The UK insurance AI regulatory landscape

UK insurers deploying AI face obligations from multiple regulators operating in parallel. The Financial Conduct Authority is the primary conduct regulator, with Consumer Duty as the overarching framework. The Prudential Regulation Authority applies prudential expectations including model risk management. The Information Commissioner's Office enforces UK GDPR. And the Financial Ombudsman Service (FOS) can adjudicate disputes about AI-driven insurance decisions, creating indirect governance pressure through complaint risk.

FCA Consumer Duty and insurance AI

Consumer Duty, which came into force in July 2023, requires firms to act to deliver good outcomes for retail customers across four outcome areas: products and services, price and value, consumer understanding, and consumer support (see the FCA's Consumer Duty page). Each of these has direct implications for AI use in insurance.

Price and value: AI pricing models must demonstrably reflect the actual risk and value received. AI that systematically charges customers more than the fair value of the insurance, including through loyalty pricing penalties, proxy discrimination, or opaque algorithmic adjustments, creates Consumer Duty exposure. Firms must be able to show the FCA, through data and analysis, that pricing outcomes are consistent with the fair value requirement.

Consumer understanding: AI-generated communications, automated renewal notices, claims decisions, underwriting explanations, must meet the Consumer Duty standard of enabling customers to make informed decisions. Generic explanations of "algorithmic underwriting" do not meet this standard. Customers must understand what factors influenced their premium or claim decision.

Consumer support: AI chatbots and automated claims handling must not create barriers that prevent customers from obtaining the outcomes they are entitled to. Automated claims rejections must be reviewable by humans, and the escalation path must be easily accessible.

FCA General Insurance Pricing Practices

The FCA's pricing practices rules (PS21/5), in force since January 2022, were a direct regulatory response to the loyalty penalty problem in insurance, where algorithmic pricing systematically charged existing customers more than equivalent new customers for the same risk. The rules require that renewal prices are no higher than the equivalent new customer price for the same product and risk profile.

For AI pricing models, this creates a specific governance requirement: the model must be tested and monitored to ensure it does not produce renewal prices systematically higher than new business prices. Firms must be able to demonstrate through data that their AI pricing model complies, which means maintaining the data infrastructure and monitoring to detect and remedy pricing disparities.

PRA model risk management

The PRA's core model risk management expectations are set out in Supervisory Statement SS1/23, which formally applies to banks, building societies, and PRA-designated investment firms with internal model approval, not to insurers. SS3/17 is a separate supervisory statement dealing with the Solvency II treatment of illiquid, unrated assets, not with AI or machine learning, so it should not be relied on for AI governance expectations. The PRA does not yet have an insurer-specific supervisory statement dedicated to AI, but its 2026 insurance supervisory priorities, published in January 2026, name AI as a new area of focus and flag risks including data quality, third party reliance, and cyber exposure. In practice, insurers using AI and machine learning in underwriting, pricing, and reserving should expect supervisors to look for model risk discipline consistent with the SS1/23 principles: independent validation before deployment, documentation of model limitations and assumptions, monitoring against defined thresholds, and revalidation after material model changes.

For actuarial models with AI components, the Chief Actuary or Actuarial Function Holder is personally accountable under the Actuaries' Code and PRA rules for the outputs of AI-assisted pricing and reserving models. That accountability cannot be delegated to the AI, they must understand the model's methodology and limitations well enough to take professional responsibility for its outputs.

ICO and UK GDPR

All personal data processed in insurance AI, including telematics data, claims history, health information, and behavioural data used in pricing, is subject to UK GDPR. Special category data (health information, genetic data used in life and health insurance underwriting) attracts the highest UK GDPR obligations and requires explicit consent or another Article 9(2) basis. Automated underwriting decisions with legal or similarly significant effects on individuals were governed by Article 22 of the UK GDPR until the Data (Use and Access) Act 2025 replaced it, with effect from 5 February 2026, with new Articles 22A to 22D. Insurers making significant automated underwriting or claims decisions must now provide safeguards that include information about the decision, the ability to make representations, access to human intervention, and the ability to contest the decision. Data (Use and Access) Act 2025, s.80

Related reading

Further reading: ICO AI guidance