For most professional firms, the first outside party to ask in writing how generative AI is governed will not be a regulator or a client. It will be the professional indemnity (PI) underwriter, at renewal, with a premium attached to the answer. The evidence below comes mostly from solicitors, but the same pattern applies to accountants, architects and consultants on their E&O renewals.
The questions arrived on the renewal form before most firms had an answer ready
The shift has been fast. In May 2024, a legal consultant at the broker Howden wrote in guidance published by Bristol Law Society that firms “might not find questions about AI on PII proposal forms yet,” while cautioning that any AI tool with a significant effect on the practice must be disclosed as “material information.” Less than two years later the forms had caught up. At the Law Society’s risk and compliance conference in March 2026, one firm owner told the Law Society Gazette: “I couldn’t believe the number of questions on the renewal form this year about AI use.” The questions covered policies, risk plans, and what staff were actually doing with the tools.
Brokers at the same event described what sits behind those questions. Marc Rowson of Lockton said insurers concentrate on three areas — accuracy of work, data security, and the precautions in place — and that “They want to see where is the human element of verification and security.” Arjun Rohilla of Paragon said insurers want clear answers about AI use rather than vague terms such as “experimenting.” A compliance consultant expected the opening question to be “do you have an AI policy,” followed by whether the firm’s compliance officer for legal practice (COLP) had input into it.
The market is organising its questions deliberately. In September 2025 the Lloyd’s Market Association (LMA), the body representing managing agents at Lloyd’s, published a report on the impact of generative AI on the international errors and omissions (E&O) market. It names liability for errors, data protection breaches, and regulatory challenges as the exposures created by reliance on generative AI, and it gives underwriters “example questions to assess AI-related exposures” alongside “considerations for policy wording.” The LMA’s framing is explicit: “Underwriters must ask the right questions to assess risk fairly.” A firm that cannot present its AI use fairly is, in insurance terms, a firm that has not disclosed it.
Underwriters are auditing governance because they cannot yet price the technology
The reason the form reads like an audit is structural. Insurers price risk from loss history, and generative AI has almost none. As the ABA Journal reported in February 2025, insurers typically base underwriting on 20 to 30 years of actuarial and loss data; Aon’s Kevin Kalinich put it plainly: “They don’t have that amount of data on the frequency and severity of AI-related losses.” The same article records a coverage question firms rarely consider: Lowenstein Sandler’s Lynda Bennett noted that AI use “may not satisfy the definition of professional service,” and that definition is the one every PI policy hangs on.
Without loss data, governance quality is the only proxy an underwriter has. Slaughter and May’s analysis of the LMA report, published in November 2025, states the premise directly: “traditional E&O policies were designed to address human error, not algorithm-driven failures.” It observes that underwriters are already requesting governance evidence through “questionnaires that cover acceptable use policies, staff training, and human-in-the-loop protocols,” and that “professional liability coverage will increasingly depend on how firms govern their use of AI.” It anticipates that pricing models may come to reflect governance quality rather than sector benchmarks alone.
The loss scenarios the market is modelling explain the specific questions. A professional who relies on a hallucinated output is liable for it. A fee earner who submits a confidential client document to a public model may breach the duty of confidentiality. And a flaw in one widely used tool can repeat the same error across many matters at once, which raises the aggregation question: one claim with one limit and one deductible, or many. Each scenario maps to a line on the form — verification, data handling, tool inventory — and a firm that cannot answer the line has told the underwriter exactly where the scenario is live.
A renewal form is an audit with a price attached: every blank answer is underwritten as a risk the firm has not managed.
A renewal form is an audit with a price attached: every blank answer is underwritten as a risk the firm has not managed.
The regulator’s expectations and the underwriter’s questions now point the same way
None of this is new to the professional regulators; the underwriters are simply the first to attach money to it. In November 2023 the Solicitors Regulation Authority (SRA) published a Risk Outlook report on AI in which its chief executive, Paul Philip, said firms “should be overseeing the use of AI” as they would supervise a junior employee; the same release reminded the profession that solicitors remain accountable to clients whether or not they use external AI. In March 2026 the Law Society published a guide noting that “the majority of firms and solicitors” now use AI for drafting and case analysis, and that human oversight is an ongoing requirement, not a one-time check.
Set against those expectations, the conference poll reported by the Gazette reads like an underwriter’s worst case. Fourteen per cent of delegates said AI in their firm was “allowed but largely unmanaged.” Almost half said responsibility for managing AI use lies with individual fee earners, and 24 per cent placed it with a supervising or managing partner. A firm in which accountability sits with each fee earner has as many answers to “where is the human element of verification” as it has people. Prohibition does not solve this: the same report records a compliance adviser’s view that insurers are more concerned by firms claiming to have banned AI, since staff then use it without guardrails. Nor does the vendor absorb the risk: the Howden guidance warns that a supplier’s own PI cover is “unlikely to be as comprehensive as your PII policy,” and that “The robot did it” is not a defence to negligence.
Treat the renewal as the audit it is and build the file before the form arrives
Our assessment is that firms should stop treating the AI section of the proposal form as a disclosure exercise and start treating it as the governance review it has become. The file that answers it well has five parts, each of which the firm needs for its own reasons: a written AI policy approved by the partners with COLP input; an inventory of the tools in use, including the ones fee earners adopted on their own; a verification protocol that names who checks which outputs and where that check is recorded; training records that show the policy was taught, not just circulated; and vendor due diligence covering data handling, contract terms, and the supplier’s own insurance. The Howden guidance adds a step that costs nothing: tell the underwriter about the technology in a covering letter rather than waiting to be asked, since significant AI use must be disclosed as material information in any case.
The owner is the risk or compliance partner, and the timeline is the renewal date. The file should exist ninety days before it, because the version written under deadline is the version the underwriter prices.
The renewal form has become the governance audit most professional firms were never going to commission for themselves. A firm that answers it with a policy, an inventory, a verification protocol, and training records is describing a risk the market can price; a firm that answers with “experimenting” is asking the market to price a risk it has not yet described to itself. Build the file before the next form arrives.