AI Adoption Outpacing Governance, Industry Leaders Warn
Insurers and brokers are deploying artificial intelligence faster than they can properly govern it, according to senior practitioners at BIBA 2026 in Manchester. The gap between deployment speed and governance maturity is creating measurable legal and operational exposure across the market.
The concern is concrete, not theoretical. Accountability gaps under the FCA's consumer duty, unsanctioned employee use of consumer AI tools, and unmanaged professional indemnity risk emerged as structural vulnerabilities that require board-level attention.
The accountability problem
Tim Johnson, partner and head of insurance at Browne Jacobson, identified accountability as the fundamental challenge. As AI assumes greater responsibility for underwriting decisions and customer interactions, regulated firms face a compliance obligation many have not fully confronted.
"Customers are entitled to understand how decisions are being made," Johnson said. "There's quite a lot of AI software where even software developers can't explain how the AI has come to its decision."
Under consumer duty rules, firms must demonstrate that products and services deliver good customer outcomes. Where AI-driven decisions cannot be properly explained or replicated when systems fail, that obligation becomes harder to meet.
Operational resilience compounds the problem. "If the AI system goes down or fails for whatever reason, does the business model enable the insurer using AI to continue to function in the same way? With AI, that's not always the case," Johnson said.
Many firms treat AI adoption as a software procurement exercise rather than a strategic transformation. Johnson said this represents the biggest error. "Once you start using AI to any degree, it's a board level issue."
Brokers and underwriting agents face an additional risk: professional indemnity exposure. Where an AI system produces an error that causes a firm to breach underwriting authority or deliver incorrect advice, the legal liability falls on the firm, not the vendor. "It is a straight negligence claim," Johnson said, "and one that is frequently overlooked in the enthusiasm to deploy."
Shadow AI and uncontrolled usage
Governance gaps extend beyond customer-facing systems. Uncontrolled AI usage inside organisations is creating growing operational risk.
Employees are using consumer AI tools outside approved corporate systems - what practitioners call "shadow AI." Johnson described this as both a regulatory risk and a practical inevitability. "If you don't give your staff an AI solution, they will open up their phones and they will use their own AI solution which carries a whole load of additional risks because it will be untested, it won't be a closed loop system," he said.
The result inverts conventional wisdom: firms moving cautiously on AI may carry greater unmanaged risk than those investing in controlled, governed systems.
Where deployment is working
For larger market participants, AI is already delivering measurable commercial advantages. At Aviva, new business enquiries are now ingested, enriched and indicatively priced within minutes.
Michael Yabantu, who leads Aviva's mid-market segment, described the change as substantive. "When a new business inquiry gets sent into us, we can now ingest it into our platforms, we can enrich it, we can indicatively price it, we can send it back to the underwriter within minutes," he said. "All of a sudden we start to transform the speed and quality of our service."
Crawford is addressing capability through a structured AI literacy programme, developing training at three levels across the organisation. Paul Lofkin, president of Crawford UK and Ireland, was direct about the limits of full automation.
"The science will tell you that fully autonomous claims handling is not currently possible, nor is it the right thing to do," Lofkin said. "Insurance is a trust business. It's a people business. And that human in the loop, where we're verifying AI because it's not always right, is really critical."
Donna Richards, chief executive of Carpenters Group, warned against assuming technology alone would solve operational challenges. "You can't just assume AI will solve the problem or that everything is going to be autopilot, people must still play a vital role," she said.
The governance question
BIBA 2026 reflected an industry that has accepted AI as a commercial necessity but is still working through the legal, regulatory and operational implications of that shift.
The firms best positioned are those treating AI adoption not as a technology project, but as a governance challenge. The distinction matters because the gap between the two is where much of the industry's emerging risk now sits.
For more on managing AI in insurance operations, see AI for Insurance and AI for Legal.
Your membership also unlocks:
