FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Marketing and PR agencies
AI-personalised emails must meet the same PECR consent rules as any marketing email, and errors are multiplied across every recipient. With PECR fines now up to £17.5m or 4% of turnover, clients will look hard at the agency that ran the campaign.
Part of: AI in Marketing and PR agencies
In short
Agencies use AI to write individual email copy, choose send times and run automated journeys. PECR and UK GDPR apply in full: consent or a valid exception, easy opt-out and careful use of inferred data. DUAA raised the maximum PECR fine to £17.5m or 4% of global turnover. Possible failures include emailing unsubscribed contacts, intrusive inferences and offensive or wrong merge content. Fines are generally uninsurable, but a client's claim that the agency negligently ran a campaign may fall within PI or cyber cover, depending on the wording.
Email and CRM agencies may use AI to write subject lines, generate individual copy for each recipient, decide send times, build automated journeys and predict which customers are likely to buy or leave. Personalisation can go beyond a first name: models can write paragraphs based on purchase history, browsing data and inferred interests. That makes the content more relevant, but it also means each email is built from personal data, and a fault in the data or the prompt can reach thousands of inboxes before anyone notices.
Electronic marketing by email and text is governed by PECR, enforced by the ICO alongside UK GDPR. In general terms, marketing emails to individuals need consent unless a narrow exception for existing customers applies, and recipients must be able to opt out easily. The ICO says the Data (Use and Access) Act raised the maximum PECR fine to £17.5m or 4% of global turnover, bringing direct marketing breaches into the same range as serious data protection breaches.
Personalisation also involves profiling. Most email personalisation will not be a "significant decision" under the new automated decision-making rules in Articles 22A to 22D, in force from 5 February 2026, but excluding people from important offers could raise the question. The IPA/ISBA principles expect respect for personal data (principle 6) and human oversight (principle 10). Promotional claims in emails are also subject to the ASA's media-neutral rules.
Illustrative scenario: an agency builds an AI-driven win-back journey for a retailer. The data feed mixes in contacts who had unsubscribed, and the model writes copy referring to "your recent baby purchases" based on an inference from browsing data. Recipients complain about unwanted and intrusive emails. The ICO contacts the retailer, which faces an investigation and press coverage, ends the retainer and claims its costs from the agency.
AI makes this worse in two ways. It draws on more data points per person than a simple merge field, so a bad input produces stranger output, and it generates copy that no human has read before it is sent. A template once approved by a person is replaced by thousands of unique emails approved by nobody.
Merge errors are the everyday version: the wrong name, a deceased customer's name, a price that does not exist, or AI copy that makes an insensitive comment. Each one is small, but at scale they damage the client's reputation and generate complaints.
An ICO fine is generally uninsurable and may be excluded; see GDPR and ICO fines for professional firms. A client's claim that the agency negligently built or ran a campaign may fall within PI, subject to any data protection exclusion, while some data-related losses may sit with cyber cover. The way the policies fit together varies, so read GDPR and data breach cover within PI and PI or media liability for AI claims.
Audience building for paid media raises related issues, explained in AI ad targeting and personal data. See also our glossary entry on PECR and the marketing and PR agencies hub.
How Apex helps: Apex arranges PI for email and CRM agencies. A broker reviews how your policies treat data protection complaints and client claims from automated campaigns.
No. The same consent and opt-out rules apply whether the email is written by a person or AI. What changes is scale and the use of inferred data, which increases the chance of contacting the wrong people or using data in an intrusive way.
According to the ICO, the Data (Use and Access) Act raised the maximum PECR fine to £17.5m or 4% of global turnover. Fines are generally uninsurable, so consent checks and suppression controls matter most.
Responsibility depends on the agreed data roles and what the agency did. If the agency advised the list could be used, ignored suppressions or processed beyond instructions, the client may claim against it.
Reviewing every email is rarely practical at scale. A better approach is to review a representative sample of variants before launch, set rules that block sensitive topics, monitor complaints and unsubscribes closely after sending, and keep a named owner who can stop the journey.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
