John Doyle is right to be worried. When insurance policies use language like 'losses arising from AI' or 'autonomous agent failures' without definition, they create a legal minefield for mid-market UK firms operating under FCA Consumer Duty PS22/9 and SRA Code obligations. A law firm rolling out an AI document review tool, a financial services firm using machine learning for AML screening, or an accountancy practice automating tax research cannot afford ambiguity about whether they are covered when something goes wrong. The real risk is not that exclusions exist — it is that they are so vague that a dispute becomes inevitable when a claim lands. Regulators and courts will eventually force clarity. Better that this happens now, in the policy draft phase, than later in a contentious claims decision.

This story is a symptom of a much deeper industry failure. Insurance companies, brokers like Marsh, and the law firms advising them have spent two years watching generative AI transform their clients' operations — and they have responded by reaching for the easiest option: broad exclusions. The same thing happened with cyber insurance ten years ago, and it took years to untangle. The problem is that 'AI' is not a single risk. A hallucination in a Harvey contract review tool poses a different exposure to a Luminance document classification error, which poses a different exposure to a rogue LLM agent making unsupervised decisions. Each has different likelihood, impact, and mitigation surfaces. Lumping them all into one exclusion clause is not risk management — it is regulatory evasion that creates a coverage cliff for firms that genuinely need protection.

At Trovix, we believe the answer is the opposite of what the insurance market is doing right now. Instead of broad exclusions, insurers and their clients need AI governance frameworks baked into policies. Which firms get coverage, and at what price, should depend on whether they have real governance: documented AI use registers, model validation workflows, human-in-the-loop controls, audit trails for material decisions, and demonstrable compliance with ISO 42001 and emerging EU AI Act requirements. This is not an opinion — it is how the PRA SS1/23 guidance on model risk management expects regulated firms to work. A policy that excludes 'AI losses' to a firm without governance is worthless to everyone. A policy that insures a firm with documented AI governance is both insurable and defensible. Trovix Audit exists precisely because firms need to prove governance to insurers, regulators, and their own boards — not to hide behind exclusions.

If you are a mid-market law firm, insurer, financial services firm, or accountancy practice, the time to move is now. Do not wait for your broker or renewal process to spring this on you. Audit your AI inventory: what tools are you actually using, what decisions do they influence, what could go wrong, and what evidence do you have of governance? Work with counsel and your insurance broker to articulate AI-specific coverage needs, not blanket exclusions. Expect insurers to demand governance proof — auditable dashboards, documented controls, human oversight for material decisions — before they will price AI-related cover fairly. This is uncomfortable. It is also inevitable. The firms that move first to transparent AI governance will find coverage available at reasonable rates. The firms that wait for clarity to be forced upon them will find themselves either uninsured or paying a penalty premium.

Source: Insurance Journal