AI file checking is here. A growing number of services now offer to review your advice files automatically, at a fraction of the cost of a human case checker. Some firms will see that price and ask: if AI has checked the file, why pay a compliance consultant to check it again?
It's a fair question. I started my compliance career checking cases and have run large teams case checkers for many years, so I know what good checking looks like and what it can miss if done incorrectly. My answer is therefore quite simple: It’s a great idea for firms to use AI to check their files, but nothing (and I mean nothing) replaces a person to judge the advice.
Compliant isn't the same as suitable
A compliant file has every document in place. A suitable file shows the client got the right advice. You need both. They are different things.
From a claim perspective, you can defend a suitable case with gaps in the paperwork, but you can't defend unsuitable advice, however tidy the file.
Formulaic checklists share the same limit. The FCA's Defined Benefit Advice Assessment Tool (DBAAT) and Retirement Income Advice Assessment Tool (RIAAT) are useful and it's good to see the regulator provide them to help firms. But I've seen cases pass them that I wouldn't consider suitable. I've also seen cases fail them that I would happily defend. Passing a checklist doesn't prove the advice was right.
In a similar way, AI is very good at following a checklist, but for the same reason as the FCA assessment, tools have limitations. And this is why AI checking cannot, and should not, be the whole answer.
Where AI earns its place
Let me be clear, none of this is an argument against AI.
The tech can read every file for completeness and structure, every time, at a cost no human team can match. It follows a process without getting tired or bored. And that's a real gain.
AI has already fixed problems that have cost firms dearly. Meeting notes that never got written. Reports with the wrong client name. Template fields left in square brackets. AI has closed so many gaps. I can’t fault it for that.
But here’s what I’d like to see as an insurer. Use AI to check 100% of your files for completeness and structure. Then keep your independent human check at the level you use today. In our experience, firms have often used third-party checking on 10% to 20% of cases. Keep that volume and aim it at the advice most likely to go wrong, such as new product advice. Annual reviews and top ups carry less risk, so you can weight your human sample away from them. Keep a person on the advice where a mistake might cost your client and your firm most.
AI lets you check everything in-house and keep that external challenge where the risk sits.
It is also worth adding that even the best in-house compliance team loses objectivity over time. Reviewers sit alongside the advisers whose files they check. They know the clients. Assumptions go unchallenged because that's how the firm has always worked.
When I had around my own team of case checkers in-house, I still used third-party QA. I had samples blind-checked by multiple consultancy firms and compared their findings with ours. It was the only way to stop our own process becoming complacent.
AI doesn't solve that problem. An AI tool checks against the rules it was given. It doesn't challenge those rules. It can't ask whether the advice made sense for this client, at this stage of their life. It has never sat across the table from a client or seen a case reach the Financial Ombudsman Service.
The biggest risk sits with the person
I guess it’s fair to say that my biggest concern isn't AI. Rather it's the adviser using it.
We know AI gets things wrong. We know it hallucinates. Right now, most advisers read their AI meeting notes before they go on file. The better AI gets, the less likely they are to keep checking them. That's when a fundamental error can slip through.
In fact, we heard of a case recently where AI meeting notes flagged a client as having suicidal thoughts. The client had made a half-joking remark about going to Dignitas in Switzerland rather than going into care. The adviser understood it straight away. The AI tool didn't. Left uncorrected on file, that note could turn a routine complaint into a vulnerability failure. The complaint might not even come from the client. Indeed, it could have come from their executors.
At BareRock we will often run the same piece of work through AI separately and compare the results. The outputs rarely match. If AI can't agree with itself, you can't rely on it unchecked.
There are no special FCA rules for AI. The existing rules apply. The FCA's SYSC rules expect you to have effective systems and controls over the processes you rely on. If you use AI to check your files, you need to check the AI. If you buy that check from a third party, the outsourcing rules apply too. You can outsource the task, but you can't outsource the responsibility. The FCA's Mills Review, published earlier this year, reached the same view. The existing framework still applies. The focus sits on the people and controls around the technology.
AI is writing the complaints too
And there's another twist here too. We now see a growing number of complaint letters that appear to be drafted using AI. Claims management companies and disgruntled clients are using these tools to hunt for structural gaps in the file and leverage regulatory wording to build a case against the firm.
Vulnerability is an obvious target for these automated fishing expeditions. Was the client vulnerable? Did the adviser identify it? Where is the objective evidence on file?
When an AI complaint generator probes your files, vague meeting notes or subjective adviser impressions won't withstand scrutiny. But it is also interesting to see that those AI generated complaints sometimes contain mistakes such as incorrectly referenced FCA rules or client circumstance, rather reinforcing the point that left unchecked, it is still fallible.
What this means for your PI
Insurers price risk on evidence of control. At BareRock, firms that show regular independent file review have already benefitted from enhanced Club scoring and better terms. AI doesn't change that, it makes the underwriting questions sharper. Who checks the AI's output? How often? What happens when it gets something wrong? Can you prove it?
My advice is thus simple. Use AI for the volume work and let it check every file for structure. Keep an independent person with real-world experience challenging the advice, and make sure someone checks the AI too. That combination makes you more efficient, keeps your costs down, and makes you a better PI risk. AI-only checking might look cheaper today, but honestly, it may cost you far more when a claim arrives.
