Aipedia: Management consultants

Designing AI process automation for clients

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Consultants who design AI process automation for clients share responsibility for whether it works and whether it complies with the law. Since 5 February 2026, automated decisions about people are governed by new UK GDPR Articles 22A to 22D.

Part of: AI in Management consultants

In short

Some consultancies now recommend or design AI automation for clients: triaging applications, routing customer queries, approving low-value claims or screening candidates. If a design produces wrong outcomes or significant decisions about individuals without proper safeguards, the client may face losses, complaints and regulatory action, and look to the consultant. Section 80 of the Data (Use and Access) Act 2025 replaced the automated decision-making rules with Articles 22A to 22D from 5 February 2026. ICMCI 3.1 requires human oversight for high-risk uses. PI usually responds to negligent design advice, subject to the wording, but fines and contractual promises are treated differently.

How consultants design AI automation

Operations and transformation consultants increasingly recommend AI as part of process redesign. Typical projects include automated triage of customer emails, document classification in back offices, eligibility checks on applications, fraud flags, scheduling and screening of job applicants. The consultant may map the current process, select a tool, design decision rules and thresholds, write the business case and oversee testing.

The boundary between consulting and technology delivery can blur. A consultant who configures decision logic is closer to a systems designer, and the client may expect the outcome to work, not just the advice to be reasonable.

The duties and rules that apply

Articles 22A to 22D UK GDPR: section 80 of the Data (Use and Access) Act 2025 replaced the old Article 22 regime from 5 February 2026 under SI 2026/82. Under Article 22C, a significant decision based solely on automated processing requires safeguards: information, the right to make representations, human intervention and the right to contest.
ICMCI 3.1: high-risk uses need a qualified person who can override or stop the system.
ICMCI 7.2: uses involving personal data, profiling or automated decisions generally need explicit client agreement.
Common law: reasonable skill and care in design advice, and any fitness for purpose terms the contract adds.

The client is usually the controller, but a consultant who processes personal data during design or testing may be a processor or controller too. The ICO's statutory code on AI and automated decision-making is forthcoming, with no date set.

What can go wrong

Illustrative: a consultant redesigns a lender's affordability checks so that applications below a score threshold are declined automatically. The design has no route for applicants to make representations or obtain human review. Complaints rise, the client has to rework the process and review past decisions, and it argues the consultant's design failed to build in the safeguards the law required.

Other failures are operational: an automated routing rule sends urgent cases to the wrong queue, or a classifier trained on old data performs badly once live. The client's loss may include re-work, compensation to customers and lost revenue. If regulators become involved, fines or enforcement fall on the client, which may then try to pass them on.

How PI usually responds

A claim that the consultant negligently designed a process or failed to advise on legal safeguards is usually within consultants' PI, subject to the terms. Points to check:

Fines and penalties are often uninsurable or excluded; a client's attempt to recover its own fine from you raises difficult questions of law and wording.
Fitness for purpose or performance warranties in the contract go beyond reasonable care and may be excluded as contractual liability.
If you also supply or build software, check whether the policy treats this as a professional service or needs technology cover.
Any AI exclusion or condition. See AI exclusions and clauses.

A data breach during testing may sit with cyber cover.

Practical controls

Ask early whether the process makes significant decisions about individuals and whether they are solely automated.
Design in the Article 22C safeguards and a human override for high-risk uses.
Advise the client in writing that it remains the controller and must take its own legal advice.
Test on representative data and record accuracy and error rates before go-live.
Avoid accepting fitness for purpose or outcome warranties.
Agree scope boundaries between advice, design and build.

How Apex helps

Apex arranges PI for management consultants and can check whether your policy treats automation design as a professional service or needs technology cover. See the AI in management consulting overview.

Sources

Frequently asked

What changed on 5 February 2026?

Section 80 of the Data (Use and Access) Act 2025 came into force under SI 2026/82, replacing the UK GDPR automated decision-making rules with Articles 22A to 22D. Significant solely automated decisions now need the safeguards set out in Article 22C.

Am I liable if the client's automated process breaks the law?

The client is usually the controller and primarily responsible. But if you designed the process and failed to advise on required safeguards, the client may claim you were negligent. Clear written advice and scope help your position.

Does PI cover a client's regulatory fine?

Usually not directly. Fines are often excluded or uninsurable. A client may still claim damages from you for losses linked to the breach, and PI may respond to that claim, depending on the wording and the law.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.