FCA authorised · FRN 724952 0117 325 0027Quote & buy →
AI regulation
Usually not fully: English law, FCA rules and policy wordings leave most regulatory fines for AI failures uninsured or uncertain, though defence costs and civil claims can often be insured. It matters because AI fines can be large, and the costs around them are where insurance is more likely to help.
Part of: AI insurance UK
In short
FCA penalties cannot be insured: GEN 6.1.5 R forbids it, though defence costs can be covered. For ICO, CMA and EU AI Act fines there is no clear rule; English courts apply the illegality defence, Safeway v Twigger (2010) points against recovering penalties the law means the wrongdoer to pay, and Patel v Mirza (2016) makes the answer depend on how serious and deliberate the breach was. Policies commonly cover fines only "where insurable by law". Investigation costs, breach response and civil claims are more commonly insured, subject to the policy terms.
English courts will not let a claimant use the law to recover the consequences of its own illegal act. This is the illegality defence, often called ex turpi causa. Insurance of fines raises the same question: if a policy pays the fine, the person who broke the rules does not bear the penalty.
The key case is Safeway Stores Ltd v Twigger [2010] EWCA Civ 1472, decided by the Court of Appeal on 21 December 2010. Safeway had admitted a breach of competition law over dairy pricing and faced a penalty from the Office of Fair Trading. It sued former directors and employees to recover the penalty, and the Court of Appeal held that the illegality defence defeated the claim. Longmore LJ said "the liability is, therefore, personal to the undertaking" (para 23), because the Competition Act 1998 penalises the undertaking itself. Pill LJ added that the statute's policy would be undermined if undertakings could pass the liability on to employees "or the employees' D & O insurers" (para 44). That remark was not a ruling on insurance, but the case is regularly cited when the insurability of fines is discussed.
In Patel v Mirza [2016] UKSC 42 (20 July 2016) the Supreme Court restated the defence as a balancing exercise: the purpose of the rule that was broken, other relevant public policies, and whether refusing the claim is proportionate, taking into account how serious and how deliberate the conduct was. So the answer now turns on the facts. A deliberate breach is very unlikely to be insurable; a fine for a negligent or strict-liability breach leaves more room for argument.
The position differs depending on who imposes the penalty. The fines below are the statutory maximums.
| Regulator and AI example (illustrative) | Maximum penalty | Can the fine be insured? |
|---|---|---|
| FCA: an authorised firm's AI credit model treats customers unfairly | Set by the FCA's penalty policy (FCA fines methodology) | No. GEN 6.1.5 R bars firms from entering into, arranging, claiming on or paying under insurance that indemnifies an FCA financial penalty. GEN 6.1.7 G confirms the costs of defending FCA enforcement can be insured |
| ICO: an AI tool processes personal data unlawfully | £17.5 million or 4% of worldwide annual turnover under the UK GDPR, if higher (UK GDPR Article 83; DPA 2018, s.157). The ICO says the Data (Use and Access) Act 2025 gives it the same ceiling under PECR | Unsettled. There is no direct authority on ICO fines, so it is decided case by case, with more scope where the breach was not deliberate (K&L Gates) |
| CMA: a chatbot makes misleading claims to consumers | Up to 10% of global turnover under the consumer regime in force since April 2025 (CMA) | No specific rule; the general public policy principles above apply |
| EU authorities or the Commission under the EU AI Act | Up to €35 million or 7% of worldwide turnover for prohibited practices (Article 99) | Depends on the law that applies; several EU countries treat administrative fines as uninsurable |
GEN 6.1.4A R also stops an FCA-authorised firm, other than a sole trader, from paying an FCA penalty imposed on its own staff or directors. For AI in regulated firms, see AI insurance for fintech and financial services. For the EU picture, see the EU AI Act for UK businesses.
In May 2022 the ICO fined Clearview AI Inc £7.5 million and issued an enforcement notice over its facial recognition database. On 17 October 2023 the First-tier Tribunal allowed Clearview's appeal, holding the ICO lacked jurisdiction (Burges Salmon). In October 2025 the Upper Tribunal upheld three of the ICO's four grounds, found the ICO had jurisdiction, and sent the case back to the First-tier Tribunal to hear the substantive appeal. The ICO's update of 19 December 2025 records that Clearview was given permission to appeal to the Court of Appeal, which heard the appeal in October 2026; judgment was awaited at the time of writing.
The lesson for insurance buyers is that an AI-related regulatory dispute can run for years before anyone knows whether a fine stands. The defence costs, the work of responding to the regulator and any linked civil claims are where insurance is more likely to help, subject to the policy terms.
Even where a fine is outside cover, much of the cost around it can be insurable.
| Cost | Where cover is commonly found (subject to the policy terms) |
|---|---|
| Lawyers and experts to respond to a regulator's investigation | Cyber (regulatory defence), PI investigation costs extensions, D&O for directors |
| Data breach response: forensics, notification, PR | Cyber |
| Compensation claims from people whose data was misused | Cyber privacy liability; sometimes PI |
| Client claims that your AI caused them financial loss | Professional indemnity, if your AI work is insured activity |
| The fine or penalty itself | Some cyber and liability wordings include fines "where insurable by law"; English policies commonly limit cover to fines insurable as a matter of law |
The split between fines and civil claims is explained further in GDPR fines vs civil claims: what is insurable and ICO fines and PI for professional firms.
Because the fine is the part least likely to be insured, prevention matters. The ICO says that "in the vast majority of cases" using AI involves processing likely to result in a high risk, so a data protection impact assessment is usually needed. Keep records of testing, human review and complaints handling. Article 83(2)(b) of the UK GDPR requires the ICO to consider "the intentional or negligent character of the infringement" when deciding on a fine, and the same evidence helps if the insurability of a fine is ever argued. For customer-facing tools, see AI chatbot insurance.
Apex has an AI insurance scheme with an insurer in which the policy names your specific AI work as insured activity, not a generic business description. Cover options are professional indemnity, cyber, product or public liability and IP infringement, so several AI exposures can sit in one policy, and US cover is available subject to underwriting; all cover is subject to the policy terms, and no policy can override the law on fines. To quote we need what your business does, with the AI work described precisely, your address, your turnover including the USA and Canada share, and the limit of indemnity you need. You can start an AI insurance quote online in a few minutes, or read about AI insurance in the UK.
Possibly in part, but it is uncertain. No English case decides whether ICO fines are insurable, so it is assessed case by case and depends on how deliberate the breach was. Many policies cover ICO fines only where insurable by law. Investigation costs and civil claims are more commonly insured.
No. FCA rule GEN 6.1.5 R prohibits authorised firms from entering into, arranging, claiming on or paying under insurance that indemnifies an FCA financial penalty. The costs of defending FCA enforcement action can be insured, under GEN 6.1.7 G.
It depends on the law that applies. The AI Act does not deal with insurance, and in several EU countries administrative fines are treated as uninsurable on public policy grounds. Treat the fine as uninsured and look to insurance for investigation costs and civil claims.
Generally not. In Safeway Stores v Twigger (2010) the Court of Appeal held that a company could not recover a competition law penalty from its former directors and employees, because the liability was personal to the company. Pill LJ said allowing it would undermine the statute's policy.
Many cyber policies include regulatory defence costs for data protection investigations, subject to the policy terms, the definition of claim and any AI exclusions. Check whether the investigation needs to follow a breach, and whether AI-related processing is within cover.
Tell us what your AI work is, where you are based, your turnover and the limit you need. It takes a few minutes online, and a broker will come back to you with options. Or call 0117 325 0027.
Start an AI insurance quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
