FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: IT consultants and developers
UK IT consultants and developers have no statutory regulator, so AI work is judged against the BCS Code, voluntary government security codes, data protection law and client contracts. Those benchmarks decide whether an AI-related failure looks negligent, and so whether a claim lands on your professional indemnity policy.
Part of: AI in IT consultants and developers
In short
IT consultants and developers in the UK have no statutory regulator and no compulsory PI requirement. AI use is shaped instead by the BCS Code of Conduct, the voluntary AI Cyber Security Code of Practice, the Software Security Code of Practice, NCSC secure AI development guidelines, UK GDPR (including new automated decision-making rules from 5 February 2026) and client contracts, including PPN 017 terms for public bodies. Medium and large managed service providers face new duties under the Cyber Security and Resilience Bill if it passes. Technology PI usually responds to negligent AI-assisted work, subject to the wording.
AI now sits inside most stages of technology delivery. Developers use AI coding assistants to suggest and refactor code, write tests and explain unfamiliar codebases. Consultants use generative AI to draft requirements, architecture notes and client reports. Managed service providers use it to triage tickets and generate remediation scripts. A growing share of firms also build AI for clients: customer-facing chatbots, integrations with third-party large language models, agents that can act inside business systems, and decision engines for credit, HR or eligibility.
That gives IT firms two distinct exposures. The first is using AI to do ordinary work faster, where the risk is that an AI error passes unchecked into a deliverable. The second is building or selling AI, where the client relies on the system itself and its failures become your failures. Both can lead to professional negligence claims, and both are judged against the same question: what would a competent IT professional have done?
No statutory regulator licenses IT consultants or software developers. The nearest thing to a professional rulebook is the BCS Code of Conduct, which binds members of BCS, The Chartered Institute for IT. It does not mention AI, but its duties apply to AI work in the same way as any other work: 2.1 (only take on work within your competence), 2.4 (know and comply with relevant legislation), 3.1 (due care and diligence), 3.3 (accept responsibility for your own work and the work of colleagues you supervise), 3.4 (do not disclose confidential information) and 3.5 (do not misrepresent performance information).
The ICO regulates personal data in AI systems and has an AI guidance hub. On 8 October 2026 it opened a call for evidence on agentic AI, warning that "the fact AI agents act with autonomy is not an excuse for poor compliance", and said a statutory code of practice on AI and automated decision-making is forthcoming. Under the Cyber Security and Resilience Bill, the ICO (to become the Information Commission) would also regulate in-scope managed service providers.
DSIT and the NCSC have published three documents that a court or expert witness could treat as evidence of good practice, even though none is binding.
Our guide to the UK AI security codes explains each one in plain English.
Most AI claims against IT firms are likely to look like familiar technology claims with a new cause. Typical patterns include:
The ICO's conclusion of its Snap "My AI" investigation in May 2024, which it called a "warning shot", shows the regulatory expectation: assess data protection risk before deploying generative AI. No UK court decision on the liability of an IT consultant or developer for AI-generated code or an AI system failure has yet been found.
There is no statutory or BCS requirement to hold PI. The level and terms of cover are usually set by client contracts, and public sector terms under PPN 017 may add AI and data clauses. Technology PI (sometimes called tech E&O) commonly responds to claims alleging negligence, breach of professional duty or failure of your software or services, and many wordings do not distinguish between work done by hand and work assisted by AI. Whether a particular AI loss is covered depends on the wording, any AI or cyber exclusions, contractual liability terms and what you told insurers at inception.
Data breaches and system outages often sit across both PI and cyber insurance, so the boundary matters. Our IT consultants PI guide covers the basics, and does tech PI cover AI failures? looks at silent AI and new exclusions.
Apex arranges technology PI and cyber cover for IT consultants, developers and managed service providers. A broker reviews your cover against the AI work you actually do and checks how your policy treats AI-assisted and AI-built deliverables.
No statutory regulator covers IT consultants or developers. BCS members are bound by the BCS Code of Conduct, the ICO regulates personal data in AI systems, and DSIT and the NCSC publish voluntary security codes. Client contracts, including PPN 017 terms for public bodies, add further obligations.
No. The BCS Code of Conduct does not mention AI. Its general duties still apply to AI work, including competence (2.1), compliance with legislation (2.4), due care (3.1), responsibility for your own and supervised work (3.3), confidentiality (3.4) and not misrepresenting performance (3.5).
There is no statutory or BCS requirement. In practice most client contracts require PI at a stated limit, and many public and enterprise clients will not contract without it. Contracts may also include AI and data clauses, so check what your policy needs to match.
No. The AI Cyber Security Code of Practice, the Software Security Code of Practice and the NCSC secure AI development guidelines are voluntary. They can still be relevant evidence of what a reasonably competent IT professional would do if a negligence claim is brought.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
