Turning the Mills Review into practical lessons for AI governance, risk and accountability
AI is rapidly transforming insurance.
Across the product and customer relationship lifecycle, it offers opportunities to increase efficiency, improve decision-making and enhance customer outcomes.
The challenge is no longer whether brokers will use AI, but how to use it responsibly and at scale.
That question sits at the heart of the Mills Review, published in July 2026: how can organisations govern AI well enough to exploit its benefits safely?
For insurance brokers, it matters because the FCA has made its stance clear. It does not intend to create an entirely new regulatory framework for AI. Instead, firms are expected to apply existing principles, including the Consumer Duty, the SMCR regime and operational resilience requirements, to the technology they deploy.
This gives firms greater freedom to innovate but greater responsibility to determine what good looks like and demonstrate that their approach is reasonable and proportionate. Less prescription does not mean less accountability; it requires firms to exercise more judgement. As regulation becomes less prescriptive, governance becomes more important because it provides the structure through which those judgements are made and evidenced.
Why governance matters more when rules matter less
Many organisations instinctively view governance as something that slows innovation.
In practice, the opposite is often true.
AI creates opportunity. Opportunity creates uncertainty. Effective governance reduces that uncertainty by helping firms understand the risks they are taking, the controls they need and where AI can be deployed safely.
Good governance creates confidence. Confidence enables adoption.
Without that confidence, innovation stalls. Boards hesitate, management become cautious and organisations struggle to move beyond isolated use cases.
The firms most likely to benefit from AI will not necessarily be those prepared to take the most risk, but those that understand their risks well enough to know where they can safely move faster than competitors.
From assistance to autonomy
One of the Mills Review’s most important observations is that AI is moving from assisting people to increasingly acting on their behalf.
There is a significant difference between AI assisting a broker and AI influencing or making decisions on its behalf.
The technology may be changing, but accountability does not move with it.
The well-publicised Air Canada case demonstrated this clearly. When the airline’s chatbot provided incorrect information to a customer, responsibility remained with the airline. The organisation could not transfer accountability to the technology.
Your AI system does not have regulatory responsibilities. Your chatbot does not get a seat at the Board table, and it cannot carry your regulatory accountability.
The risks brokers need to understand
Brokers occupy a unique position between customers and insurers, creating a number of AI-specific considerations.
Advice and placement
Where AI influences customer recommendations, market selection or product comparisons, firms must understand how outcomes are generated, how conflicts are managed and how decisions can be rationalised.
Risk presentation
AI-generated submissions may contain errors or omissions that affect a client’s compliance with its duty of fair presentation. This could create coverage risks for the client and professional indemnity exposure for the broker.
Embedded and third-party AI
AI increasingly sits within broking platforms, CRM systems and other third-party products. Accountability remains with the regulated firm, even where the technology is provided by someone else.
Claims, renewals and vulnerable customers
Claims and renewals can have significant customer impact, particularly for vulnerable customers. Firms should consider whether AI-driven processes could create barriers to support, limit appropriate escalation or lead to poor and un-evidencable decisions and customer outcomes.
Human oversight only works if it remains effective
Many firms assume that introducing human oversight automatically mitigates AI risk. The reality is more complicated.
Human oversight only works if those responsible have the knowledge, authority and confidence to challenge the output. Automation bias can leave human approval existing on paper while providing little meaningful challenge.
As firms become more reliant on AI, human controls need to be maintained as carefully as the technology itself.
What brokers bring that AI can’t
AI can analyse information, identify patterns and automate tasks, but it does not assume responsibility for the outcome. Brokers remain accountable for understanding clients’ needs, applying professional judgement, managing competing considerations and standing behind the advice and service they provide.
Many of the qualities that distinguish good brokers remain difficult to automate, including understanding how risks evolve, building trusted relationships, navigating complex circumstances and advocating for clients when it matters most.
Two-thirds of consumers surveyed for the Mills Review expressed concern about a lack of protection if AI goes wrong. Generic AI tools are available to every competitor. Competitive advantage comes less from access to technology and more from how effectively firms combine AI with expertise, client knowledge and governance in a way that clients trust.
A practical governance framework for brokers
Existing governance arrangements can usually be adapted rather than replaced.
A practical approach is:
- Understand where AI is used and what could happen if it fails.
- Assess the operational, third-party, regulatory and customer outcome risks.
- Decide ownership, accountability, acceptable autonomy and risk appetite.
- Prepare people and suppliers to use AI effectively and support oversight.
- Document key decisions and rationale.
- Monitor outcomes and emerging risks.
- Reassess regularly as technology and risks evolve.
For any material application of AI, Boards and senior management should be able to answer two straightforward questions:
- Why did we consider this an appropriate use of AI based on the evidence available at the time?
- What evidence do we now have that demonstrates that assessment remains valid?
Governance as the accelerator
AI governance is often framed as a choice between innovation and control. In reality, effective governance creates the conditions needed to innovate responsibly.
As the FCA is unlikely to prescribe exactly how firms should govern AI, responsibility sits with firms themselves. The organisations that succeed will be those that understand their risks well enough to move faster than competitors.
Ultimately, good governance is not a constraint on innovation. It enables firms to adopt AI responsibly, make better decisions and seize opportunities that others may be unwilling to pursue.
Need support with AI governance in insurance?
Our regulatory consulting and AI governance specialists work together to help brokers understand what the FCA expects, assess where their AI governance stands today and put proportionate controls in place. Contact us to discuss your firm’s approach.
