A solicitor using AI to draft client letters. An accountant whose tool pulls in client data to generate reports. A consultant who relies on an AI model to flag risks in a contract review. All three are using technology that their current insurance policies may or may not cover, depending on wording they probably haven’t read since they renewed.
The question that founders in professional services keep asking is some version of: “Do I need AI insurance?” The answer is almost always the same. AI does not create a new insurance category. What it does is redistribute where losses land, and if you haven’t checked whether your existing policies still fit, there’s a gap worth closing.
What choice are you actually facing?
The decision for a UK SME owner isn’t whether to buy AI insurance. The policies sold under that label are rare, expensive, and often redundant if your PI and cyber cover is properly worded. The real choice is understanding which of your existing policies covers which AI-related failure mode, and whether your current cover is accurately disclosed.
For a services firm using AI in client-facing work, the relevant policies are typically professional indemnity, cyber, public and product liability, and employer’s liability if you have staff. Which one matters most depends on what the AI actually touches: advice and output, personal data and systems, physical processes, or your people.
When professional indemnity is the policy to check
If your business uses AI to produce anything a client relies on, PI is almost always the first policy to examine. Professional indemnity covers claims for financial loss caused by professional advice, errors, omissions, or faulty output. If an AI tool drafts a document, generates a recommendation, or flags a risk and gets it wrong, and a client suffers a financial loss as a result, that claim lands on your PI policy first.
UK brokers are already adjusting their underwriting questions for this. CFC Underwriting notes that insurers are asking SMEs whether AI-generated outputs are reviewed by a human before delivery to clients, whether records of that review are kept, and whether AI use is disclosed. Undisclosed AI use can complicate or void a claim regardless of whether the underlying cause was the AI or the professional. If your renewal form doesn’t yet ask about AI, answering truthfully in your disclosure is still the right move.
When cyber insurance is the relevant cover
Cyber insurance becomes the primary policy when the AI incident involves data rather than advice. A breach of personal data processed by an AI tool, ransomware introduced through an AI-connected system, a supply-chain compromise through an AI vendor, or a system outage that interrupts your operations: these all route through your cyber policy rather than your PI.
That matters because many AI tools touch personal data. Customer records, prompt inputs, staff information, client files. The ICO’s guidance on AI and data protection is clear that organisations must be able to explain and justify AI use, assess risks, and maintain appropriate controls where personal data is involved. A failure on any of those fronts can produce a double exposure: ICO scrutiny and a private compensation claim running at the same time, with your cyber policy covering the defence and response costs of the latter. Chubb’s SME cyber guide sets out what typical policies cover (breach response, forensic investigation, legal advice, and business interruption) and what they commonly exclude, including some outsourced-provider incidents and events with no underlying security breach.
What it costs to get the call wrong
The real cost of choosing the wrong policy is rarely the premium itself. The ABI’s SME Insurance Guide makes clear that businesses facing an uninsured claim absorb legal defence, rectification work, client compensation, and the management time consumed by a dispute, costs that frequently outweigh the original incident. Routing a PI claim through a cyber policy, or vice versa, puts a coverage dispute ahead of any payment.
There is also a regulatory layer specific to AI. For UK SMEs supplying services to EU customers, the EU AI Act introduces obligations on providers and deployers of AI systems used in the EU. Where a policy excludes regulatory fines, a non-compliance finding against an EU client’s AI system you contributed to can become an uninsured loss. The NCSC’s AI security guidance adds a further dimension: firms that cannot demonstrate basic controls, access restrictions, logging, human oversight, incident response, may find their insurer narrows terms, increases excesses, or declines cover altogether at renewal.
Employer’s liability sits slightly apart. If you have staff in the UK, the ABI confirms this cover is legally required with a statutory minimum of £5 million. AI-related workplace harm, from discriminatory allocation tools to unsafe automated processes, doesn’t remove that obligation or the routes through which a claim can be brought.
What to ask before you decide
Before buying anything new or renewing what you have, the useful questions are operational rather than product-led. What does your AI actually touch: client advice, personal data, physical processes, or internal operations? Who reviews AI outputs before they reach a client, and is that review documented? Have you disclosed your AI use to your current broker, and does your policy wording reflect it?
The FCA’s approach to AI in financial services, relevant even to firms not directly regulated, emphasises governance, explainability, and evidence of human oversight as the markers of acceptable AI use. Insurers and larger clients are applying the same lens. A firm that can show a clear trail of human review and documented controls is a better risk and a more credible counter-party than one that relies on the AI tool’s own assurances.
The Geneva Association’s 2025 survey of 600 corporate respondents found that firms are still developing their approaches to AI risk perception and transfer. That pattern holds for SMEs too. For any firm where board-level decisions govern AI adoption, directors’ and officers’ cover is worth adding to the list. Board-level choices on which tools to deploy, which data to process, and what controls to apply can create personal liability if those decisions lead to harm and the governance trail is thin.
For many UK SMEs in professional services, the practical answer is a review and disclosure update rather than a new policy. PI plus cyber covers the scenarios most likely to arise from advice-output and data-system failures. A broker with recent AI claims experience is worth more than a product labelled AI insurance. The question worth spending time on is what your AI actually does in your business, because that’s what your insurer will ask you when a claim lands.
