Claims intake and triage

• Every claim is read and its key details extracted within minutes of arriving, whatever channel it came from.
• Claims are sorted by type, complexity and urgency, then routed to the right team automatically.
• Simple, low-value claims arrive in the handler's queue already filled in, with the policy checked, ready for one-click approval.
• Complex or suspicious claims go straight to senior handlers or the fraud team, with a summary and the specific reasons they were flagged.
• Possible signs of vulnerability are flagged to a trained handler on the first day, not the tenth.
• People stay in control: the AI recommends, a person decides, and every step is logged for audit and for Consumer Duty evidence.

• FCAConsumer Duty (PRIN 2A)
  →

  There's no AI-specific rulebook. The FCA applies the Duty to AI like any other change. Every recommendation carries a plain-English reason, outcomes are monitored by customer group, and the firm can explain any decision if challenged.

• FCAICOBS 8: claims handling
  →

  Claims must be handled promptly and fairly. The AI can speed claims up and route them, but it never rejects a claim on its own. Every decline is a person's decision.

• FCAVulnerable customers (FG21/1)
  →

  Signs of vulnerability in the claim text, such as bereavement, illness or financial difficulty, are flagged to a trained handler, never acted on automatically.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Claims often contain health and other special category data. That means a DPIA before the pilot, collecting only what's needed, processing in UK regions, a clear retention period, and a contract that stops providers training their models on your data.

• ICOAutomated decisions (UK GDPR, as amended by the Data (Use and Access) Act 2025)
  →

  Since 5 February 2026, the strict limit on solely automated significant decisions applies mainly where special category data is involved, and claims often include health data. Every other automated decision needs safeguards: telling people, letting them challenge it, and a person who can step in. A person on every adverse decision keeps the design clearly within the rules.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• An exception queue for claims the AI isn't confident about, with a clear owner.
• Override rules, so handlers know when and how to disagree, and their reasons are captured.
• A weekly quality review of a sample of AI recommendations, including vulnerable-customer cases.
• A named owner for every prompt, policy document and model, with change control like any other system.
• Handlers trained before go-live, not after, including what the AI can't see.
• Consumer Duty monitoring updated to report outcomes for AI-assisted claims separately.

1. 2–3 weeks

   Discovery

   Map today's process, measure the baseline, check data access, and pick the first claim type.

2. Gate · must be true to passBaseline measures agreed, data access confirmed, DPIA started, and compliance involved.

3. 6–8 weeks

   Pilot

   One claim type, in shadow mode: the AI recommends, handlers work as normal, and the two are compared.

4. Gate · must be true to passAccuracy and override rate within agreed limits, no customer group worse off, and compliance sign-off.

5. 4–6 weeks

   Production

   Recommendations go live for the first claim type, with monitoring, support and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan and handler training in place.

7. Ongoing

   Scale

   Add claim types one at a time, then reuse the pattern for complaints and underwriting referrals.

8. Gate · must be true to passEach new claim type passes the same pilot gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The demo used clean PDFs. Real claims are phone photos of handwritten forms.

   How the design avoids it

   Pilot on last month's real claims, every channel, not a curated sample.

2. 2

   Goes wrong

   The AI talks to the claims system directly, so one outage stops everything.

   How the design avoids it

   An API layer and a queue in between, and a switch that sends claims straight to handlers.

3. 3

   Goes wrong

   Nobody owns the prompts or policy documents, so quality drifts quietly.

   How the design avoids it

   A named owner for each, change control, and a weekly sample review.

4. 4

   Goes wrong

   Handlers don't trust it and re-check everything, so nothing is saved.

   How the design avoids it

   Shadow mode first, override reasons fed back, and handlers involved in setting the rules.

5. 5

   Goes wrong

   Compliance sees it a week before go-live.

   How the design avoids it

   DPIA and Consumer Duty review at the discovery gate, not the production gate.

1. By end of 2026
   The FCA's public update on the Which? super-complaint

   The FCA has been analysing claims service quality in home and travel insurance. Expect sharper expectations on claim acceptance, delays and communication. Build the outcome reporting now, split by product and customer group.

2. 2026–2027
   The ICO's code of practice on AI and automated decision-making

   Regulations in force since May 2026 require the ICO to produce a statutory code. Keep the decision log, the explanations and the human review records in a form you could show the ICO.

3. Late 2026–2028
   The Cyber Security and Resilience Bill

   Medium and large managed service providers come into regulation for the first time, with faster incident reporting. Expect your IT and AI suppliers to face new duties, and your contracts and supplier assurance to need updating.

4. 2028
   The NCSC's post-quantum cryptography milestone

   The NCSC asks organisations to have a full migration plan by 2028. Claims data is sensitive and long-lived, so record which encryption the new platform uses and keep it easy to change.