At the Association of Financial Mutuals (AFM) Annual Conference 2026, Technology Partner, Phil Broadbery, argued that AI governance is not a brake on adoption but the thing that lets smaller insurers move faster with responsible adoption. Here are the practical takeaways from a packed session, and what the FCA’s Mills Review means for you.
AI adoption in insurance: why governance matters more than ever
AI is the latest in a series of technology waves that insurers have lived through: from the desktop PC, email and the internet, to e-commerce, cloud software and mobile. This one is different because for the first time, judgement is being made inside the software.
Adoption is already well under way. More than 80% of financial services firms are adopting AI, and around 40% are scaling it. Insurers are taking different routes: some buy capability from suppliers, some build their own, and some redesign whole processes around it.
The barriers to building have also fallen sharply in the last 18 months. “We’re too small” is no longer the answer it once was. The more useful question for a board is whether it can see, own and evidence the AI the organisation is already using.
The FCA’s Mills Review: what it means for insurers using AI
The FCA published the Mills Review, its report on AI and the future of retail financial services, on 6 July 2026. It proposes no new AI-specific rules. Consumer Duty, the Senior Managers and Certification Regime, and operational resilience all still apply. What it changes is how firms should think about their exposure.
Understanding AI risk: focusing on human accountability rather than the technology
The review grades AI based on how it changes the role of the person using it, from operator through to observer. Adding AI to a process that was already automated may change little. An assistant that decides for itself how to approach a task may change a great deal. An inventory of tools does not tell you your exposure; knowing which human roles changed does.
Why a human in the loop is not enough
Firms must be clear what the reviewer sees, when they can intervene and how challenge is recorded. Oversight weakens when reviewers are overloaded or defer to the model.
How effective AI governance supports responsible innovation
Firms that can evidence testing, permissions and monitoring will adopt with more confidence. The review also warns that smaller firms face higher relative costs for governance and vendor management. The tools got cheap; the governance did not. That is why proportionality matters.
Four practical steps to strengthen AI governance in insurance
Most smaller insurers sit at level one or two of a five-level AI governance maturity scale.
Level three, where controls actually operate, is the proportionate destination. ISO 42001 certification is right for very few firms of this size, although the standard is useful as a gap-analysis tool. Getting to level three means four things:
- Create a complete AI inventory. Cover AI built in-house, bought, or switched-on by a supplier during an upgrade
- Assign clear executive ownership for AI. Choose an executive with a route to the board, separate from whoever champions adoption
- Implement meaningful AI oversight and challenge. Document intervention points and record challenge, so that decisions can be explained and reproduced if a policyholder or the regulator asks
- Strengthen AI supplier governance and assurance. Identify contracts that require notification of AI changes, protect your data and model rights, and give you audit rights.
The first three can be addressed internally while responsibility for the fourth sits outside the firm. For smaller insurers relying on the same few suppliers, combining forces to do that due diligence once, together, makes far more sense than each firm repeating it.
Insurers may also find they have a head start. The firm’s GDPR record of processing is often the only complete description of what data the business processes. Break each process into its steps and look for where work waits, usually at an unstructured input such as free text, a scanned form or a phone call. That is where AI earns its keep.
Building long-term competitive advantage through AI governance
Most of the AI deployed by insurers this year will have also been deployed by the business’s competitors, and from the same suppliers, too. That is keeping up, not gaining a competitive advantage. What sets a business apart is built on what makes it unique: its data, claims history, underwriting judgement, culture and relationships with policyholders. Governance is what carries you from this year’s efficiency gains to that longer-term advantage.
How we can help
Our AI governance and assurance services help insurers manage AI risk, strengthen governance and meet evolving regulatory expectations. A typical starting point is an AI governance maturity assessment, which benchmarks your current approach, identifies gaps and provides a roadmap for improvement. We also run board awareness sessions. To discuss further, contact Phil Broadbery.
Explore the latest edition of Insurer Update to discover expert insights, articles and industry updates from our Insurance Carrier team.
