PI Insurance and AI for Financial Services Firms

Professional indemnity insurance for financial planning practices and accounting firms has always been calibrated to the quality of the firm’s systems and controls. A firm with documented processes, supervision frameworks, and clear accountability presents a lower risk profile than one that cannot demonstrate how its advice is produced and reviewed.

AI has changed what systems and controls means. Advisers and accountants are using AI tools to draft Statements of Advice, summarise client files, research product recommendations, and prepare tax advice. In many practices, this is happening without IT approval, without governance, and without any record of what data was submitted to which tool.

From an insurer’s perspective, this creates three intersecting risks that PI underwriters are now pricing explicitly.

• Advice quality risk — if an AI tool generated a draft SOA that the adviser did not critically review, and the advice is later found unsuitable, the firm’s best interests duty process is not defensible. The claim has merit and the process that produced the advice is indefensible.
• Privacy and data breach risk — if client financial data was submitted to a consumer AI tool without enterprise data protections, and that data is later involved in a breach or misuse event, the firm faces both a Privacy Act notifiable data breach and a PI claim arising from the same incident.
• Reasonable steps risk — if the firm cannot demonstrate that it had adequate controls over AI use by staff – the RI Advice standard – the insurer’s exposure is not bounded by what actually happened. It is bounded by what could have happened, given the controls that were not in place.

Insurers have responded by adding AI governance questions to renewal questionnaires. The questions are specific. The answers are consequential.

ASIC v RI Advice Group Pty Ltd [2022] FCA 496 is the most important decision for understanding what PI insurers mean when they ask about reasonable steps. The Federal Court found that RI Advice Group had contravened its AFSL obligations by failing to maintain adequate cyber risk management systems. The court did not require ASIC to prove that a specific client was harmed by the inadequate controls. The inadequacy of the controls was itself the contravention.

Applied to AI governance, the RI Advice principle runs like this: a financial planning practice or accounting firm that has no visibility into what AI tools staff are using, no technical controls that prevent client data from being submitted to unapproved tools, and no records of AI use in advice production, has not taken reasonable steps to manage AI risk. The absence of the system is the problem – not the outcome that the system would have prevented.

PI insurers are applying exactly this test at renewal. They are not asking whether you have had an AI-related claim. They are asking whether your controls are adequate to prevent one. A firm that cannot demonstrate adequate controls is a firm that presents an elevated, open-ended risk profile – which insurers price accordingly.

These are the five questions now appearing in PI renewal questionnaires for financial planning practices and accounting firms in Australia. They are not hypothetical. They are the questions your broker will ask you to answer before your next renewal.

The policy distinction matters specifically because consumer-grade AI tools present a different risk profile to enterprise tools. Consumer accounts do not provide data processing agreements, do not guarantee data residency in Australia, and may use submitted content for model training. An AI policy that treats all tools the same has not addressed the material risk.

This is the question that most practices cannot answer satisfactorily in 2026. The gap between a policy that says staff should not use unapproved AI tools with client data, and a control that enforces that policy at the browser level, is exactly the gap that ASIC and APRA have both identified as the most common failure across regulated financial services firms.

This is the question that most practices cannot answer satisfactorily in 2026. The gap between a policy that says staff should not use unapproved AI tools with client data, and a control that enforces that policy at the browser level, is exactly the gap that ASIC and APRA have both identified as the most common failure across regulated financial services firms.

Insurers writing PI cover for financial planners are aware that RG 175 requires advice records to be kept for seven years and that those records must be sufficient to show the basis for the advice. A SOA produced with AI assistance, with no record of the AI’s involvement, is a file that cannot demonstrate the process behind the advice. Underwriters treat this as an advice quality risk that they cannot quantify, and price it accordingly.

The data assessment question is where the intersection between PI insurance and Privacy Act compliance becomes direct. A practice that cannot confirm its data handling position for AI tools is a practice that may be operating in breach of APP 6 (use of personal information), APP 11 (security of personal information), and the Notifiable Data Breaches scheme. Each of those is a separate exposure that the PI insurer may or may not cover, depending on how the policy is worded and what the firm disclosed at renewal.

The training records question connects directly to the ASIC framework. ASIC’s expectations for adequate risk management systems under section 912A of the Corporations Act include not just having controls, but being able to demonstrate that those controls were communicated and operating. A policy without training records is a policy that cannot be evidenced as an operating system.

Firms that are well-positioned at PI renewal in 2026 share a consistent set of characteristics. They are not necessarily the largest firms, or the most technically sophisticated. They are the firms that treated AI governance as a governance question rather than a technology question — and built the evidence base accordingly.

• A written AI acceptable use policy — that specifically addresses financial services use cases: SOA drafting, client file summarisation, product research, and meeting preparation. Reviewed in the past twelve months. Available to share with the insurer or broker.
• Browser-level technical controls — that enforce the approved tool list and restrict client data from reaching unapproved tools. Not just a firewall or URL block — controls that operate at the level of the AI interaction itself, restricting file uploads and paste operations within consumer tools.
• An AI tool usage log — that records AI tool access by user, tool, and data category. Retained as part of the advice record-keeping obligation. Accessible on demand.
• Documented enterprise tool assessments — confirming that approved AI tools have adequate data processing agreements and that their data handling terms are consistent with Australian Privacy Principle obligations.
• Staff training records — showing when AI governance training was delivered, who attended, and what was covered. Updated when the policy changes or a significant new tool enters the market.

Firms that have all five in place can answer the PI renewal questionnaire in full, can demonstrate that their controls are operating rather than just documented, and can position themselves as a managed risk rather than an open-ended one. That is the difference that shows up in premium, in coverage terms, and in how quickly a claim is resolved.

KMTech’s Shadow AI Governance service provides the technology layer that translates your AI governance policy into an operating system with an evidence base. For financial planning practices and accounting firms, the service produces the specific artefacts that PI insurers are asking to see.

• Real-time AI tool inventory — complete visibility into which AI tools staff are accessing, addressing Question 1 with evidence rather than assertion. The insurer can see the tools in use, not just the policy that governs them.
• Browser-level preventative controls — technical enforcement of your approved tool list, directly addressing Question 2. Policy plus enforcement, not policy alone.
• AI tool usage log — a continuous, timestamped record of AI tool access by user and data category, addressing Question 3. Retained and available on demand for advice file review, AFCA processes, or insurer requests.
• Data handling documentation support — clarity on which tools are operating under enterprise terms and which are restricted from client data, addressing Question 4.
• Staff awareness communications — delivered in a format that can be recorded as training for Question 5. Not a one-time briefing — regular communications that refresh awareness as the AI tool landscape changes.

KMTech is not an insurance broker, PI adviser, or AFSL compliance consultant. We provide the managed IT and security infrastructure that makes your AI governance framework operate in practice. The evidence of controls we generate is the evidence your insurer is asking for.