Vibe-coding poses governance risks for insurers
Douglas Dick, KPMG’s UK head of emerging technology risk, says the prevailing myth is that AI-generated code eliminates the need for governance in vibe-coding across the market today overall.
The Siren Call of Vibe-Coding
The term vibe-coding was coined by OpenAI co-founder Andrej Karpathy in a statement made on the social media platform X in February 2025. He wrote that this is “possible because the large language models (LLMs) are getting too good.” Later that year, vibe-coding was added to the Collins English Dictionary and defined as “the use of AI-prompted by natural language to assist with the writing of computer code.”
Read Also: UK insurance sector celebrates gender progress
This formal acknowledgment came as adoption surged, including within the insurance industry. A report from Gallagher Re, published in August 2026, highlighted how established (re)insurers were increasingly creating their own tools and platforms through vibe-coding. However, this hands-off method of software creation has sparked concerns about regulatory oversight, accountability, and compliance—particularly in the tightly controlled UK insurance market.
Such worries are amplified by the fact that AI implementation in the UK is expanding faster than the development of governance frameworks. A 2025 survey by Ernst & Young, which polled 50 senior executives from UK financial firms, found that 26% reported having no or only minimal safeguards to ensure their AI systems complied with legal standards. This lack of oversight is striking given that 34% of firms claimed to have fully integrated AI into operations, while another 44% said they had multiple AI systems in place.
Risks in the Code
In truth, he argued, the practice only heightens the necessity for rigorous supervision, testing, and accountability. ‘AI-produced code can introduce hidden vulnerabilities,’ Dick noted, emphasizing that thorough validation is critical—especially in highly regulated fields like insurance, where clear responsibility for decisions and traceable system changes are mandatory.
Read Also: The Hidden Cost Questions Singapore Condo Buyers Should Ask
Tim Hardcastle, CEO of insurtech firm Instanda, cautioned that while vibe-coding may offer efficiencies for basic or standalone applications, its potential as a universal shortcut is overstated. He compared the allure of rapidly deploying AI-built systems to the mythical sirens of The Odyssey, warning that relying on it to overhaul critical infrastructure risks ‘disastrous outcomes.’ Hardcastle stressed that insurers must prioritize auditability in their core systems to meet regulatory demands, particularly as some managing general agents (MGAs) are already using AI to construct quoting and policy-purchase platforms.
From Experiment to Enterprise
While there are plenty of technologies that can appear easy to experiment with, Martin Henley, chief executive at Mea Platform, said that turning them into enterprise-class, production-grade systems that can withstand regulatory scrutiny is “pretty difficult.” The insurance industry has seen this pattern before time and time again, he explained, with similar tech-driven initiatives often proving tough to “stick” because of the complexity of property and casualty (P&C), commercial and specialty lines.
