FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Payroll bureaux
Using AI to read fit notes and family-leave documents speeds up statutory pay, but it puts health data into an AI tool and can produce eligibility errors. The bureau may face both a negligence claim and a data protection complaint.
Part of: AI in payroll bureaux
In short
Bureaux use AI to read fit notes, maternity certificates and leave forms, decide eligibility and calculate statutory payments. GOV.UK states Statutory Sick Pay is £123.25 a week or 80% of average weekly earnings, whichever is lower, for up to 28 weeks. Fit notes contain health data, which is special category data under UK GDPR, so the bureau needs a lawful basis, processor terms and a DPIA where AI tools are used. Wrong eligibility decisions can lead to disputes and claims. PI usually responds to negligent calculation, while a data incident may need cyber or data liability cover, depending on the wordings.
Statutory payments start with documents. A fit note, a maternity certificate or an adoption match letter must be read, dates extracted, eligibility checked and payments calculated over the right period. Bureaux use AI to read scanned documents, extract dates and conditions, check average weekly earnings and generate the payment schedule.
This removes a lot of manual keying, but it also means a tool is reading medical information and making or proposing eligibility decisions about people at a vulnerable time. Fit notes are often handwritten or photographed on a phone, and family-leave documents vary in format, so extraction errors are more likely than with structured payroll data.
GOV.UK's employer guide to Statutory Sick Pay gives the rate as £123.25 a week or 80% of the employee's average weekly earnings, whichever is lower, paid for up to 28 weeks. The employer is liable to pay; the bureau owes the employer reasonable care and skill under section 13 of the Supply of Goods and Services Act 1982.
Data protection adds a second layer. Sickness information is health data, which is special category data. The bureau is usually a processor for the employer under Article 28 terms, and the ICO's AI guidance applies to the use of AI on that data, including DPIAs. A fully automated refusal of statutory pay could be a significant decision under UK GDPR Articles 22A to 22D; see automated payroll decisions.
Illustrative scenario: a bureau introduces an AI tool to read fit notes uploaded by a client's managers. The tool misreads a handwritten end date on several notes and stops SSP early. The affected employees complain, one escalates through a union, and the client asks the bureau to explain how a tool came to make that decision. At the same time, the client discovers that the tool provider retained copies of the uploaded fit notes, which was not in the processor terms.
Other errors include missing a linked period of sickness, using the wrong earnings period for average weekly earnings, or applying the wrong start date for family leave. Each can produce underpayment and a dispute, and the data handling questions run alongside.
A claim by the employer that the bureau negligently calculated or stopped statutory pay usually falls under PI, subject to the policy terms. Statutory pay the employer always owed is not normally the bureau's loss, but the employer's costs of correcting payments, handling grievances and defending claims may be.
A data incident is different. Complaints or compensation claims under Article 82 for misuse of health data may fall under a PI wording that includes data liability, or under cyber cover, depending on the terms. See GDPR cover within PI and Article 82 and processors.
The following steps help manage both the calculation and data risks:
Apex arranges professional indemnity for payroll bureaux and can review whether health data processing by AI tools falls under your PI, your cyber insurance or neither. See also AI in payroll bureaux.
GOV.UK's employer guide gives SSP as £123.25 a week or 80% of the employee's average weekly earnings, whichever is lower, for up to 28 weeks. Check the current page before relying on the figure, as rates are updated.
It can be, but fit notes contain health data, which is special category data. The bureau needs a lawful basis through the employer, Article 28 processor terms, a DPIA and safeguards on how the AI provider stores or uses the data.
A DPIA is expected where processing is likely to be high risk, and using a new technology on special category health data is a strong indicator. The employer, as controller, owns the DPIA, but the bureau should contribute details of the tool, its provider and the safeguards in place.
The employer must pay the employee what was due. If the error came from the bureau's negligence, the employer may claim its costs from the bureau, and PI usually responds to that claim, subject to the wording.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
