This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
What AI Governance Framework Does the PRA Expect From Insurers?
An insurer assessing AI should connect each use case to its existing risk, model oversight, outsourcing and resilience arrangements. Check the PRA's current supervisory materials and the firm's permissions before describing any control as a regulatory requirement.
Check the current supervisory materials and their applicability before attributing priorities or requirements to the PRA. For the proposed AI uses, review relevant model-risk, resilience, outsourcing and solvency considerations with the responsible owners.
Assess the AI use alongside the insurer's existing risk arrangements. Identify gaps without treating a generic AI framework as confirmation that regulatory expectations are met.
The PRA’s Lens: Stability, Solvency, and Systemic Risk
Do not reduce the regulators' roles to a “fair” versus “safe” contrast. Identify the requirements that apply to the insurer and the AI use before assigning responsibility for the controls.
Before treating any item in the table as a requirement for your insurer, check the relevant supervisory materials, their scope and their applicability to the proposed AI use.
| PRA Priority |
PRA Expectation for AI Governance |
| 1. Solvency UK & Model Risk Management |
Model risk: ask the responsible reviewer to determine which current PRA statements and model-risk requirements apply to this insurer and activity. Do not assume SS1/23 applies universally to insurers or every AI model. |
| 2. Operational Resilience |
Resilience: identify the AI-supported service, outage consequences, dependencies and contingency options. Have the reviewer establish the applicable service and tolerance requirements, then test the proposed plan. |
| 3. Third-Party Risk Management |
Concentration: map shared suppliers and material dependencies for the actual service. Check current primary requirements with the reviewer and record the evidence, alternatives and gaps relevant to the firm. |
Integrating PRA Expectations into Your AI Governance Framework
Review how the proposed AI use fits existing risk arrangements. Questions to work through with the relevant owners include:
- AI risk register: identify relevant risks for the use, such as effects on reserving or investment decisions, and record the basis for the assessment.
- Model risk management: check which AI models are in scope and what inventory, validation and monitoring arrangements apply.
- Operational resilience: identify whether AI supports a service in scope and consider relevant disruption scenarios and fallback arrangements.
- Outsourcing and third-party risk: review relevant provider dependencies, concentration and failure scenarios against the arrangements that apply.
The Board’s Role: A Prudential Responsibility
Clarify which AI-related risk decisions and reports need board attention under the firm's arrangements. Identify the responsible owners and any regulatory questions needing specialist review.
A useful report can identify the AI uses in scope, their risks, the controls tested and the decisions or evidence gaps needing attention. Agree its format and frequency with the relevant owners.
The Bottom Line: AI Governance is a Tale of Two Regulators
Review relevant conduct and prudential considerations together where they apply to the insurer's AI use. Keep the applicable requirements and evidence distinct.
A generic framework does not establish compliance. Record which requirements were assessed and what remains unresolved.
Resolve applicability questions before presenting any control as a PRA expectation.
Take the Next Step
If you are ready to move from theory to action, I can help. My AI Audit gives you a comprehensive assessment of your firm's AI readiness, identifying the gaps in your governance, the risks in your current tooling, and a clear roadmap to get you where you need to be.
Book a Discovery Call → or learn more about the AI Audit.
Need help assessing an AI workflow and its unresolved risks?
Map where AI can improve decisions, service and operations while keeping Consumer Duty, SM&CR, model-risk and client-data controls visible.
