Aipedia: Veterinary surgeons and practices

Client data, consent and AI in veterinary practices

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Practices using AI must check that developers cannot access or train on client data without consent, and be open with clients about how AI processes their data. Client and animal information is confidential under the RCVS Code, and client personal data is also covered by UK GDPR.

Part of: AI in veterinary practice

In short

Code 2.6 says vets must not disclose information about a client or the client's animals to third parties, and Chapter 14 covers client confidentiality. The RCVS Spring 2026 AI advice asks practices to check developer access, whether a tool trains on practice data or learns from live client data, and to get consent where it does. Practices should be "open and honest" with clients about AI data processing and refer to ICO guidance. Client personal data is covered by UK GDPR. A data incident involving an AI tool can lead to complaints, regulatory attention and claims that may sit across PI and cyber cover.

Where client data meets AI

Almost every AI tool in practice handles client or animal information. Scribes record consultations. Imaging and lab services receive images and samples linked to client records. Chatbots collect owner details and symptoms. Staff paste histories into generative AI chatbots to draft letters or insurance forms. Farm and equine systems hold detailed data about a client's business or animals.

The question for each tool is where the data go, who can see them and whether they are used to improve the tool.

The duties that apply

These duties apply whether or not AI is involved:

Code 2.6: the Code says vets "must not disclose information about a client or the client's animals to a third party". The RCVS treats animal data as confidential too.
Chapter 14 and the AI advice: the RCVS AI advice asks practices to check that developers cannot access practice data or train on it without consent, and whether a tool learns from live client data; if it does, clients should have consented.
Openness: practices should be "open and honest" with clients about how AI processes their data.
Adoption checklist: check data storage against the practice privacy policy, how the tool was trained, and whether it is a closed system or the developer has access.
Lay staff: remind them of their confidentiality obligations.

UK GDPR and automated decisions

Client personal data, such as names, contact details, payment information and anything that identifies the owner, is covered by UK GDPR, and the RCVS advice refers practices to ICO guidance. Using an AI tool usually means the supplier processes personal data for the practice, which brings contract and transparency obligations.

Section 80 of the Data (Use and Access) Act 2025 inserted Articles 22A to 22D on automated decision-making, fully in force from 5 February 2026. These apply to solely automated significant decisions about clients as people, not to decisions about animals. A tool that automatically refused credit or service to an owner could engage them; a tool suggesting a diagnosis for a dog would not.

What can go wrong

Illustrative scenario: a practice adopts an AI scribe on a free trial. Nobody reads the terms, which allow the developer to use recordings to train its models. A client later learns that a recording of a difficult euthanasia discussion may have been used this way and complains to the practice and the ICO. The practice cannot show it checked developer access or told clients.

Other examples include staff pasting identifiable histories into public chatbots, chat logs stored outside the UK without the practice knowing, and a supplier data breach that exposes client records.

How insurance usually responds

Data incidents can fall between policies. A client claim alleging breach of confidence in providing professional services may be treated under PI, while breach response costs, notification and system restoration are usually cyber matters. Some PI policies may exclude data or cyber events, and regulatory fines are often uninsurable or excluded, depending on the wording. See cyber insurance and AI risks, GDPR cover within PI and data breach liability for professional firms.

Practical controls

Put these controls in place:

Read the data terms of every AI tool, including free trials and features in existing software.
Choose tools that do not train on practice data, or get client consent if they do.
Update the privacy notice to explain AI processing in plain terms.
Ban identifiable client data in public chatbots.
Keep a record of the RCVS adoption checklist for each tool.
Check how your PI and cyber cover work together.

How Apex helps

Apex arranges PI for veterinary practices. A broker reviews how your policy treats incidents involving AI tools and client data.

Sources

Frequently asked

Do clients have to consent to AI use?

Not for every tool. The RCVS asks practices to be open and honest about AI data processing, and to get consent where a tool learns from live client data. UK GDPR transparency rules also apply to client personal data.

Is animal data personal data?

Information about an animal alone is not usually personal data, but it often identifies the owner. The RCVS treats animal information as confidential under Code 2.6 and Chapter 14 regardless, so it needs protecting either way.

Do the new automated decision rules apply to vets?

Articles 22A to 22D, in force from 5 February 2026, cover solely automated significant decisions about people. They can apply to decisions about clients, such as credit or access to services, but not to clinical decisions about animals.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.