Professional indemnity explained

AI audit tools and professional indemnity for UK audit firms

Reviewed by the Apex broking team · Last reviewed 2026-11-06

AI audit tools are software products that use analytics or AI to help auditors test ledgers, match evidence and draft workpapers, such as MindBridge, DataSnipper, Caseware AiDA and Inflo. They matter because the FRC says the human auditor is always accountable, so an error a tool misses is still the firm's error.

Part of: Audit firm PI cover

In short

MindBridge, DataSnipper, Caseware AiDA and Inflo each describe AI features that score transactions, match documents, answer methodology questions or analyse client data. None is named or approved by the FRC, whose March 2026 guidance says the human auditor is always accountable. A claim alleging a failed audit is usually judged on what the firm did, reviewed and documented, not on the software it used. Audit firm PI usually responds to such claims subject to the policy terms, but insurers increasingly ask how tools were assessed under ISQM (UK) 1 and how their output is reviewed.

Do AI audit tools change who is liable for the audit?

No. The audit firm and its Responsible Individuals stay accountable for audit quality whatever software they use. The FRC's release of 30 March 2026 says "the human auditor is always accountable" and that "regulatory accountability for the deployment of AI tools and the quality of audit outputs remains unchanged". It adds that people, meaning the firms and their Responsible Individuals, are accountable for audit quality.

What the tools do change is the evidence trail. Risk scores decide which journals get tested, automated matching decides which invoices are vouched, and an assistant may shape how a workpaper is written. When an audit is later challenged, that trail is what a claimant's expert, the regulator and your PI insurer will read. This page covers the four tools as a group; each has its own page on how it works: MindBridge, DataSnipper, Caseware AiDA and Inflo.

What each tool says it does, and what it says about data

The table summarises each vendor's own statements, read in November 2026. They are claims by the vendor, not findings by Apex or any regulator, and they change; check the current position before relying on them.

Tool	What the vendor says it does	Data and security statements (vendor's own)
MindBridge (Ottawa, Canada)	Calls itself "the leader in AI-powered financial decision intelligence" and says teams can "analyze 100% of financial transactions in real time", scoring transactions for risk.	Security page: SOC 1, SOC 2 and SOC 3 Type 2 reports and ISO/IEC 27001:2022, 27017 and 27018 certification. Hosting region and use of data for AI training are not stated there.
DataSnipper (Amsterdam)	An Excel add-in for snipping, extracting and matching evidence to workpapers, described as "The connected trust layer for audit and finance teams". Its AI products include the agentic Alwin.	Help article: core features run on the user's machine, but optional AI services "process documents on our servers for up to 24 hours". SOC 2 Type II.
Caseware AiDA	An AI digital assistant inside Caseware products. UK launch announced 15 October 2024. Caseware says it summarises long PDFs, answers questions on documentation, methodology and compliance, and helps produce workpapers.	Caseware release: no prompts are stored or fed back into the model. Hosting region and certifications not stated on the pages we read.
Inflo (UK company)	"a Digital Audit platform" with "AI-enabled capabilities", covering working papers, client collaboration and data analytics.	Security page: ISO/IEC 27001:2022 and SOC 2 Type II. EMEA data has its primary site in Ireland and backup in the Netherlands; no UK region is stated.

Some UK firms have announced their own adoption. KPMG UK announced an alliance with MindBridge in May 2023, Buzzacott a partnership on 26 August 2025 and BDO UK an expansion on 7 July 2026. HLB International announced member firm access to Inflo on 8 September 2026. Apex has no commercial relationship with any of these vendors and does not rate their products.

What the FRC has said, and what it has not

26 June 2025. AI in audit: Illustrative example and documentation guidance walks through an AI-enhanced journals procedure and how to document it. The FRC says it "is not prescriptive and does not introduce new regulatory requirements". It covers tools from third-party providers and was published alongside a thematic review on certification of automated tools and techniques.
30 March 2026. Generative and Agentic AI Guidance "codifies good practice" and "does not alter" accountability under auditing standards. It expects outputs to be reviewed by "humans in the loop" who have "appropriate competence", "should apply professional scepticism" and stay alert to automation bias.
ISQM (UK) 1. The quality management standard came into effect on 15 December 2022. One of its components is resources, which the FRC describes as "including human, technology and intellectual resources obtained from the firm's network and service providers". This is why many firms run an approval or certification process before relying on a tool; see certifying AI tools under ISQM (UK) 1.

Neither FRC document names MindBridge, DataSnipper, Caseware AiDA, Inflo or any other commercial vendor, and no tool is FRC-approved. The FRC AI in audit page also names none of them. For a fuller walk-through, see FRC AI guidance explained.

Audit failure claims and how audit firm PI usually responds

Most audit claims are brought by the audited company, often through administrators or liquidators after a collapse, alleging that the auditor should have spotted a fraud or a material misstatement. Claims by third parties such as lenders or investors face a narrower duty of care; see the auditor duty of care and audit fraud detection claims.

Audit firm PI usually responds to these claims, subject to the policy terms, in the same way whether or not AI was used. Points that commonly matter:

Claims-made basis. The policy in force when the claim is first made usually responds, not the one in force when the audit was signed. See claims-made PI.
Aggregation. If the same tool setting or review gap runs through several years' audits, how the wording groups those claims affects how the limit applies. See aggregation of claims.
Limits. Professional body minimums are a floor. For listed or public interest entity audits, the right limit is a question to discuss with your broker; see choosing PI limits.
Data incidents. A breach of a vendor's cloud is usually a cyber matter first; PI may respond to client claims for breach of confidentiality depending on the wording. See cyber exclusions in PI.

Illustrative example. A firm audits a group with three subsidiaries, using an analytics tool for journals and an evidence-matching add-in for revenue vouching. After the group fails, the administrators allege overstated revenue across two years. Their expert asks why flagged journals were cleared without follow-up and why matched invoices were not traced to cash. Neither question is about the software; both are about review and documentation, which is what the PI defence will rest on.

What insurers may ask about AI tools

Proposal forms for audit firm PI vary. Questions insurers may raise include:

Which tools are used, on which engagements, and whether any is used on listed or public interest entity audits.
How each tool was assessed before use under ISQM (UK) 1, and who signed that off.
How outputs are reviewed and documented, and how the firm guards against automation bias.
Where client data is processed and stored, under what contract, and whether engagement letters cover it.
Whether any FRC or professional body inspection has raised findings about the use of tools.

Some wordings now carry AI-specific clauses; see AI exclusions and clauses. For how errors attributable to tools are usually handled, see auditors, AI errors and PI.

Common misunderstandings and practical steps

"The vendor is liable if the tool gets it wrong." Vendor contracts commonly cap liability, and the client's claim is against the auditor. Any recovery from a vendor is a separate question.
"Full population testing means nothing is missed." A tool can read every transaction and still score a fraudulent one as low risk. See full population testing and AI journal entry testing.
"An accredited or well-known tool is safe to rely on." The firm still has to assess it and review its output.

Practical steps: keep a register of tools and engagements, record the ISQM (UK) 1 assessment, set review rules for each tool, explain AI use in engagement letters, and tell your broker about tools before renewal. More on the profession: AI for auditors and AI tools by profession.

Apex arranges audit firm PI cover; a broker reads every enquiry.

Sources

Frequently asked

Is any AI audit tool approved by the FRC?

No. The FRC's June 2025 example and its March 2026 Generative and Agentic AI Guidance do not name MindBridge, DataSnipper, Caseware AiDA, Inflo or any other commercial vendor. The firm decides whether a tool is fit for use, assesses it under ISQM (UK) 1 and stays accountable for the audit.

Does audit firm PI cover mistakes made with AI tools?

Usually, yes, subject to the policy terms. PI responds to claims that the firm's professional work was negligent, and using a tool does not usually change that. Check the wording for any AI-specific clauses and make sure your proposal form describes how you use the tools.

Do we need to tell our PI insurer which AI tools we use?

You must give a fair presentation of the risk, and material changes in how you deliver audits are likely to be relevant. Telling your broker which tools you use, on which engagements and how output is reviewed avoids arguments later. Your broker can advise how to present it.

Should audit engagement letters mention AI tools?

It is increasingly common. A short clause explaining that the firm may use AI-enabled software, that client data may be processed by named providers and that the firm reviews all output helps with confidentiality and data protection questions and sets expectations if a dispute arises.

Do we need cyber cover as well as PI if tools are cloud hosted?

Usually it is worth considering. PI responds to claims about your professional work; cyber usually covers your own breach response costs, system restoration and some third-party data claims. Where client ledgers and documents sit in vendor clouds, the two policies work together.

Using AI tools in your firm? Have your PI reviewed before renewal

Tell us which tools your firm uses, what they produce and how output is checked. We will review how your PI and cyber cover respond and what insurers will ask at renewal. No fee and no obligation. Or call 0117 325 0027.

Book a PI programme review Get a PI quote

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.