What was tested this time?

The same question as in Death Is Guaranteed, "Can I use AI to run a protection fact find?", put to ChatGPT three times on 3 November 2026, each in a fresh logged-out session. All three answers were stored in full.

What is different from September?

In September the two re-runs did not reproduce the July contradiction, so that article narrowed its claim to there being no single answer to rely on. In November all three answers set out the same safeguard early, the adviser's role in advice and suitability, and all three then recommended an AI that holds the fact-find conversation with the client directly.

Did the answers still mention health?

Two of the three did, among their considerations. The first did not mention health data at all. That matches the September finding that the same question does not get the same answer twice.

Does UK GDPR apply when an AI collects a client's answers?

Collecting is processing. UK GDPR Article 4(2) defines processing as any operation performed on personal data, whether or not by automated means, and its list begins with collection. Article 9(1) prohibits processing data concerning health unless a condition in Article 9(2) applies, and since the Data (Use and Access) Act 2025 that paragraph opens by requiring a basis under Article 6(1) as well.

Is this a claim that brokers should not use AI in a fact find?

No. It is a record of what one engine recommended on one day, three times, and of the gap between the safeguard each answer stated and the design it went on to recommend.

The Contradiction Came Back

In September I wrote about one question, put to one AI engine four times across two months: "Can I use AI to run a protection fact find?" (Death Is Guaranteed. So Is the Transcript.)

I had set out to show something I found in July. The answer warned against putting health information into an AI system, then put an AI in the room. When I asked again in September, that did not reproduce. So the article said something narrower: the same question does not get the same answer twice, and there is nothing stable to rely on.

On 3 November I asked three more times. Logged out, each in a fresh session, and every word kept. On this question, all three did a version of the thing September could not confirm.

The safeguard: the adviser

Every answer set out the same boundary early, before any of its lists: the adviser's role.

"The important distinction is that AI can support the fact-find, but it shouldn't independently make regulated advice or suitability decisions unless the process, permissions and regulatory controls allow it."

"The important distinction is that AI should support the adviser, not replace professional judgement or regulatory responsibilities."

"However, it should support the adviser rather than replace professional judgement, suitability assessments or regulatory responsibilities."

Three answers, one safeguard. The adviser stays in charge.

The design: the conversation moves

Each answer then recommended what to build.

"An AI-powered protection fact-find that works like a conversation between a protection adviser and a customer."

"I'd build an AI-powered, conversational protection fact find that works like an experienced protection adviser."

"A conversational AI protection fact find that feels like sitting down with an experienced protection adviser".

Two of the three included a sample conversation, and in both the only parties were the AI and the client. In one, the AI tells the client: "There may be a potential shortfall against your stated mortgage protection objective." Another asked itself "Could you automate the whole process?" and answered "Yes."

To be fair to all three, each ended by asking who the tool was for, and each offered a version for the adviser alone. But by then each had already made its recommendation, and it was the one the client talks to.

So the safeguard is the adviser, and the design is an AI that does the adviser's talking. The adviser still reads the report at the end. The conversation has moved.

In a protection fact find, that is not a detail. The conversation is where an adviser hears what the client is not saying, notices the pause before a health question, and asks the follow-up that changes the cover.

Where the health data goes

Health did not disappear, but it did not hold steady either. The first answer never mentioned health data. The third listed "Health and lifestyle considerations" among the things the AI should guide the client through. The second named the risk, "Explicit controls around sensitive medical information", and then offered a version where "The client answers questions directly through a conversational AI assistant".

In October we set out why a protection conversation puts Article 9 in play from its first sentence (Compliance With No Regulator In It). What these answers change is who hears that sentence. In the design they recommend, the client says it to the AI.

UK GDPR does not treat that as a step before processing. Processing means "any operation or set of operations which is performed on personal data", "whether or not by automated means", and the list starts with "collection, recording, organisation, structuring, storage" (Article 4(2)). The AI asking the question and recording the answer is the processing.

What a broker takes away

September showed that you cannot rely on what the tool says. November adds something narrower. Even when three answers agreed on the safeguard, all three recommended a design that walks past it.

A broker reads both halves. The safeguard is a sentence. The design is a list of features, a sample conversation and an offer to help build it. The caution reassures you that the risk has been thought about. The design is where it was not.

So when an AI answer tells you the adviser stays in charge, then offers to build you something that "works like an experienced protection adviser", read the design as if the safeguard were not there. That is how it will be built.

What I am not claiming

This is one engine, one question, three answers on one day. It is not a trend, and three answers cannot show one. It is not a claim that any broker has built this, or that using AI in a fact find breaks a rule.

This article is part of Compliance Reality Check, one of three editorial streams from AI for Brokers. The compliance risks brokers are already carrying without realising. The uncomfortable questions no one else is asking. The scenario in this article is illustrative and does not refer to any real firm or individual.