICO's AI guidance hub includes guidance on explaining decisions made with AI, and the ICO has said a statutory code of practice on AI and automated decision-making is forthcoming. BCS members should also note clauses 1.3 (no discrimination on protected characteristics) and 2.4 (know and comply with relevant legislation).
Illustrative scenario: a software house builds an online loan eligibility engine for a lender. Applicants are declined automatically and see only a generic message. There is no route to ask for a human review, and decision reasons are not logged, so staff cannot explain any individual outcome. After complaints, the lender is told its process does not meet the Article 22C safeguards. It has to rebuild the workflow, review past decisions and handle complaints, and it claims the costs from the developer, arguing the specification asked for a "compliant" system.
Bias is a parallel risk. A model trained on historic data can reproduce unfair patterns, raising discrimination concerns as well as data protection ones. See AI bias and discrimination claims.
The client is usually the controller and owes the Article 22C duties to individuals. The developer's exposure is mainly contractual and in negligence: did you build what was agreed, with the skill and care of a competent developer who knows the law applies? If the contract promised compliance, or the client relied on your expertise to design a lawful process, your exposure is wider. If the client specified the design and declined safeguards you recommended, record that.
Technology PI commonly covers claims alleging negligent design or advice, including the client's costs of remediation, subject to the policy terms. Regulatory fines imposed on the client, and any you face directly, raise separate insurability questions and are often excluded or uninsurable. Warranties of legal compliance may fall outside cover where they go beyond what a competent developer would owe anyway. See ICO fines and PI.
Apex arranges PI for developers who build decision systems. A broker reviews your cover and how your policy treats compliance-related claims. See also LLM integrations and data leaks, advising on AI tools and the IT consultants AI hub.
Section 80 of the Data (Use and Access) Act 2025 inserted Articles 22A to 22D into the UK GDPR. They came into force on 5 February 2026 under the commencement regulations, SI 2026/82.
In design terms, the system must support giving individuals information about significant automated decisions, letting them make representations, enabling human intervention and allowing them to contest the decision. Developers should build these into the workflow and data model from the start.
The client is usually the controller and owes the legal duties. The developer can still face a contract or negligence claim if the system was built in a way that prevents compliance, or if the contract promised compliance.
A client claim alleging negligent design is commonly within technology PI, subject to the wording. Fines and penalties are often excluded or uninsurable, and broad warranties of legal compliance may fall outside cover. Check your wording and contract terms together.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
