FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Business process automation
Yes. If you design, build or advise on business process automation, such as robotic process automation, workflow tools, low-code apps or AI agents, you need professional indemnity insurance. An automation does exactly what it was built to do, thousands of times, so one wrong rule becomes thousands of wrong payments, emails or records before anyone notices. The client’s loss is financial and the claim is that your work was negligent. Public liability does not cover that; PI does, subject to the policy terms.
Part of: Professional indemnity for consultants
In short
Automation consultants carry a scale risk most advisers do not: a single logic error repeats across every transaction the automation touches. Claims allege duplicate payments, missed deadlines, corrupted data and bots that kept running after a system changed. PI covers negligent design, build, testing and advice, but check how the policy groups related claims, because one root cause can mean one claim or hundreds. Where an automation makes significant decisions about people, UK GDPR Articles 22A to 22D have applied since 5 February 2026: any lawful basis can be used with safeguards, but special category data stays restricted. Cyber insurance usually deals with attacks on your systems and the credentials your bots use.
Last reviewed 5 October 2026 by the Apex professional indemnity team.
Automation consultants are paid to take work away from people: invoice processing, onboarding, reconciliations, customer emails, claims triage, reporting. You map the process, choose the tool, build the bots, flows, low-code apps or AI agents, test them and hand them over, often with a period of support. The client then stops checking the work by hand, which is the whole point.
That is also the risk. A person who misreads an invoice makes one mistake. An automation that misreads a field makes the same mistake every time it runs, quickly and without complaint, until someone spots the pattern. The losses are financial: duplicate or misdirected payments, missed regulatory deadlines, corrupted records, customers sent the wrong outcome, and the staff time needed to unpick it all.
Public liability (PL) insurance covers accidental injury and damage to property, which an automation consultant rarely causes. Professional indemnity (PI), written for technology work as technology errors and omissions cover, responds when a client alleges your design, build, testing or advice was negligent, subject to the policy terms. Cyber insurance covers attacks on your own systems and, depending on the wording, the client data and bot credentials you hold. This page is about business process automation. If you program PLCs, SCADA or other industrial control systems, see our engineers’ PI guide.
The scenarios below are illustrative. They show the kind of allegation automation consultants face, not real claims or outcomes.
In every case the software did what it was told. The allegation is that you told it the wrong thing, or failed to make it stop.
The defining feature of automation risk is aggregation. The same defect can touch every transaction for weeks, and the way your PI policy groups related claims decides how much protection you really have.
The controls that prevent large claims are design decisions, and they are what an expert will look for afterwards: volume and value caps that halt a run outside normal limits, reconciliation against source systems, alerts when a target screen or API changes, staged roll-outs with parallel running, and a stop switch the client knows how to use. Record which of these you recommended and which the client declined.
If an automation you design decides something about an individual, such as a credit limit, a job application, an insurance claim or access to a service, data protection law governs how it does so. The rules changed on 5 February 2026, when section 80 of the Data (Use and Access) Act 2025 came fully into force and replaced Article 22 of the UK GDPR with new Articles 22A to 22D.
| Rule | What it says | Why it matters to your PI |
|---|---|---|
| UK GDPR, Article 22A | A decision is based solely on automated processing if there is no meaningful human involvement in taking it, judged partly by how far it relies on profiling. A significant decision is one with a legal or similarly significant effect for the person. | A token approval step does not make a decision human. Your workflow decides which side of the line the client is on. |
| UK GDPR, Article 22C | For significant decisions taken solely by automated processing, the controller must have safeguards that give the person information about the decisions and let them make representations, obtain human intervention and contest the decision. | Clients will expect your build to make each of these possible. |
| UK GDPR, Article 22B | Such decisions based on special category data are allowed only with explicit consent, or where necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies. | Health, ethnicity or biometric data in a decision flow needs a lawful route before you build. |
| ICO guidance on the 2025 Act | The change opens up the full range of lawful bases for significant automated decisions, so long as appropriate safeguards continue to be applied; it does not extend to special category data. | More freedom for clients, but the safeguards are still designed in by you. |
| UK GDPR, Article 82(2) | A processor is liable for damage caused by processing only where it breached obligations aimed at processors or acted outside or against the controller’s lawful instructions. | If you run automations for clients, work to documented instructions. |
| ISO/IEC 42001:2023 | Requirements for establishing, implementing, maintaining and continually improving an AI management system. | Clients that adopt it will expect AI agents you deliver to fit its controls. |
The controller duties sit with your client. Your exposure is the advice and design behind them: a client that relied on you to build a compliant process can claim the cost of putting it right if it was not. Fines and penalties are commonly excluded from PI wordings.
| Usually covered by PI | Often excluded or limited | Needs a different policy |
|---|---|---|
| Negligent process design and automation logic | Guaranteed savings, accuracy rates or headcount reductions | An attack on your systems or the bot credentials you hold (cyber) |
| Build and configuration errors in RPA, workflow and low-code tools | Fines and penalties, which PI wordings commonly exclude | Money stolen through fraudulent payment instructions (crime cover) |
| Testing failures that let defects reach live use | The cost of rebuilding your own defective work | Injury or damage at a client’s premises (public liability) |
| Negligent advice on tools, process change and automated decisions | Outages of third-party platforms you do not control | Claims against your directors over how the firm is run (D&O) |
| Data errors and accidental disclosure caused by your build | AI work you did not declare, or that the wording restricts | Injury to your own staff (employers’ liability) |
| Defence costs, including forensic and data experts | Issues you were already aware of when cover began | Laptops and equipment (equipment cover) |
The detail depends on the wording. Some PI and cyber policies limit or exclude AI-related work, so describe your use of AI agents and generative AI tools in plain terms when you apply.
The limit usually comes from the client contract or framework. Financial services firms, public bodies and larger companies often specify an amount and ask for cover to be maintained for some years after the work ends. Size it to the values your automations touch, not to the fee for building them.
A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:
Speak to a broker
PI for automation consultants, placed by a named broker
Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.
Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.
Yes. Automations you design or build repeat any error across every transaction they handle, so a single mistake can cause large financial losses through wrong payments, bad data or missed deadlines. Public liability does not cover that. PI pays defence costs and compensation when a client alleges negligence, subject to the policy terms.
No law or regulator requires automation consultants to hold PI. In practice clients make it a condition of the contract or framework, especially in financial services and the public sector, usually with a minimum limit and sometimes a requirement to keep cover in place for years after the project ends.
Often, yes. Many PI wordings treat claims from the same originating cause or a series of related errors as one claim, with one excess and one limit. That limit then has to cover every affected transaction, so size it to the values your automations process and check the aggregation wording.
It can, if your declared business includes designing and deploying AI agents and the client alleges your design, configuration, testing or advice was negligent. Some wordings restrict AI-related work, so declare it clearly. PI will not usually pay out on a promise that the agent would reach a stated accuracy.
The client, as controller, must apply the Article 22C safeguards to significant solely automated decisions. If you run the automation for the client, Article 82 makes you liable only where you breach processor obligations or act outside its lawful instructions. Your design advice can still be challenged as negligent.
It depends on who was responsible for spotting the change. If your contract made you responsible for monitoring and you missed it, PI may respond to the negligence claim. If the client changed a system without telling you, record that. Agree change notification and monitoring duties in your support terms.
Apex arranges professional indemnity insurance for automation consultants across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.
Start your PI proposal Call 0117 325 0027Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.
