FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: IT consultants and developers
If AI-suggested code you ship contains a bug or vulnerability, the client will usually treat it as your defect, because you chose to accept and deliver it. For developers, AI coding assistants change the speed of work but not the duty to review it.
Part of: AI in IT consultants and developers
In short
AI coding assistants can propose whole functions in seconds, but the developer who accepts and ships the suggestion owns the result. BCS Code duties to work only within your competence (2.1) and to accept responsibility for your own and supervised work (3.3) apply unchanged. The Software Security Code of Practice expects vendors to ship secure software whoever wrote the first draft. Technology PI usually treats a negligent defect from an AI suggestion like any other coding error, subject to the wording, so the practical focus is review, testing and records of how code was accepted.
Most development teams now use an AI coding assistant inside the editor. It completes lines, writes boilerplate, proposes tests, translates between languages and explains legacy code. Used well, it removes repetitive work. Used carelessly, it produces code that compiles, passes a quick glance and still contains a logic error, an outdated library call or an injection flaw. The risk grows when junior developers accept suggestions they could not have written themselves, or when review is squeezed because output looks finished.
There is no statutory regulator for developers, but members of BCS are bound by the BCS Code of Conduct. Clause 2.1 says only take on work within your competence; accepting AI code you cannot evaluate sits uneasily with that. Clause 3.3 requires you to accept responsibility for your own work and for colleagues you supervise, which covers code a team member accepted from an assistant. Clause 3.4 prohibits disclosing confidential information, relevant if client code is sent to an external AI service.
The voluntary Software Security Code of Practice sets 14 principles software vendors are expected to implement, and the AI Cyber Security Code of Practice adds supply chain and testing expectations where you build AI systems. Neither carves out machine-written code.
Illustrative scenario: a small agency builds an online booking system for a client. A developer accepts an AI-suggested database query that concatenates user input. Code review is a quick skim before a deadline. Months later the client suffers a data breach through that query, faces regulatory attention and customer complaints, and claims its costs from the agency, alleging the code fell below the standard of a competent developer.
Other patterns include AI-suggested dependencies that are out of date or do not exist, licence-incompatible snippets, and subtle calculation errors in financial or pricing logic that only surface after go-live. Our page on software delivery and project failure claims covers how such disputes usually unfold.
Technology PI is generally written around negligent acts, errors and omissions in your professional services. Many wordings say nothing specific about AI, so a defect introduced by an AI suggestion is commonly treated in the same way as one typed by hand. The usual questions are whether the claim alleges a breach of professional duty, whether a contractual liability, warranty or cyber exclusion applies, and whether the loss falls within the limit and excess.
There is no statutory or BCS PI requirement for developers; limits are usually set by client contracts. A breach caused by your code may also touch cyber cover, so it helps to understand how the two policies interact. Some wordings may include AI-specific language; see does tech PI cover AI failures?.
Apex arranges technology PI for developers and IT consultancies. A broker reviews your cover and how your policy treats defects in AI-assisted code. For related risks see vibe coding client apps, IT claims examples and the IT consultants AI hub.
Usually the client will look to you, because you delivered the code. Under BCS Code clause 3.3 you accept responsibility for your own work, and contracts rarely distinguish how code was written. Liability then depends on whether the defect falls below the standard of a competent developer and on your contract terms.
Many policies do not mention AI, so AI-assisted code is commonly treated like any other work, subject to the wording. Insurers may add AI-specific clauses, so check your schedule and wording rather than assuming, and tell your insurer about material changes in how you work.
Check the contract first. Some clients, including public bodies using PPN 017, may ask suppliers to declare AI use in service delivery, and contracts may restrict sending client data or code to AI tools. Being transparent also reduces arguments later about what was agreed.
Records of your review process are the most useful: pull request approvals, test results, security scan outputs and notes of who accepted the change. They help show the defect got through despite reasonable care, which is the question a negligence claim turns on.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
