FCA authorised · FRN 724952 0117 325 0027Quote & buy →
AI insurance
AI insurance for fintech and financial services firms covers claims arising from AI used in credit, fraud detection, advice, onboarding and customer service, mainly through PI, cyber and IP cover. It matters because the FCA applies its existing rules to AI, so firms stay responsible for AI outcomes, including those from models they buy in.
Part of: AI insurance UK
In short
The FCA does not plan AI-specific rules. It applies the Consumer Duty, the Senior Managers and Certification Regime and its other principles, and says firms remain responsible for AI they develop, buy or outsource. Automated decisions now fall under UK GDPR Articles 22A to 22D, in force since 5 February 2026, and banks with internal model approval must follow PRA SS1/23 on model risk. PI usually responds to clients' financial loss from AI errors and cyber to data incidents. FCA fines cannot be insured, and AI exclusions in compulsory PI can raise capital questions.
The FCA has no AI rulebook and does not intend to write one. Announcing its review of AI in retail financial services on 27 January 2026, it said it "does not plan to introduce AI-specific regulation" and will rely on its principles-based framework, including the Consumer Duty. Its AI approach page adds that its rules "emphasise accountability for senior managers and are relevant to the safe use of AI".
That review, led by Sheldon Mills, was published on 6 July 2026 with seven priority recommendations, including adapting the regulatory perimeter and building an AI-enabled supervisory model. On 19 October 2026 the FCA published good practice and areas for improvement on AI, which creates no new requirements but states that firms are responsible for the AI systems they develop, procure and deploy, "including their outputs and outcomes", and that firms "can outsource AI services, but remain responsible for them".
| Existing framework | What it means for AI |
|---|---|
| Consumer Duty (in force 31 July 2023 for open products, 31 July 2024 for closed ones) | Test AI-driven outcomes across customer groups, including vulnerable customers, and monitor them after launch |
| Senior Managers and Certification Regime | Senior managers stay accountable for AI used in their areas; the FCA's good practice includes clear senior manager ownership of AI risks |
| Outsourcing and third-party risk | Vendor models remain the firm's responsibility |
| UK GDPR Articles 22A to 22D | Safeguards for significant decisions made solely by automated means |
| PRA SS1/23 | Model risk management for banks with internal model approval |
See Consumer Duty and PRIN 2A and SM&CR.
A Bank of England and FCA survey published in November 2024 found 75% of firms already using AI, a third of use cases implemented by third parties, and fraud detection among the most common uses. The scenarios below are illustrative.
| Use | What can go wrong (illustrative) | Who may claim |
|---|---|---|
| Credit and affordability decisions | A model update wrongly declines one customer group or approves unaffordable lending | Customers through complaints and the Financial Ombudsman Service; the lender client of a B2B fintech |
| Fraud detection | The model misses scams or blocks genuine payments | Customers; the payment firm, which since 7 October 2024 has generally had to reimburse authorised push payment fraud victims on Faster Payments and CHAPS, up to £85,000 per claim (Freshfields) |
| Guidance and advice tools | Output that is unsuitable or misleading | Customers, the Financial Ombudsman Service |
| Onboarding and KYC | Wrongful exclusion, or failing to stop financial crime | Customers, clients, regulators |
Customer-facing assistants and AI that takes actions raise their own issues; see AI chatbot insurance and AI agent insurance. For discrimination risk in credit models, see AI bias and discrimination claims.
Section 80 of the Data (Use and Access) Act 2025 replaced the old UK GDPR Article 22 with new Articles 22A to 22D, in force from 5 February 2026. A decision is solely automated if there is "no meaningful human involvement", and significant if it has a legal or similarly significant effect, which many credit decisions will. Solely automated significant decisions remain restricted where special category data is involved. Otherwise they are allowed with safeguards: telling people about the decision, letting them make representations, obtain human intervention and contest it.
Weak safeguards can lead to complaints, ICO action and civil claims, and a customer who cannot get a decision reviewed is also likely to raise Consumer Duty concerns. Keep records showing where humans review decisions, what information they see and what they can change. The FCA's good practice notes that "Human review may mask weaknesses in the model", so review needs to be real, not a rubber stamp.
The PRA's SS1/23 model risk management principles were published on 17 May 2023 and took effect on 17 May 2024. They apply to banks and building societies with permission to use internal models for regulatory capital, applied proportionately, and they cover AI and machine learning models within the general model framework. Other firms are not formally in scope, but the principles (model inventory, tiering, independent validation, monitoring) are a recognised benchmark, and a fintech supplying models to a bank may be asked to evidence them in due diligence and contracts.
The FCA requires certain firms to hold PI, including firms carrying on insurance distribution or home finance mediation (MIPRU 3) and personal investment firms (IPRU-INV 13). Account information and payment initiation service providers must also hold PI.
See IPRU-INV PI requirements and MIPRU PI requirements.
| Loss (illustrative) | Cover that may respond, subject to the policy terms |
|---|---|
| A bank client claims your credit model caused it losses | PI / technology errors and omissions |
| Customers complain that AI-driven advice was unsuitable | The regulated firm's PI, which for some firms must cover Ombudsman awards |
| Customer data exposed through an AI vendor | Cyber |
| A claim that your model or training data infringes IP | IP infringement |
| Your own fraud reimbursements or write-offs | Not usually PI, which responds to claims by others rather than your own losses |
| An FCA fine | Not insurable for FCA-authorised firms (GEN 6.1.5R) |
Senior managers' personal exposure is usually a matter for directors' and officers' cover; see D&O for financial services firms. If you have US or Canadian clients or users, see US cover for UK AI firms. For wider fintech cover, see insurance for fintech startups and PI for fintech and regtech professionals.
Apex has an AI insurance scheme with an insurer in which your specific AI work, for example "supply of machine learning credit decisioning software to UK lenders" (illustrative), is written into the policy as insured activity rather than left to a generic business description. Cover options are professional indemnity, cyber, product / public liability and IP infringement, so several AI exposures can sit in one policy, and cover for US exposure is available, subject to the insurer's underwriting and the policy terms. To quote, we need a precise description of your AI work, your address, your turnover (including how much comes from the USA and Canada) and the limit of indemnity you want; you can start an AI insurance quote online in a few minutes. See AI insurance UK.
Section 3 of the Insurance Act 2015 requires a fair presentation of the risk.
No. In January 2026 the FCA said it does not plan to introduce AI-specific regulation and relies on its principles-based framework, including the Consumer Duty and the Senior Managers and Certification Regime. Its October 2026 good practice publication says firms remain responsible for AI they build, buy or outsource, including its outcomes.
The firm, and under the Senior Managers and Certification Regime the senior manager responsible for the relevant area. The FCA says it does not expect senior managers to be technical specialists, but they must take reasonable steps to understand AI risks. Outsourcing a model does not transfer that responsibility.
It can, if the AI work falls within the insured activity and no AI exclusion applies, subject to the policy terms. PI responds to third-party claims for financial loss, such as a lender client suing a fintech supplier. It does not usually cover your own losses, and it cannot cover FCA fines.
Not if it is FCA-authorised. GEN 6.1.5R prohibits firms from entering into, arranging or claiming on insurance that indemnifies anyone against an FCA financial penalty. Some policies may cover investigation and defence costs and related civil claims, depending on the wording.
Not directly. SS1/23 applies to banks and building societies with permission to use internal models for regulatory capital, and took effect on 17 May 2024. Fintechs that supply models to banks may be asked to show they meet similar standards on validation, monitoring and documentation.
Tell us what your AI work is, where you are based, your turnover and the limit you need. It takes a few minutes online, and a broker will come back to you with options. Or call 0117 325 0027.
Start an AI insurance quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
