The most AI-intensive sector in UK finance. And the most exposed.
Insurers use AI in pricing, claims, underwriting and service more than any other financial sector — the Bank of England found 95% adoption.
of UK insurers use AI (Bank of England/FCA, 2024)
use cases expected per firm within three years, up from nine (Bank of England/FCA, 2024)
rate data protection as a large constraint on AI (Bank of England/FCA, 2024)
Accountability stays with a named person.
PRA SS1/23 (April 2026) applies to AI and vendor models used in pricing, claims and underwriting; responsibility sits with a named SMF holder. Health data in claims is special-category data under UK GDPR, where the automated-decision reforms do not relax the rules.
Regulator statements summarised from the published guidance; see the sources on the Problems page. This supports compliance; it is not legal advice.
- Claims triage and document extraction
- Underwriting support and summarisation
- Customer service chat and voice
- Fraud indicators
- Special-category data (health) in prompts
- Pricing and claims models without a documented human check
- Vendor AI inside policy administration systems
Gateway redaction for health and financial data. Rules with named exclusions for claims and pricing decisions. Change Control and sandbox testing before any model switch. Evidence Packs mapped to ISO/IEC 42001 and UK GDPR.
Four agents, trained for this sector.
The rules, as controls.
- FCA Consumer Duty
- PRA expectations
- ICOBS
- UK GDPR (special-category data)
- PCI DSS
Issues detected · needs attention first
| Issue | Rule | Severity | Owner | Status |
|---|---|---|---|---|
| Payroll file uploaded to an external AI tool | R-15 | High | HR Director | Blocked · reviewed |
| 31 personal AI accounts found in Sales | R-02 | High | Head of Sales | Migrating · 27 done |
| Customer data in a prompt without redaction | R-01 | High | Ops lead | Redacted · 0 left |
| Premium model used for internal drafts · 412 requests | R-07 | Medium | Engineering lead | Rerouted |
| CRM "AI assist" running without a DPIA | Policy | Medium | Head of Sales | DPIA in progress |
| Agent attempted an external email | R-12 | Low | S. Reid | Held · approved |
| Job | Owner | RAG | Effort | Cost to date | Forecast | Actual | Variance | Return / yr | Status |
|---|---|---|---|---|---|---|---|---|---|
| Migrate personal accounts to managed | IT Director | 12 d | £4,200 | £6,000 · 20 d | £4,200 · 12 d | −£1,800 · −8 d | risk | Done | |
| Route everyday tasks to standard tier | FD | 3 d | £900 | £1,200 · 4 d | £900 · 3 d | −£300 · −1 d | £58,400 | Done | |
| Payroll upload block (R-15) | HR Director | 1 d | £300 | £300 · 1 d | £300 · 1 d | 0 | risk | Done | |
| Collections letters via Comms agent | Head of Collections | 18 d | £11,600 | £14,000 · 25 d | — | on track | £96,000 | In progress | |
| KYC document checks | Head of Onboarding | 9 d | £5,100 | £9,000 · 15 d | — | on track | £61,000 | In progress | |
| Contact-centre adviser assist | Head of CS | 26 d | £19,800 | £16,000 · 20 d | — | +£3,800 · +6 d | £142,000 | At risk · vendor delay |
Effort, cost and return are recorded against each job as it happens. Done means the job is solved in production with its owner’s sign-off, not that a licence was bought.
From this sector.
We use a vendor claims platform with AI built in. Is that covered?
Yes. Register finds AI features inside vendor systems and puts them in the same register with an owner, a purpose and a data classification.
Where does our data go?
Nowhere new. Everything runs inside your own cloud account. Nothing routes through GenWA's infrastructure. Sensitive data is removed before a request leaves your environment.
Find out where your AI stands. Then decide.
Under a minute, an upload, or a visit. Something for the board either way.