Aviva put AI into the one kind of underwriting where the law still requires a person. It reads the file. The underwriter still decides.

Read the February change and Aviva's product decisions side by side and they line up in a way that is hard to call coincidence.

The change first. On 5 February 2026, section 80 of the Data (Use and Access) Act 2025 came into force, removing Article 22 of the UK GDPR and putting Articles 22A to 22D in its place. Article 22 had been a prohibition on significant decisions made by machine alone, with narrow exceptions. The new articles are a permission with safeguards. For everything except special category data, the machine may decide.

The safeguards in Article 22C are worth reading for what they do not contain. A person must be told a decision was automated, may make representations about it, may obtain human intervention, and may contest it. Every one of those happens after the decision exists. None of them puts a person inside it.

Article 22B is the exception. Decisions relying on special category data, which includes health, stay under the older near-prohibition.

Now the product. Aviva's AI underwriting tool launched for individual life insurance in November 2025 and was extended to critical illness cover in March 2026. Both of those lines are underwritten on medical evidence, largely GP reports. That is health data. That is special category. That is precisely the territory where the February change did not reach and a human decision is still required.

Aviva's own description of the tool is that it works at the front end of the journey, supporting underwriters to make decisions more quickly from the point of application. The machine reads the file. The underwriter decides.

Set that against the lines the change did reach. Motor and home pricing, and consumer credit in the ordinary case, do not rely on special category data. Since February the default there permits a decision by machine alone, provided the after-the-fact safeguards are in place.

So the statute predicts the shape of the job. Where the law still demands a person, the deployment automates the reading and keeps the decider. Where it does not, nothing in the rules requires a decider at all.

This desk argued on 22 July that a human kept in the loop can become a rubber stamp with the blame pre-attached. The legal counterpart of that argument has now arrived, and it runs the other way: where the loop is no longer required, the stamp is not needed either.

One thing this desk cannot tell you. We looked for a named British insurer or lender that has moved to solely automated significant decisions since February and could not find one. That is not evidence there is none. It is what we found.

WHY IT MATTERS HERE: The protection around this job is not a limit on what the machine can do. It is a category in a statute. Change the category and the protection moves with it, in whichever direction the change runs.