This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
Who Is Accountable for AI Decisions Under SM&CR in Insurance Firms?
An insurer using AI in pricing or claims should map the system's decisions to the relevant business owner, risk controls and senior-management responsibilities. Record who can challenge or override an outcome and check the firm's actual SM&CR allocation.
Check the firm's allocated responsibilities for the business activity using AI. Keep the people who approve, supervise and challenge the system identifiable in the governance record.
The Accountability Void: A Common Problem
Review how the firm's technology, risk, compliance and business roles divide responsibility for the system. Confirm the functions and allocations that actually apply rather than inferring them from job titles:
- Technology and operations: check who maintains the system and its operational controls, and whether SMF24 applies to the firm's allocation.
- Risk management: identify who reviews the system's risks and how any applicable SMF4 responsibility is recorded.
- Compliance oversight: identify who assesses relevant requirements and check any applicable SMF16 allocation.
- Underwriting or claims: record the business owner's role and confirm the person's actual senior-management or certification status.
Record how these roles work together, including who can challenge an outcome, request a review or stop the affected use. Resolve unclear allocations with the firm's responsible advisers.
Pinning the Tail on the Donkey: A Framework for AI Accountability
Use the table to check the firm's actual allocation for each activity. Record the responsible people, their remit and how they work together; do not infer an SMF or prescribed responsibility from an AI use or job title alone.
| Area to review |
Firm-specific allocation checks |
| 1. Overall Responsibility for AI Strategy & Governance |
Who approves the firm's AI strategy and governance arrangements? Check the relevant statements of responsibilities and governance records with the firm's responsible advisers. Record the applicable allocation, any gaps and who can resolve them, rather than assuming a separate AI prescribed responsibility. |
| 2. Responsibility for a Specific AI System |
For an underwriting or claims system, who approves the business use, reviews its risks and performance, and can challenge or stop it? Check the business owner's actual remit and any relevant senior-management allocation. Record how decisions and unresolved issues reach the appropriate person. |
| 3. Responsibility for Technology & Operations |
Who maintains the AI system and reviews its resilience, security and performance? Confirm the technology and operations remit, supplier responsibilities and escalation route. Check whether SMF24 applies to the firm and this allocation; do not assume it from a COO title. |
| 4. Responsibility for Risk & Compliance Oversight |
Who provides risk challenge and compliance oversight for this use? Check any applicable SMF4 and SMF16 allocations and how these functions interact with the business and technology owners. Record the evidence, applicable requirements and unresolved issues for review, including Consumer Duty where relevant. |
The "Partial Understanding" Problem
The cited survey's phrase "partial understanding" should not be treated as a finding that a particular firm is non-compliant. Review what the responsible people understand about the system and which gaps affect oversight.
Keep evidence of the responsible manager's review and challenge, alongside input from the data science team or supplier. Check the steps needed for the actual system and responsibility allocation.
The Bottom Line: Accountability Must Be Designed
Check whether responsibilities, governance records or committee oversight need updating for the AI use. Record the decision and any changes to how the system is supervised.
Make responsibility for the affected business activity clear before relying on the system's outputs.
Keep the review and challenge records available so the firm can explain the decisions it made.
Take the Next Step
To assess AI readiness, list the tools already in use, the information they handle, the decisions they influence and the people accountable for them. Turn the unresolved gaps into a prioritised review plan rather than treating an assessment as proof that the firm is ready.
Book a Discovery Call → or learn more about the AI Audit.
Need help assessing an AI workflow and its unresolved risks?
Map where AI can improve decisions, service and operations while keeping Consumer Duty, SM&CR, model-risk and client-data controls visible.
