The 5 Questions Your PI Insurer Will Ask About AI in 2026 and Whether Your Law Firm Can Answer Them

PI renewal conversations have changed. Insurers assessing risk for Australian law firms are no longer focused solely on traditional risk indicators such as supervision ratios, matter management processes, and claims history. In 2026, AI governance has joined that list.

The shift is driven by claims data. The Legal Practitioners Liability Committee has identified inadequate technology controls as a contributing factor in a growing proportion of professional indemnity claims. Insurers have responded by asking more specific questions about how firms govern their technology environments, including how they manage AI tool use by staff.

Managing partners approaching renewal who have not addressed AI governance are walking into a conversation they are not prepared for. This article maps the five questions you are most likely to face, the evidence insurers want behind each answer, and what a firm that can answer them looks like in practice.

This is the foundational question. Insurers are not asking whether your firm has banned AI or whether you have approved AI. They are asking whether you have made a documented decision about AI governance and committed it to writing.

A documented AI governance policy defines which AI tools are approved for use with client data, which are approved for internal use only, and which are prohibited. It sets out what staff must not do with client information when using AI tools, and it establishes a process for assessing new tools before they enter the workflow.

What insurers want to see: A written policy that has been dated, approved by firm leadership, and distributed to all staff. A policy that exists in draft form or has not been formally adopted does not provide the same protection.

What firms without this answer: If you cannot confirm that a documented policy exists, the insurer has no basis to assess your governance position. This is the question that most directly affects whether coverage terms are affected.

A policy that governs tools you do not know about is not a control. Insurers understand that Shadow AI use is widespread, and they will ask whether you have taken steps to establish a baseline picture of what is actually in use across your firm.

This question is designed to test whether your governance framework is based on evidence or assumption. A managing partner who has issued a policy but has not verified what tools staff are accessing is, from an insurer’s perspective, operating with an unverified control.

What insurers want to see: Evidence that the firm has conducted a Shadow AI assessment or IT audit to identify which AI platforms are being accessed across the network. This does not need to be a large exercise. A one-day assessment by your IT team or IT partner produces a defensible baseline.

What firms without this answer: If your response is that you assume staff are following the policy but you have not verified it, the insurer will treat your AI governance controls as unverified.

For a plain-English account of what Shadow AI is and why the assessment matters, see Shadow AI in Law Firms: What Managing Partners Need to Know.

Approving a tool without assessing it is not governance. Insurers will ask whether the tools the firm has approved for use with client data have been assessed against the firm’s obligations under the ASCR, the Privacy Act, and the expectations of the VLSB+C and LPLC.

The specific areas of assessment that matter are: whether the vendor provides a data processing agreement, whether client data is used for model training, and whether data residency commitments are consistent with the firm’s Privacy Act obligations.

What insurers want to see: A record that the firm has reviewed the data processing terms of each approved AI tool, confirmed that client data is not used for model training, and verified the vendor’s data residency position. This does not need to be a lengthy document. A one-page assessment record per tool is sufficient.

What firms without this answer: Approving tools without documented assessment means the firm cannot demonstrate that its approved tools meet its professional obligations. This is the question that most directly affects claims arising from a specific tool’s data handling.

For a detailed guide to assessing and selecting AI platforms appropriate for legal practice, see How to Choose an Approved AI Platform for Your Law Firm and Restrict Everything Else.

A policy that relies entirely on staff compliance is not a control. Insurers are asking whether the firm has implemented technical measures that enforce the policy without relying on individual decision-making at the moment of use.

This question reflects the LPLC’s published guidance that adequate technology controls require more than a written policy. Technical enforcement is the layer that converts a policy into a governance framework.

What insurers want to see: Evidence that the firm has implemented browser-level or network-level controls that block access to unapproved AI platforms and prevent file uploads to unapproved external tools. A firm that can describe its technical enforcement layer is in a materially stronger position than one that cannot.

What firms without this answer: If the firm’s only control is a policy document and a staff communication, the insurer will assess the firm’s AI governance as having a significant implementation gap.

In the event of a claim arising from an AI-related data breach or confidentiality event, the insurer’s investigation will look for evidence of what occurred, when, and whether the firm’s controls were in place and functioning. An audit trail is the evidence base for that investigation.

This means the firm needs logging that records AI platform access across the network, alerts on unapproved tool access attempts, and documentation of the governance decisions made, the policy, the tool assessments, the staff communications.

What insurers want to see: A description of the logging and alerting capability in place, and confirmation that governance decisions are documented and retained.

What firms without this answer: Without an audit trail, the firm cannot demonstrate that its controls were in place at the time of the event. That is a significant gap in any claims investigation.

A firm that can answer all five questions has a documented AI governance policy, has assessed which tools staff are using, has reviewed approved tools against its professional obligations, has technical controls enforcing the policy, and has an audit trail supporting any future investigation.

That is not a large programme of work. For most firms it is a structured project of four to six weeks with the right IT partner. The output is a governance position that satisfies the VLSB+C’s adequate systems requirement, meets the LPLC’s evidence expectations at renewal, and supports the firm’s Privacy Act obligations under APP 11.

For the full regulatory picture behind these five questions, see AI Governance for Law Firms: What VLSB+C, LPLC and OAIC Actually Require.

For a look at how directors’ duties obligations apply to managing partners in this context, see Directors’ Duties for Australian Legal Firms.

Download the AI Governance Checklist for Law Firms for a structured starting point covering all five areas.

Author:

Bradley Kaine, CEO and Co-Founder, Kaine Mathrick Tech · Reading time: approximately 8 minutes

Bradley Kaine is CEO and co-founder of Kaine Mathrick Tech, a cyber-first managed IT services provider with offices across Melbourne, Sydney, Brisbane, and Hobart. He advises managing partners and firm principals on AI governance frameworks aligned to Australian professional indemnity and regulatory obligations.