Underwriting submission review

• Every submission is read on arrival, and the risk data is extracted into a structured record mapped to Core Data Record and ACORD-aligned fields. Each value links back to the page or spreadsheet cell it came from.
• Schedules of values are normalised: columns mapped to your fields, units checked, totals reconciled to the slip, and addresses cleaned for exposure and catastrophe modelling.
• The risk is checked against the line guide, appetite statements and the underwriter's written authority. Each result shows the rule it used and the evidence it found.
• Gaps are flagged, such as missing construction details, loss runs that stop short or values that don't add up, with a draft information request for the underwriter to send.
• The underwriter gets a one-page summary and, where the risk needs referral, a draft referral note in the house format.
• The underwriter decides whether to quote, on what terms and at what price. The AI never quotes, declines, binds or writes to the broker.

• PRAInsurance supervision: 2026 priorities (15 January 2026)
  →

  The PRA highlights a softening underwriting cycle and closer scrutiny of underwriting discipline and delegated underwriting, and sees AI through the lens of prudential risk and operational resilience. The design applies the written guidelines the same way every time, keeps authority limits as hard rules owned by underwriting management, and gives the board management information on referrals and breaches.

• PRA and FCAOperational resilience (SS1/21, SYSC 15A) and outsourcing and third-party risk (SS2/21)
  →

  Firms, including Lloyd's managing agents, have had to stay within impact tolerances for their important business services since 31 March 2025. The AI is kept off the critical path: if it is switched off, submissions go to underwriting assistants as before. Cloud and model providers are assessed and recorded as material third parties where they qualify.

• FCAConsumer Duty (PRIN 2A) and PROD 4, where SME customers are in scope
  →

  Since PS25/21 (9 December 2025), contracts for larger commercial customers and specialist risks are outside PROD 4 and the Consumer Duty, but micro enterprises and small businesses are still retail customers. Each submission is tagged by customer type, and for retail customers the appetite rules and outcomes are monitored so no group is turned away without a reason.

• UK lawInsurance Act 2015: fair presentation and the insurer's knowledge
  →

  The broker must make a fair presentation, and the insurer is expected to ask questions where it should. Under section 5, the insurer can be treated as knowing information it holds that is readily available to the underwriter. So nothing extracted is silently dropped: the summary links to every source document, and possible material facts are shown to the underwriter, not hidden in an attachment.

• Lloyd's and the London Market GroupCore Data Record (CDR) and ACORD standards
  →

  The CDR is the market's agreed set of placing data, aligned with ACORD's GRLC standards, and now reaches into treaty reinsurance and claims. Extracted data uses CDR field definitions where they exist, so it can be shared with brokers, Lloyd's and market services without a second mapping.

• HM Treasury (OFSI)UK financial sanctions
  →

  The insured, its owners and the territories involved are screened by your existing sanctions tool, called by the agent. A possible match always goes to compliance. The AI never clears a match or decides it is a false positive.

• ICOUK GDPR, the Data Protection Act 2018 and automated decisions
  →

  Submissions hold personal data on directors, sole traders, employees and claimants named in loss runs, and sometimes health or criminal conviction details. That means a DPIA, processing in UK regions, retention tied to the policy record, and a contract that stops providers training on your data. The AI never declines on its own, so no significant decision about a sole trader is solely automated.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• Each class of business has a named underwriting owner for its line guide, appetite statement and referral rules. A change goes through the same approval as today, then into the guidelines index.
• Underwriting assistants move from re-keying to checking: they confirm extracted data on new broker layouts and on anything the AI isn't confident about.
• Override rules, so underwriters know how to disagree with an appetite result, and their reasons are captured and reviewed.
• Peer review continues as now, with a sample that includes risks the AI marked as in appetite and those it marked as out.
• Brokers hear from underwriters, not the AI. Information requests are drafts until an underwriter sends them.
• Underwriters trained before go-live, including what the summary can't show: the broker relationship, the market and their own judgement.

1. 3 weeks

   Discovery

   Map today's submission flow, measure the baseline, collect a sample of real submissions, check workbench APIs, and pick the first class of business.

2. Gate · must be true to passBaseline agreed, workbench route confirmed, DPIA started, underwriting owner named for the first class.

3. 6–8 weeks

   Pilot

   One class, such as UK commercial property, in shadow mode: the AI extracts, checks and drafts, assistants and underwriters work as normal, and the two are compared.

4. Gate · must be true to passExtraction accuracy and appetite agreement within agreed limits, no missed sanctions referrals, and underwriting management sign-off.

5. 4–6 weeks

   Production

   Summaries and checks go live for the first class, with monitoring, support and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan and underwriter training in place.

7. Ongoing

   Scale

   Add classes one at a time, then reuse the pattern for bordereaux from coverholders and for renewal review.

8. Gate · must be true to passEach new class passes the same pilot gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The demo used tidy spreadsheets. Real schedules of values have merged cells, hidden tabs and a different layout from every broker.

   How the design avoids it

   Pilot on last quarter's real submissions, every broker, and confirm each new layout once with a person.

2. 2

   Goes wrong

   A value is read in thousands instead of pounds, and nobody notices until the cat model does.

   How the design avoids it

   Plain code checks units and reconciles totals against the slip, and anything that doesn't reconcile goes to a person.

3. 3

   Goes wrong

   Appetite rules live in a prompt and drift away from the line guide.

   How the design avoids it

   Guidelines are retrieved from versioned, owned documents, and authority limits are hard rules in code.

4. 4

   Goes wrong

   Underwriters treat the summary as the submission, and miss a fact in an attachment the firm is treated as knowing.

   How the design avoids it

   Every summary links to its sources, flags what it couldn't read, and peer review checks the source documents, not just the summary.

5. 5

   Goes wrong

   A one-off data model is built, so nothing can be shared with brokers or the market later.

   How the design avoids it

   Map to Core Data Record and ACORD-aligned fields from the start.

1. Under way in 2026–2027
   The London Market Group's Data Council keeps extending the Core Data Record: treaty reinsurance (v3.3, 2026), first notification of loss data (October 2026), a delegated authority consultation, and work to build it into the next version of the market reform contract.

   Map extracted data to the current CDR version and keep the mapping as configuration, so each new release is an update, not a rebuild.

2. 2026–2030
   The London market's 2026–30 modernisation plans, which move step by step rather than through one central platform.

   Don't wait for a market platform to clean the data. Design for email and structured data side by side, and take structured feeds as they appear.

3. Q1 2027
   The FCA's policy statement following CP26/23 on the Consumer Duty in wholesale markets, distribution chains and non-UK business.

   Record customer type and UK connection on every submission now, so you can apply whatever scope the final rules set.

4. 18 March 2027
   The PRA's and FCA's operational incident and third-party reporting rules (PS7/26 and PS26/2) take effect, with an updated SS2/21. Firms keep a register of material third-party arrangements.

   List the AI, cloud and model providers in this design, decide which are material, and map them to your important business services.

5. 2026–2027
   The ICO's code of practice on AI and automated decision-making, required by regulations in force since May 2026.

   Keep the decision log, sources and underwriter decisions in a form you could show the ICO, especially for sole traders and small businesses.