An owner I spoke with last month has her professional indemnity renewal in eight weeks. The firm has been using AI tools for research and first drafts for over a year, the same way many of her peers have. She has never once mentioned this to her broker, and she has never asked whether her current cover responds to a claim where AI was involved in the work. Her assumption, like many owners’, is that nothing has changed. The policy is the policy.
The policy is not quite the policy. Mainstream SME insurance was largely written before AI use became normal in small business, and the coverage for AI-related incidents is patchy, often unclear, and frequently surprises owners who assumed their professional indemnity or cyber policy had it covered. The conversation with the broker is overdue. It is also short, once you know what to ask. This post is the working version of that conversation. None of it is insurance advice on your specific policy.
Which insurance policies actually touch AI exposure?
Five categories carry the weight for an SME. Professional indemnity covers claims that your advice caused a client a financial loss. Cyber covers data breach and business interruption. Public liability covers third-party injury or damage from your operations, including customer-facing chatbots in some readings. Errors and omissions sits next to PI for commercial firms. Directors and officers covers personal board liability.
The relative weight depends on the business. A management consultancy or a financial adviser leans heavily on professional indemnity. An e-commerce business with an AI-driven recommendation engine cares more about public liability and product liability. A software-services firm relies on errors and omissions. Almost every owner-operated business carries some cyber exposure now, because almost every business has staff who may at some point paste a piece of client data into a public AI tool to save twenty minutes.
What do current policies typically do and do not cover?
Many mainstream UK policies in 2025 remain silent on AI-assisted work, which insurers do not treat as the same thing as covered. Silence creates ambiguity, and ambiguity gets resolved at claim time. Some insurers have begun adding explicit AI exclusions for autonomous decision-making without human oversight, others are asking detailed underwriting questions, and a small number have written AI-inclusive wording.
The pattern varies sharply between lines. Cyber insurers like Beazley have moved fastest, publishing 2024 guidance that ties continued cover to documented AI governance and naming generative AI explicitly as a material risk. Professional indemnity has moved more slowly, with many insurers still relying on silence in the wording. Public liability is the murkiest, with chatbot misrepresentation cases sitting in an unresolved space between product liability and professional service. D&O cover for AI-deployment decisions remains an open question across the UK market, and a director who deploys an AI system without proper governance can find that the policy responds far less generously than expected if a shareholder or regulator challenges the decision.
What are insurers actually asking SMEs now?
A growing number are asking detailed AI questions at underwriting and renewal. Hiscox, AIG and Beazley have moved to structured questionnaires that ask which AI tools the business uses, what data flows through them, whether employees have been trained, and whether there is documented human oversight of material outputs. The questions are not theatre. The answers shape cover, exclusions and price.
This is the practical shift. Black-box underwriting, where the insurer prices the risk on industry, revenue and claims history, is giving way to white-box underwriting, where the insurer assesses the specific business practices around AI use. For owners this means that renewal is no longer a passive exercise of accepting last year’s terms. It is an active conversation in which what you say about AI use directly affects what you are covered for. Some insurers now reference the NIST AI Risk Management Framework or ISO/IEC 42001 as benchmarks for acceptable governance, and an SME that has aligned to those frameworks can sometimes negotiate coverage extensions or pricing improvements. The Lloyd’s Market Association has begun work on standardised model clauses that will, over time, make the questions more consistent across the market.
What are the five questions to ask your broker?
Ask all five in writing at renewal and hold the answers on file. One, does my professional indemnity or E&O policy explicitly cover AI-assisted advice, and on what conditions? Two, does my cyber policy cover data exposure from staff use of public cloud AI tools? Three, does my public liability policy respond to claims arising from chatbot misrepresentation or automated decision errors?
Four, does my current policy contain any AI-specific exclusions, and if so what use cases are excluded? Five, does the insurer require disclosure of my AI use as a material fact, and am I currently compliant with that obligation? The format matters as much as the questions. Written questions and written answers create a record of the insurer’s understanding of cover. That record, sitting in the file alongside a documented governance note about how the business uses AI, is what closes the gap between what an owner thinks the policy says and what an insurer will pay against. Insurance is a contract of utmost good faith. If an insurer can later show that a material fact about AI use was not disclosed, even an otherwise responsive policy can be set aside.
When should you buy specialist AI insurance, and when can you leave it alone?
For a typical SME in the 5 to 50 person bracket the answer is leave it alone. Specialist products from Munich Re aiSure, Armilla, Vouch and Lloyd’s participants are real and growing, but they are sized for businesses with substantial documented AI exposure. The usually sufficient move is to ask the broker to identify gaps and propose targeted wording amendments rather than a separate policy.
Specialist cover starts to earn its keep at the point where AI is central to the service the business sells, not when AI is helping with research and drafting in the background. The clearest trigger is a customer-facing AI system that influences third-party decisions or outcomes. A chatbot giving allergen information to restaurant customers, an automated scoring tool inside a recruitment service, an AI-driven recommendation engine on an e-commerce platform. For owners running operations of that shape, the conversation about specialist cover is worth having properly. It sits beside the work covered in the proportionate AI risk register for a 5 to 50 person business, and beside the disclosure question covered in disclosing AI use to customers.
If your professional indemnity renewal is closer than you would like and you have never had this conversation with your broker, book a conversation.
