Why ask
UK insurers remain responsible when an AI supplier is involved. The FCA's Consumer Duty guidance says that where firms outsource activities to third parties, they remain responsible for compliance. Under UK GDPR, an insurer may only use processors that provide "sufficient guarantees" of appropriate measures, and the ICO's AI guidance expects buyers to carry out their own due diligence rather than rely on the supplier's word.
For insurers in scope of Solvency II, the PRA's supervisory statement SS2/21 sets expectations for outsourcing and third party risk management, including business continuity and exit plans.
This request turns those duties into twelve plain questions for the supplier. The answers are self-declared, so treat the result as a list of documents to ask for, not as proof.
How it works
- You create a request link above and send it to your supplier from your own email.
- Your supplier answers 12 questions on this page about the evidence they hold.
- You both get the same result: what is available, what is partly available and what is missing, with the rule behind each item and a fingerprint so anyone can check it was not changed.
The 12 questions
- What the system decides: A plain description of what the system does, which decisions it makes or influences, and about whom. UK GDPR Art 28(3)(f): assisting with Articles 32 to 36, including the DPIA
- Controller and processor roles: A record of whether you act as processor, controller or joint controller for each processing activity. ICO guidance on AI and data protection: accountability and governance
- Processing on documented instructions: Confirmation that personal data is processed only on the insurer's documented instructions, including on international transfers. UK GDPR Art 28(3)(a)
- Security measures: The technical and organisational security measures in place. UK GDPR Art 28(3)(c) and Art 32
- Help with individuals' rights: How you help the insurer respond to requests from individuals exercising their data rights. UK GDPR Art 28(3)(e)
- Information for the DPIA: Information the insurer needs to complete its Data Protection Impact Assessment. UK GDPR Art 28(3)(f) and Art 35
- Audits and compliance information: Willingness to provide the information needed to demonstrate compliance and to allow audits or inspections. UK GDPR Art 28(3)(h)
- Automated decision safeguards: Where decisions with legal or similarly significant effects are made solely by the system, support for telling people, letting them make representations, obtaining human intervention and contesting the decision. UK GDPR Art 22C (inserted by the Data (Use and Access) Act 2025, in force 5 February 2026)
- Trade-offs and personal data used: A record of the trade-offs built into the system (for example accuracy against fairness) and a justification for the personal data it needs. ICO guidance on AI and data protection: due diligence when procuring AI
- Customer outcome information: Information that helps the insurer monitor outcomes for its customers where your system is involved. FCA FG22/5 Consumer Duty guidance, paras 2.22 and 2.24
- Change notification and review: A commitment to tell the insurer about material changes to the system, so it can review the service regularly. ICO guidance on AI and data protection: regularly review outsourced services
- Continuity and exit: Business continuity arrangements and support for exit or switching to another provider. PRA SS2/21 Outsourcing and third party risk management (business continuity and exit plans); ICO guidance on switching provider
Sources
- UK GDPR Article 28 (legislation.gov.uk)
- Data (Use and Access) Act 2025, section 80 (legislation.gov.uk)
- ICO: accountability and governance implications of AI
- FCA FG22/5: Final non-Handbook Guidance for firms on the Consumer Duty
- PRA SS2/21: Outsourcing and third party risk management
Sources checked 8 October 2026. This tool helps you ask for evidence. It is not legal advice, an audit or a certification, and the answers are the supplier's own.