What a completed report looks like
This is a real assessment of a UK insurance chatbot. It shows the acts, obligations and next steps you receive when you run a check. Not legal advice.
A chat assistant on a UK motor insurance website that answers questions about policies and can start a claim. It keeps the conversation history against the customer account. UK users only.
- Acts in scope
- 4
- Obligations found
- 12
- Applies
- 8
- Undetermined
- 4
Around ~1 hr of legal review, if you did this by hand
12 obligations at about 3 minutes each to find, read and decide.
What we found
UK Financial Services and Markets Act 2000 (FCA)
United Kingdom- Applies
Maintain a permanent, effective and independent compliance function
- Applies
Ensure customer-facing AI outputs are fair, clear and not misleading
- Applies
Retain records of automated decisions affecting customers for a minimum period
- Undetermined
Notify the FCA before deploying material changes to AI systems used in regulated activities
EU AI Act
European Union (extraterritorial)- Undetermined
Register as provider of a high-risk AI system if FMSA classification applies
- Undetermined
Conduct a conformity assessment before deployment
- Applies
Implement a quality management system covering data governance and human oversight
- Applies
Provide affected individuals with meaningful information about automated processing
UK GDPR / Data Protection Act 2018
United Kingdom- Applies
Provide meaningful information about automated processing at point of collection
- Applies
Allow subject access requests and respond within one calendar month
- Applies
Document the lawful basis for each processing activity involving personal data
- Undetermined
Appoint a Data Protection Officer if processing is carried out on a large scale
1 further act is locked
You can see every act we found and what each one amounts to. Verifying your email address opens the obligations themselves.