Regulatory Investigations in the AI Era: What insurers should do before the regulator calls

As regulatory scrutiny continues to evolve across the insurance sector, firms face increasing pressure to demonstrate strong governance, effective oversight and robust operational resilience. At the same time, the rapid adoption of artificial intelligence is creating new risks, new questions and new expectations from regulators.

Our recent seminar, led by HFW, highlighted a clear message for insurers: preparation matters. Whether dealing with a regulatory enquiry, an internal investigation or emerging AI-related risks, firms that think ahead are far better placed to navigate scrutiny when it arrives.

Don't wait for a formal investigation

Many regulatory matters begin long before a formal investigation is launched. A whistleblowing allegation, customer complaint, governance concern or seemingly routine request from the FCA can quickly escalate if not handled appropriately.

One of the key themes from the discussion was the value of conducting internal investigations early. These allow firms to establish the facts, understand potential exposures and determine whether issues require remediation before a regulator becomes directly involved.

However, firms should carefully consider who leads these investigations. While in-house legal and compliance teams bring valuable business knowledge, external advisers often provide specialist expertise, independence and legal privilege protections that can prove critical if findings are later scrutinised by regulators.

Governance matters more than ever

A recurring observation from recent regulatory activity is that many issues stem not from misconduct itself, but from failures in governance, documentation and oversight.
Regulators increasingly expect firms to demonstrate:

• Clear decision-making processes
• Effective challenge and escalation procedures
• Reliable management information
• Strong oversight of operational and customer outcomes
• Evidence that risks have been identified and managed appropriately

In many cases, the absence of supporting documentation can be just as problematic as the underlying conduct.
For insurers, maintaining an auditable record of key decisions and risk assessments is becoming essential.

Be prepared for Section 166 reviews

A Section 166 Skilled Person Review remains one of the FCA's most powerful supervisory tools. While historically viewed as a precursor to enforcement action, these reviews are increasingly being used to assess governance, operational resilience and remediation programmes.

The challenge for insurers is twofold:
First, Section 166 reviews can be costly, with firms responsible for funding the review.
Second, firms have limited control over the final report and must provide rapid access to personnel, systems and documentation.

Preparation is therefore critical. Firms should have clear processes for responding to information requests, briefing staff and coordinating advisers long before a review becomes a possibility.

Insurance should be part of the conversation

Another important takeaway was the need for closer collaboration between regulatory, legal and insurance functions.

Many organisations still treat regulatory issues and insurance notifications as separate matters. In reality, regulatory enquiries, investigations and certain remediation activities may trigger cover under civil liability, management liability or D&O policies.

Early notification can help preserve coverage and avoid complications later. If you're wondering whether insurers might want to know about an issue, they probably do.

AI Brings New Regulatory Challenges

Artificial intelligence is a major focus, not only because firms are increasingly deploying AI tools, but because regulators are beginning to use them too.

For insurers, three risks stand out:

1.  Explainability - Regulators are likely to ask firms how AI-assisted decisions are made and how customer outcomes are monitored.
   Businesses must be able to explain:
   •    How AI tools are used
   •    What controls exist
   •    Who oversees outputs
   •    How fairness and consistency are assessed
2. AI-Driven Decision Making - Particular attention is being paid to AI's role in pricing, underwriting and claims handling. Questions around biased outcomes, inappropriate claim declinatures or insufficient human oversight could quickly become regulatory concerns.
3. Data, Evidence and Record Keeping - Many firms focus on AI outputs but spend less time considering how decisions will be evidenced years later. If a regulator investigates a business in the future, firms will need to show not only what decisions were made, but how AI systems contributed to them and what oversight was in place at the time.

Key takeaways for insurers

1. Think ahead
   Consider how today's decisions would look if reviewed by a regulator in two or three years' time. Build governance, documentation and evidence trails now.
2. Avoid well-intentioned mistakes
   Many regulatory issues arise because employees try to be helpful. Ensure clear escalation processes exist and staff understand when to involve legal, compliance and insurance teams.
3. Keep insurance in mind
   Regulatory activity increasingly interacts with insurance coverage. Engage brokers and insurers early and make sure regulatory and risk teams are aligned.
   For insurers, success will depend on preparedness. Firms that invest in clear governance structures, robust investigation processes and thoughtful AI oversight will be far better positioned when regulatory scrutiny inevitably arrives.