Governing our use of AI

Artificial intelligence does real work in our underwriting and claims process. It reads submissions and the documents that come with them, extracts the information an underwriter would otherwise re-key, assembles analysis, and drafts correspondence for review.

What it does not do is decide. The distinction matters more than any particular capability, and the principles below exist to hold it.

Every underwriting and claims decision we take is made by an identified person. Nothing binds, declines, prices or settles on its own.

Human review is built into the workflow rather than bolted onto the end of it, at the points where a decision is actually made. Our records distinguish between analysis produced by a machine and a decision taken by a person, and name the person.

Underwriting and claims work leaves a record that can be examined afterwards: what was considered, what was concluded, who concluded it, and when. Those records cannot be edited after the event.

That record is available to our principal, which is responsible for the regulated business we conduct and reviews it, and it is what allows a decision to be explained to a counterparty who asks.

The models we use, and the data they operate on, run on infrastructure hosted in the United Kingdom. Information sent to us by brokers and cedants is not exported to have machine analysis performed on it elsewhere.

Our systems are built so that the technology cannot exceed its role:

• it does not correspond with anyone outside the firm without a person reviewing and sending it;
• it operates within limits on cost and activity that we set and can change, and which can be stopped;
• it is confined to the information relevant to the matter in hand rather than given the run of the book;
• its use is monitored, and we treat unexpected behaviour as something to investigate rather than tune around.

We write commercial facultative reinsurance of corporate risks, and we are established in the United Kingdom. We do not price life or health insurance for individuals, and we do not profile natural persons; our analysis concerns companies, assets and the physical risks attaching to them.

Our privacy notice sets out the position on automated decision-making in the terms United Kingdom data protection law uses.

Counterparties conducting due diligence on us frequently ask for more detail than a public page carries. We are glad to answer in full, including on our controls, our suppliers and our testing, under the usual confidentiality. Please ask.