A managing partner at a small accountancy firm spent much of last year copying client tax summaries into an AI drafting tool. No breach occurred. No client ever knew. But when she pulled out her professional indemnity policy to check what would happen if something did go wrong, she found two immediate problems. The definition of “computer system” covered systems “owned or operated” by the firm. The AI tool ran on third-party servers she had never heard of. And the policy required staff to follow all written data-handling procedures. The firm had none that mentioned AI.
The UK government’s 2024 Cyber Security Breaches Survey found 50% of UK businesses experienced a cyber breach or attack in the previous year. AI tools are a growing route into that exposure. What the accountancy partner needed was a structured read of her existing wording, a short checklist, and a broker conversation.
What does checking AI insurance policy wording actually involve?
Checking AI insurance policy wording means reading your firm’s existing cyber and professional indemnity policies against the list of AI tools your business actually uses, to find definitions, exclusions, or conditions that might prevent a claim from paying out. For an owner-managed services firm, this is a structured read-through of two or three documents, plus a broker conversation to resolve any gaps you find.
Three policy types are worth checking. Professional indemnity, sometimes called errors and omissions, covers negligence in professional services. Cyber insurance covers security incidents, data breaches, and incident response. If your firm advises clients and handles their data, you likely carry both. Before reaching for the policy, build a list of every AI tool your firm uses, what data each tool touches, and which services rely on AI output. With that list in hand, reading the policy becomes a matching exercise rather than a general browse.
Why does your current policy probably miss your AI exposure?
Many cyber and professional indemnity policies were written before generative AI became a day-to-day business tool. The definitions they use for things like “computer system” or “professional services” were drafted with traditional IT infrastructure in mind. When staff use cloud AI platforms, the data flows outside those definitions. UK broker Miller Insurance has explicitly flagged this gap, advising clients to review their terms specifically for AI-related exposures.
The NCSC has published detailed guidance on generative AI risks, flagging data leakage, prompt-injection attacks, and supply-chain risks as scenarios existing cyber controls were not designed to address. These are also scenarios that older policy wordings may not name explicitly. Beyond cyber risk, the ICO treats any AI processing of personal data as subject to standard UK GDPR obligations. Failures in that area, such as the £7.5m fine issued to Clearview AI in 2022 for unlawful biometric data collection, sit outside standard policy limits. Fines imposed by regulators are excluded in almost every standard cyber and PI policy as “penalties imposed by law.”
Where do the coverage gaps tend to appear?
The riskiest gaps in AI-related cover tend to cluster in three places: the definition of “computer system” or “IT network”, which may exclude third-party cloud platforms; the scope of “professional services”, which may not explicitly include AI-assisted outputs; and the exclusions section, where fines, intellectual property disputes, and deliberate acts can swallow scenarios that look covered on a first read.
On definitions, check whether your cyber policy’s “computer system” definition includes SaaS platforms and third-party hosted services, or restricts cover to systems you own or control directly. If the wording says “systems owned, operated or used by” the insured, you are in better shape than if it stops at “owned or operated.”
On exclusions, fines and penalties imposed by law are excluded in almost every standard policy, which means ICO enforcement action sits outside the limit. For UK services firms handling EU clients with credit scoring, recruitment, or insurance underwriting tools, the EU AI Act classifies those as high-risk systems, with penalties of up to 7% of global annual turnover or €35 million for non-compliance. That is an uninsured exposure under standard commercial wordings.
A less visible risk is shadow AI. Security and governance specialists have reported that over 70% of employees in some organisations use AI tools that have not been sanctioned by their employer. If your policy requires staff to follow written security procedures and your written procedures say nothing about AI, an insurer can argue that unsanctioned AI use was a breach of a warranty condition even before a claim arises.
When does a gap matter enough to act on?
A gap matters most when the AI scenario is realistic for your firm and the financial exposure is meaningful. If your broker confirms the wording is genuinely ambiguous, that warrants a follow-up. For firms using AI only to draft internal memos with no client data involved, the practical risk is low. For any firm using AI in client-facing work or handling personal data, the conversation should happen before the next renewal.
A useful test is to write out two or three realistic scenarios. For example: a staff member pastes client financial data into a public AI model and it leaks; an AI-assisted report contains a material error that a client acts on; an AI recruitment screening tool is alleged to discriminate. Send those to your broker and ask how the current wording would respond. If your broker cannot confirm coverage, the options are an endorsement to clarify language, adjustments to internal controls, or moving to an insurer whose form better reflects an AI-enabled business.
What else should be in place before you renew?
The wording check works best when you already know what AI your firm uses and have a short written policy governing it. Insurers are increasingly asking about this on proposal forms, and mis-disclosure can justify a claim denial under the Insurance Act 2015. A brief acceptable-use policy, a list of approved tools, and a note of which client data each tool touches will take a day and materially strengthen your position at renewal.
Two related concepts are worth having a handle on before that conversation. The first is the retroactive date on your PI policy, which sets how far back claims can reach. If AI became part of how you deliver services two years ago and your retroactive date is more recent than that, earlier work may sit outside cover. The second is vendor contracts. Major AI platforms typically disclaim liability and cap their exposure sharply in their terms. If you are promising clients outcomes that depend on those platforms, the gap between what the platform promises you and what you promise your client is risk you carry. That risk is only insurable if your PI wording explicitly addresses it.
The accountancy partner from the opening ended up with one endorsement on her PI policy and a two-page AI acceptable-use document her team actually uses. It took two broker conversations and an afternoon of internal work. The cover she has now reflects the business she actually runs. If yours does not, renewal is the moment to fix that.
