Bloomberg Law reported last month that insurers including those benchmarking against Verisk Analytics' Insurance Services Office are embedding AI exclusions into commercial general liability and professional indemnity policies. For UK law firms, accountancy practices, financial services firms and insurers themselves, the practical impact is stark: if your AI system generates a defective analysis that causes client loss, your professional indemnity policy may now have a carve-out that denies coverage. The FCA's Consumer Duty (PS22/9) and the SRA Code both require firms to manage technology risk. But these new exclusions make that risk harder to quantify, harder to insure, and—critically—harder to demonstrate you've managed it proportionately. This is not a minor policy tweak. This reshapes the cost structure of AI adoption for any mid-market firm.

The exclusion trend reflects something deeper: the insurance industry has not kept pace with AI governance maturity. Instead of underwriting firms that can demonstrate robust AI controls (ISO 42001 certification, vendor due diligence, RAG systems with auditable sources), insurers are using blunt exclusions. This is the easier commercial path. But it reveals a market failure. Firms that implement AI carefully—with proper testing, guardrails, and human review—are being priced or excluded alongside those that deploy ChatGPT on live client data with no oversight. The EU AI Act's risk-based framework and the ICO's own AI governance guidance both assume that organisations can demonstrate AI risk management proportionate to harm. Insurance exclusions punish this approach rather than reward it.

Trovix's perspective is that this moment exposes a hard truth: generic large language models connected to your entire file system are not the answer. The rush toward solutions like Microsoft Copilot or Harvey—which offer breadth but not auditability—has created precisely the uncertainty that insurers fear. Firms need AI that is defensible in a coverage dispute. That means RAG-based assistants with explicit source attribution, document extraction systems that can be validated against benchmarks, and intake automation that creates an audit trail. Trovix Aria and Trovix Sift are built on the principle that every output must trace back to a source or a rule. That transparency is what insurers should underwrite—and what regulators (FCA, SRA, PRA) expect you to demonstrate.

What should you do now? First, audit your current AI use against your policy wording. Call your broker. Many policies have not yet been reworded, but renewal notices will carry exclusions. Second, if you are not already, move toward AI systems that produce auditable work product. Document extraction, matter intake, and knowledge assistance are the three areas where regulated firms see the highest ROI and the lowest risk—provided you can show your working. Third, start building your own AI governance framework now, because insurance will no longer carry the weight. ISO 42001 certification is achievable within 12 months and will become table stakes. Finally, do not wait for policy language to stabilise. It won't. Firms that treat AI as 'someone else's problem' after deployment will face both insurance gaps and regulatory scrutiny under the Consumer Duty.

Source: Bloomberg Law