REG Reviews – November 2026

1st Central has launched Motivo, a motor proposition built around an AI agent that carries out tasks on the customer’s behalf. Policy changes and payment management happen inside the conversation rather than through a form or a phone call, handled by an assistant the group has named KAI. It launched exclusively on Confused.com, built with Microsoft AI and cloud technology on top of 1st Central’s own policy administration platform.

Previous UK insurance AI has advised, answered and routed. This one transacts. A customer changing an address, adding a named driver or moving a payment date gives an instruction and the agent executes it. Chief executive Michael Lee has put the saving at around 40% of the time a customer spends managing their insurance.

Three consequences follow for brokers watching from the commercial side of the market.

The first is a cost benchmark. Mid-term adjustments, payment queries and address changes make up a large share of personal lines servicing volume and almost none of its margin. A competitor processing that work without a human touching it resets what the market considers a reasonable cost to serve, and the comparison will reach commercial lines eventually.

The second is the service proposition. Brokers have long defended their position on the strength of being reachable when something goes wrong. An agent available at two in the morning that completes the task in ninety seconds answers a different need, and a decent number of clients prefer it for routine work. The broker argument holds for the complicated conversation and gets weaker for the simple one.

The third sits with compliance. An AI agent making changes to a live policy creates an audit question about who authorised what and on what basis, and a Consumer Duty question about whether a customer who instructs an agent has understood the consequence for cover. The FCA named box-ticking human review as poor practice in its October paper on AI, which suggests it will look closely at how oversight works in propositions like this one.

Worth watching over the next year: whether Motivo stays confined to servicing or extends into claims, and whether a broker platform offers anything comparable. The software houses have been promising agentic capability for a while and the carriers are shipping it first.

The NCSC issued an alert on two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, warning that under certain conditions the flaw could be exploited to achieve unauthenticated remote code execution. Its advice was to update immediately, and to take systems offline where a firm could not apply the update or a temporary mitigation in time. A good many organisations chose the second option. Oxford City Council and the City of Edinburgh Council pulled their websites down. The Office for Budget Responsibility did the same.

Cloudflare’s chief executive reported thousands of attempts to exploit the flaw in the ten hours before it was announced publicly, rising to millions once the news broke.

The detail that makes this different from an ordinary patch cycle is where the flaw came from. A researcher found it in August using an advanced OpenAI model. The vulnerability had presumably been sitting in widely deployed code for a long time, invisible to the people maintaining it, until a machine read the code and spotted what humans had missed.

Two things follow for anyone writing or buying cyber cover.

The aggregation question is the larger one. PHP runs underneath an enormous share of the web, including the content management systems most SMEs use without knowing the name of the technology involved. A cyber portfolio with a few hundred SME insureds almost certainly has PHP under a large proportion of them, and nobody is tracking that the way the market tracks cloud or endpoint concentration. One dependency, simultaneous exposure, and no way to diversify out of it after the fact.

The second is timing. Underwriters have long assumed a window between a vulnerability becoming known and criminals operationalising it, which is the window a reasonable patching policy is built to fit inside. Millions of exploit attempts within hours of disclosure compresses it to something close to nothing. A control question that asks whether a client patches critical vulnerabilities within thirty days is asking about a timescale that no longer matches the threat.

Brokers have a useful conversation available on the back of this. Ask a commercial client who maintains their website, how quickly that supplier patches, and what the contract says about it. Very few will know.

FCA chief executive Nikhil Rathi has called on UK financial services firms to move away from tick-box compliance, arguing that excessive data collection and complex processes are creating unnecessary burdens.

He believes firms should use their resources more effectively to tackle financial crime and that the FCA will take a more proportionate approach to supervision, focusing its attention on areas where the risk of harm is greatest.

Rathi added that firms must also address repetitive compliance processes, including overlapping assurance exercises, risk reports and internal audits, some of which are driven by regulation and others by commercial decisions.

FCA deputy chief executive Sarah Pritchard will work with the sector to identify and reduce unnecessary requirements, encouraging boards to reconsider whether the traditional three lines of defence model remains appropriate.

Rathi highlighted the need for firms to move beyond traditional KYC checks to identify actual money laundering, as the FCA prepares to take on AML supervision of more than 60,000 professional services businesses by 2028.

New COO Johan Sekora will lead efforts to strengthen intelligence-led approaches, while existing KYC, transaction and sanctions monitoring data will continue to play an important role in detecting financial crime.

He said firms must better connect existing customer data to identify potential risks. The FCA also plans to use AI to analyse regulatory information and flag concerns, allowing supervisors to focus on complex decisions involving market manipulation and systemic risks.

As AI adoption in underwriting moves beyond the pilot stage, insurers are increasingly focused on scaling its use and measuring its impact. Attention is shifting towards key challenges such as data quality, governance, technology investment and workforce changes, with AI orchestration emerging as a central part of successful integration.

Underwriting teams are increasingly using orchestration tools to coordinate tasks between AI agents and human employees.

Modern underwriting workbenches are evolving into platforms that manage these workflows, improve data reliability and ensure people focus on decisions requiring human expertise, with growing confidence that this approach can improve efficiency and profitability.

AI adoption is expected to deliver significant commercial benefits, with 53% of commercial P&C insurers anticipating revenue growth of 11–15% over two years.

While some industry leaders question whether AI will genuinely reduce costs, examples such as Markel demonstrate its potential, with an AI-powered underwriting tool reportedly increasing productivity by 300% and generating $30m in new business, according to Oxbow Partners.

Ultimately, AI is enhancing underwriting expertise by automating routine tasks and providing insights that support better risk assessment, pricing decisions and portfolio management.

Industry leaders agree that human judgement remains essential to underwriting, particularly in specialty insurance, where experience, broker relationships and negotiation play a key role.

Markel International’s CUO, Tom Hillier, stresses that technology cannot fully replicate the conversations needed to understand clients and assess risk.

Similarly, Apollo’s CUO, James Slaughter, highlights the importance of human oversight in AI-driven decisions, arguing that trust in these systems must be built through human involvement and engagement with data.

Chris Mullan, head of data and AI at CFC highlights that AI cannot replicate the market knowledge, negotiation skills and broker relationships that human underwriters bring to decision-making.

Similarly, Elizabeth Wooliston, chief of markets at Artificial, emphasises the importance of commercial judgement, contextual understanding and human connection, particularly in complex casualty risks.

William Harnett, head of product strategy at Send also stresses the need for experienced underwriters to challenge AI recommendations and identify less obvious risks that automated systems may overlook.

AI can also improve transparency and help insurers identify bias in underwriting decisions. However, several experts stress that consistent outcomes do not always mean accurate pricing, making human judgement and oversight essential.

They highlight the need for strong AI governance to prevent bias, ensure accuracy and maintain accountability in underwriting decisions.

Allianz Trade’s Vik Vijai and Sollers Consulting’s Jakub Śliwiński stress the importance of transparency, explainability and ongoing human oversight, while Send’s William Harnett warns that AI models can reinforce existing biases.

Pegasystems’ Manoj Pant adds that reliable AI also depends on connecting, standardising and enriching data from multiple sources.

Finally, as AI continues to reshape underwriting roles, it will free up time for stronger broker relationships and staff development while requiring underwriters to build greater data literacy, analytical skills and confidence in challenging AI-driven insights.

REG Technologies is proud to have sponsored the latest Insurtech Run Club event, which drew the club’s largest attendance to date.

Insurtech Run Club brings together professionals from across the insurance and technology sectors for a 5k run through the City of London, followed by an informal networking session. The format offers a valuable opportunity for industry colleagues to connect outside the usual setting of meetings and conferences, and it has quickly become a fixture in the market’s calendar.

We would like to extend our thanks to organisers Nick Goodwin, Elliott Green and Harry Moore for welcoming REG as a sponsor. Their commitment to building an inclusive, well-run community has clearly resonated, and the record turnout reflects the momentum the club has built.

As part of our sponsorship, REG provided branded t-shirts and socks for participants. The shirts carried the message “good partners keep you moving,” a principle that sits at the heart of how we work. Insurance is a collaborative industry, and progress depends on partners who can respond quickly, adapt to changing conditions and support clients through periods of growth and pressure. That is the standard REG holds itself to, and we were pleased to see it represented across the route.

The response to the merchandise was excellent, and the sight of REG colours moving through the City made for a memorable evening. We are grateful to every participant who took part, whether setting a new personal best or simply enjoying the run alongside peers.

Supporting initiatives like this is something we intend to do on a REGular basis. Events that bring the market together, encourage wellbeing and strengthen professional relationships align closely with our values, and we look forward to continuing our involvement.

Our thanks again to the organisers and everyone who attended. We will REGroup at the starting line for the next one.

The FCA is cautioning firms against leaning too heavily on single AI suppliers, according to Insurance Post. Its new report, published on 19 October, sets out examples of strong and weak AI practice to help firms adopt the technology sensibly, and builds on July’s Mills Review.

The FCA’s Jessica Rusu observed that consumers are already using chatbots such as ChatGPT, Gemini and Claude to find financial information. That could open up access, but may also muddy the distinction between regulated and unregulated activity.

The regulator wants AI providers to display clear, consistent warnings about the limits of their financial output, and will extend its existing initiatives rather than build the new public-interest tool the Mills Review suggested.

On supplier risk, the FCA stressed that handing AI work to a third party does not hand over responsibility, Insurance Post reported.

Stronger firms built systems able to swap between providers, brought legal, compliance and risk colleagues into buying decisions, kept a record of their AI uses and suppliers, and prepared for supplier disruption.

Weaker firms took vendor claims at face value and had no fallback if a model became unsuitable or unavailable.

The report also expects firms to settle on the customer outcome they want before picking a tool, check for unfair results across customer groups, test whether customers actually understand AI outputs, and support vulnerable people, including offering human-led help for simple tasks. Smaller firms are held to the same principles, with oversight scaled to the risk involved.
Reaction was mixed. Michael Sicsic of Sicsic Advisory welcomed the practical examples but felt many were light on detail, noting that pricing, underwriting and fair value were absent.

He advised insurers, MGAs and brokers to trace who is responsible for each AI tool along their chain. Cormac Bradley of Broadstone said the findings show AI offers no exemption from regulation.