This week's CPA Practice Advisor analysis of AI indemnification from Microsoft, Google, OpenAI and Anthropic exposes a critical gap that should worry every UK regulated firm. Yes, these vendors commit to defending you against certain IP infringement claims. But — and this matters deeply — indemnity for copyright suits is not the same as liability cover for professional negligence, regulatory breach, or client harm. When an accountant relies on Microsoft Copilot or an OpenAI model and that system hallucinates a tax position, the indemnity clause does not cover the mistake. It covers the model's training data. Those are entirely different things. For firms operating under FCA Consumer Duty PS22/9 or facing SRA Code obligations, that distinction is not academic. It is the difference between sleeping at night and losing a practice.

What this story reveals is the industry's deeper problem: we have normalized the idea that AI risk can be outsourced to vendors. It cannot. The regulatory regime in the UK — including the ICO's GDPR enforcement, the PRA's SS1/23 guidance on model risk, and the incoming EU AI Act compliance obligations — places accountability on the firm using the AI, not on the platform provider. When Luminance or Harvey process legal documents and those documents contain errors, the law firm remains liable to the client. When an insurer uses a large language model to assess claims and the model misses a coverage issue, Lloyd's Blueprint Two governance requirements still fall on the insurer's board. Indemnification from the vendor is a comfort blanket. The regulators will still look at you.

At Trovix, we take a deliberately different approach. Rather than asking whether we can transfer risk to a big tech vendor through a contractual indemnity, we design systems that are inherently auditable, locally governed, and aligned with professional liability frameworks from the start. Trovix Audit builds governance and compliance tracking directly into the AI workflow so that every decision point is logged and defensible — not retrospectively, but in real time. When you deploy Trovix Sift for document intelligence or Trovix Aria as a knowledge assistant, you own the audit trail. You can show regulators, clients, and insurers exactly what the system did and why. That is not indemnity. That is control.

For a mid-market accountancy firm, law firm, or financial services outfit, the action is clear. First: do not sign a contract with any AI vendor — large or small — on the assumption that their indemnity clause covers your professional liability. It does not. Second: audit what indemnity actually covers. Read the exclusions. In almost every case, you will find that IP infringement is covered and everything else — errors, omissions, regulatory breach — is your problem. Third: demand transparency. Insist on systems where you can see, test, and govern the AI before it touches client work. If a vendor cannot provide audit trails, model cards, or confidence scores, they are asking you to take a leap of faith on their behalf. Do not take it.

Source: CPA Practice Advisor