This article is from Moterra;
Walk around almost any broking office today and you will find AI already at work. Someone is summarising a renewal pack before a client meeting. Someone else is turning a loss adjuster’s notes into a tidy update for the insured. A third is asking a chatbot to compare two policy wordings line by line. Very little of this was approved, and most of it runs through public AI tools that the firm does not control.
This is not a criticism of the people doing it: the tools are genuinely useful, and nobody gave them a better option. But it leaves the firm with a problem it cannot see: client data, claims histories and commercial terms leaving the business through a browser tab, with no record of where they went or who else can now read them. Banning AI rarely solves this. Staff simply move to their phones or personal accounts, the pattern usually called shadow AI, and the firm loses even the little visibility it had.
The more useful question is how to give people AI that works for them, while the firm keeps control of the data and of the cost. Start with the data, not the tool The first decision is where the AI runs. When a model sits inside the firm’s own cloud environment, in a UK region, client data does not leave the business to be processed somewhere else. The firm decides how long prompts and outputs are kept, who can see the logs and what is deleted. That single choice answers most of the questions a compliance officer, a DPO or a capacity provider will ask before AI can be used on live client work.
It also changes the conversation with clients. “We use AI, and your data never leaves our environment” is a very different statement from “some of our staff use a chatbot”.
Access permissions are where it becomes practical
Once the AI runs in the firm’s own environment, the real work is deciding who can use it, on what, and how far. In broking, that maps naturally onto the way teams already work. Renewals. Account handlers need AI that can read the current schedule, the claims history and last year’s correspondence to draft a renewal summary or a market submission. They do not need access to every other client’s file.
Permissions should follow the client portfolio: a handler’s AI sees what the handler is allowed to see, and nothing more.
Pricing and future risk.
Pricing and underwriting teams work with the most sensitive commercial information in the building: loss ratios, rate changes, capacity conversations. AI can help them test scenarios, but this is exactly the area to ring-fence. A sensible set-up gives the pricing team its own workspace, keeps its data out of everyone else’s reach, and logs every query so the firm can show who looked at what.
Add-on risks.
Cross-selling add-ons such as cyber, legal expenses or key person cover is where AI can spot gaps in a client’s programme. It is also where suitability and Consumer Duty questions arise. Here the permission is less about data and more about use: the AI can suggest, but a named person signs off, and the record shows both. Third parties on claims and repairs.
Claims bring in loss adjusters, repairers, solicitors and assessors, each needing some information and none needing all of it. AI can draft instructions, chase updates and summarise reports, but anything shared outward should be limited to that claim and that party. Good practice is to treat the AI like a junior colleague: it can prepare the message, but it cannot decide on its own what leaves the firm. The cost question nobody asks early enough The second surprise firms meet is the bill. AI pilots often start with a handful of enthusiastic users.
When the whole office wants access, a cost that grows with every licence, whether people use it daily or once a month, can quickly undermine the business case. The same controls that protect data also protect the budget. When access and spend sit in one admin console, the firm can set limits by team, see which uses actually deliver value, and expand where it pays off rather than buying licences for everyone on day one.
What a regulator would want to see
Brokers do not need to wait for AI-specific rules. The FCA has said it will oversee AI through the frameworks firms already work under, and three of them apply directly to the AI already in the office.
SM&CR.
Responsibility for how the firm uses AI sits with a named senior manager. If an AI-drafted renewal summary misstates cover, the question is not which tool made the mistake, but who was accountable for the controls around it.
Consumer Duty.
The Duty covers the add-on conversation. If AI suggests cyber or legal expenses cover, the firm must be able to show the product was suitable and offered fair value, and that a person checked it.
UK GDPR.
Every prompt containing client details is personal data processing. The ICO’s guidance on AI and data protection expects a data protection impact assessment in most cases before AI is used on personal data, which means knowing where the data is processed, how long it is kept and who can see it. A firm that can show where its AI runs, who can use it, what it was used for and who approved the outcome can answer all three.
A firm that cannot has an exposure it has not yet measured. A practical first step For most firms, the starting point is modest: find out what AI is already in use, decide where an approved tool should run, agree three or four permission groups that mirror how the business works, and set a spending limit before rollout rather than after.
Done in that order, AI stops being a quiet risk and becomes a tool the whole office can use with confidence. Making sure the client data stays where it belongs is a management decision, not an IT one.
About Moterra
Moterra is a private AI deployment company and a Select Services Partner in the Claude Partner Network. We help businesses deploy Claude inside their own AWS or Azure environment, connect it to the tools they already use, and keep it secure and governed, so everyday processes get faster. moterra.ai
Be the first to comment