Verisk Analytics' Insurance Services Office has quietly handed the insurance industry a capitulation notice. When major insurers start excluding losses from generative AI use via boilerplate policy language, they are not setting careful boundaries—they are admitting they cannot price or manage the risk properly. This matters acutely to UK-regulated firms in insurance, law, accountancy and financial services. The FCA's Consumer Duty (PS22/9) and the PRA's AI guidance expect firms to understand what their third-party tools actually do. But when your insurer tells you 'we do not cover AI-related claims,' they are telling you they have not done that work either. The coverage gap is not an accident. It is an admission of failure.

This story is part of a wider pattern: the insurance industry has moved faster at banning AI than understanding it. Over the past eighteen months, we have seen a rush to 'manage' AI risk through exclusion rather than integration. Lloyd's of London's Blueprint Two emphasises responsible AI adoption—but exclusions work backwards from that principle. They protect insurers from pricing uncertainty, not from genuine risk transfer. The same insurers now excluding AI claims are themselves deploying AI tools in underwriting, claims and customer service. The logic is broken: if generative AI is too risky to cover in a policy, why is it safe enough to run your own operations on? This double standard is what happens when risk management is built by legal teams reacting to headlines rather than by teams with operational intelligence.

Trovix's view is straightforward: the real risk is not generative AI itself. The risk is generative AI deployed without governance. A law firm using Harvey or a financial services firm using Luminance without proper controls, audit trails, output validation and decision frameworks—that is genuinely uninsurable. But the same tools used within a mature AI governance structure, tested for your specific use case, with documented controls and human oversight, is manageable risk. The problem is that most mid-market firms using these products have no systematic way to prove that governance to an underwriter. They cannot show their audit trail. They cannot show their testing protocols. They cannot show their decision logs. Broad exclusion clauses emerge because underwriters have no mechanism to assess whether a firm is the first category or the second. This is not a failure of AI. It is a failure of governance visibility. Trovix Audit exists precisely to create that visibility—to give underwriters and regulators the evidence they need that your AI use is governed, not just deployed.

If you manage an insurance firm, law practice, financial services outfit or accountancy business, you need to act now on two fronts. First: do not respond to AI exclusion clauses by restricting your AI use. Respond by documenting it. Build an AI governance record that proves your controls work. That record becomes your insurance argument, your regulatory defence under FCA rules and SRA Code requirements, and your competitive advantage. Second: when you evaluate AI tools—whether intake automation, document review, regulatory monitoring, or client-facing assistants—choose products and vendors who understand governance is not optional. Insist on audit trails. Insist on output testing. Insist on human decision frameworks. The firms that will keep their broad insurance cover are not the ones who avoid AI. They are the ones who can prove they manage it. Verisk's exclusion language is a warning that the industry is moving past the 'what is AI?' phase. You need to be in the 'how is AI governed?' phase now.

Source: Bloomberg Law