How should professional firms check PII cover for AI-assisted work?

Checking PII cover before AI becomes part of client delivery

Professional firms should treat AI-assisted work as a change to the delivery process, not as a software purchase. If an assistant can influence research, drafting, analysis, client communications or a recommendation, the firm needs to know whether its professional indemnity insurance still responds when that work goes wrong.

The question is rarely answered by a general statement that technology is permitted. Policy wording, endorsements, notifications and the facts of the proposed use all matter. A sensible review starts before a tool is put into a live matter.

Start with the work, the data and the control

Set out the proposed use in plain terms: the task, the client or matter type, the information entering the tool, the output produced, and the professional who remains accountable. Include whether the tool is public, embedded in an existing platform or supplied by a third party. This gives the broker or insurer a usable basis for discussing cover rather than a vague question about AI.

Ask whether the policy has exclusions, conditions or notification duties relevant to automated processing, confidentiality, cyber events, inaccurate advice, delegated activity or novel technology. Do not assume an answer obtained for internal administration also applies to regulated or client-facing work.

Review AI risk and efficiency controls

Make the insurer conversation evidence-led

Prepare a short control pack for the broker or insurer. It should cover the approved use case, data classification, supplier terms, retention and training settings where available, access controls, human review steps, escalation routes and records kept for quality assurance. The aim is to show that AI supports professional judgement rather than replacing it.

Keep written evidence of what was asked, who responded, the policy version reviewed and any conditions attached to the answer. If the response is conditional, assign an owner and due date for each action. This audit trail helps the firm demonstrate that it considered risk before relying on the tool.

Put a review control around every client-facing output

PII cover is only one part of the risk position. A firm should define which outputs require a qualified reviewer, what checks must be performed and when the work must be redone without AI. For legal, accountancy, advisory and insurance work, that review should be proportionate to the potential client harm, confidentiality impact and reliance placed on the result.

Document exceptions as well as normal cases. A staff member should know when a tool is outside the approved scope, how to pause use and who can decide whether the issue needs to be raised with the insurer, client, regulator or data protection lead.

Build an evidence-led AI governance operating model

Turn the answer into an operating rule

Once cover and conditions are understood, update the acceptable-use policy, matter intake checks and staff guidance. Link the rule to a register of approved tools and use cases, with a review date when policy wording, supplier terms or the use case changes. This prevents an old assurance from being applied to a new workflow.

For firms moving from trials to routine use, an implementation plan should connect insurance, risk, data protection and delivery owners. The output is a controlled process: permitted work, prohibited work, review requirements, evidence retained and a route for changes.

Plan a controlled AI implementation

Conclusion

Professional firms should confirm PII treatment of AI-assisted work before relying on it in client delivery. Clear use-case evidence, written insurer or broker guidance and human quality review provide a more defensible position than a broad assumption that existing cover applies.