FCA authorised · FRN 724952 0117 325 0027Quote & buy →
AI insurance
Health AI insurance covers the liabilities of businesses that build or supply AI for diagnosis, triage, monitoring or clinical administration, across professional indemnity, product liability, cyber and IP. It matters because AI with a medical purpose is regulated as a medical device, and its errors can cause injury as well as financial loss.
Part of: AI insurance UK
In short
AI software with a medical purpose is a medical device under the UK Medical Devices Regulations 2002, and tighter post-market surveillance rules have applied in Great Britain since 16 June 2025. In England, suppliers to the NHS are expected to meet clinical safety standard DCB0129, pass DTAC and hold the insurance their contract specifies. When clinical AI gets it wrong, patients usually pursue the provider, which may then pursue the supplier. Health AI firms commonly need PI, product liability, cyber and IP cover, and medical malpractice cover where they deliver care.
A health AI product's regulatory status shapes its insurance. Examples are illustrative.
| Product (illustrative) | Likely to be a medical device? | Main exposures |
|---|---|---|
| AI that reads scans or flags disease | Likely, as it has a diagnostic purpose | Injury from a missed or wrong finding, product liability |
| Triage or symptom-checker assistant | Often, depending on its intended purpose | Wrong advice acted on, data protection |
| Ambient voice scribe that summarises consultations | NHS England says generative AI summarisation is likely to qualify | Errors in clinical records, confidentiality |
| Rostering or back-office AI for providers | Usually not, unless it has a medical purpose | Customer's financial loss, data breaches |
In Great Britain, regulation 2 of the Medical Devices Regulations 2002 (UK MDR 2002) defines a medical device to include "software" intended by the manufacturer to be used for human beings for purposes such as the "diagnosis, prevention, monitoring, treatment or alleviation of disease". The intended purpose in your labelling and marketing decides it, so the same model can be a device in one product and not in another. See the MHRA's guidance on software and AI as a medical device.
Insurers will ask whether your product is a device, its class and how it is marked. A regulated device described in the policy as "software development" invites disputes; see affirmative AI cover vs silent AI.
The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024, made on 16 December 2024, apply from 16 June 2025 and add a new Part 4A to the UK MDR 2002. The MHRA's table of key changes shows that a post-market surveillance plan is now mandatory, some serious incident reports are due within 15 days rather than 30, periodic safety update reports must be given to the MHRA within 3 working days on request, and trend reporting is required.
For AI, post-market surveillance is where model drift and falling performance show up, and the same records are what an insurer or a court will examine after an incident.
The MHRA's AI Airlock, a regulatory sandbox for AI as a medical device, launched in spring 2024. Its pilot closed in April 2025, a second phase finished in May 2026, and on 6 October 2026 the MHRA announced a third phase on post-market surveillance and oversight.
The MHRA set up the National Commission into the Regulation of AI in Healthcare on 26 September 2025. Its recommendations, published on 10 September 2026, call for continuous, real-world monitoring of AI devices. Commentators note its concern that negligence claims tend to land on clinicians and providers rather than on AI makers (CMS). In its response of 6 October 2026 the government accepted all 44 recommendations, including work on allocating responsibility more clearly between manufacturers and providers, with details due by spring 2027. These are commitments, not new law.
In England, DCB0129 applies to manufacturers of health IT and DCB0160 to the organisations that deploy it. Both are information standards under section 250 of the Health and Social Care Act 2012. DCB0129 requires a proportionate clinical risk management process, safety documentation such as a hazard log and safety case, and a clinical safety officer.
NHS England says section 95 of the Health and Care Act 2022 (in force 7 July 2025) changed the duty from "have regard to" to "must comply", and section 121 of the Data (Use and Access) Act 2025 (in force 5 February 2026) lets IT providers be made subject to it. For now, bodies must continue to have regard to the standards while a national review, which identified AI governance as a gap, continues. A well-kept hazard log is one of the most persuasive documents you can show an insurer.
An NHS customer facing a claim will look to your contract, and your insurance. See AI contract clauses and indemnities.
| Incident (illustrative) | Who is likely to be pursued | Cover that may respond, subject to the policy terms |
|---|---|---|
| An imaging tool misses a tumour and treatment is delayed | The provider, which may then pursue the manufacturer in contract, negligence or under the Consumer Protection Act 1987 | Product liability for the manufacturer; medical malpractice for the provider |
| A scribe tool records the wrong medication and a patient is harmed | The practice, then the supplier | Product liability or PI, depending on the wording and device status |
| A software update corrupts appointment data and a trust pays to restore it | The supplier | PI (technology errors and omissions); cyber for data restoration |
| Patient data is exposed through a model integration | The supplier and the data controller | Cyber |
The PI and product liability boundary matters most in health: PI wordings commonly exclude bodily injury, and liability wordings commonly exclude professional advice. See AI product and public liability insurance.
See also medical technology insurance and insurance for healthtech startups.
Apex has an AI insurance scheme with an insurer in which your specific AI work, for example "AI triage software for NHS urgent care, supplied as a registered medical device" (illustrative), is written into the policy as insured activity rather than left to a generic business description. Cover options are professional indemnity, cyber, product / public liability and IP infringement, so several health AI exposures can sit in one policy, and cover for US exposure is available, subject to the insurer's underwriting and the policy terms. To quote, we need a precise description of your AI work, your address, your turnover (including how much comes from the USA and Canada) and the limit of indemnity you want; you can start an AI insurance quote online in a few minutes. See AI insurance UK and US cover for UK AI firms.
Section 3 of the Insurance Act 2015 requires a fair presentation of the risk. See what to document about your AI use.
It is if the manufacturer intends it to be used for a medical purpose, such as diagnosing, preventing, monitoring or treating disease. In Great Britain the test is in regulation 2 of the Medical Devices Regulations 2002, applied to the intended purpose you state. Northern Ireland follows the EU Medical Devices Regulation.
Usually, if the software or device could contribute to injury. Professional indemnity is mainly for financial loss and commonly excludes bodily injury, while product liability covers injury and damage caused by products you supply, subject to the policy terms. Many health AI firms need both, plus cyber for patient data.
The patient usually pursues the healthcare provider and its clinicians. NHS England's ambient scribing guidance notes a trust keeps a non-delegable duty for treatment but can still act against the supplier. The manufacturer may then face claims in contract, negligence or under the Consumer Protection Act 1987.
It depends on the contract. NHS England's guidance on its standard terms says the default requirements are employer's liability, public liability, professional indemnity for services and product liability for goods, with a default minimum of the greater of £5 million per claim or any legal minimum. Buyers using the contract and framework versions can vary them.
Not always. If you supply software and do not deliver care, PI, product liability and cyber are usually the core covers. If your business provides clinical services or your clinicians review and sign off outputs, malpractice cover may also be needed. Apex can quote it alongside an AI policy.
Tell us what your AI work is, where you are based, your turnover and the limit you need. It takes a few minutes online, and a broker will come back to you with options. Or call 0117 325 0027.
Start an AI insurance quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
