In the US, the gap between insurance brokers and their brokerages now has numbers on it. Liberty Mutual's latest survey of independent agencies found 65% of agents had used AI for work in the past year. Only 14% said their agency had formally adopted an AI tool, Insurance Business reported last week.
There is no Australian survey that separates what brokers do from what their brokerages have approved in the same way. The local research that does exist points to a similar pattern though. And from December 10, firms covered by the Privacy Act will have to start disclosing some of their AI use.
Finance and insurance businesses are among the heavier users of AI among Australian SMEs. NAB's research found 64% of finance and insurance SMEs used AI, compared with 42% across all industries. Most firms in the sector used it for operations rather than marketing. Cost and efficiency was the main expected benefit for 29% of them, the highest share of any industry.
Employee use does not always match company policy. In the University of Melbourne and KPMG's 2025 study of trust in AI, 44% of Australian employees said they had used AI in ways that went against workplace policies or guidelines. A further 57% said they had relied on AI output without checking it was accurate.
The study covered workers across all industries rather than brokers specifically. For brokers, though, unchecked output can end up in a client's policy schedule or advice.
Read next: AI roll out is outpacing risk controls, Gallagher warns
ASIC raised the issue in 2024. Its review of 23 financial services and credit licensees covered 624 AI use cases. It found that some licensees' governance and risk management had fallen behind their use of AI, which ASIC said created the greatest risk of consumer harm (Report 798). Most licensees were updating their rules while expanding their use of AI, rather than before.
ASIC's chair at the time, Joe Longo, referred to the "potential for a governance gap". He said around 60% of the licensees planned to increase their use of AI.
Not every brokerage fits the pattern the survey data describes. Shane Brady, director of Stone Lane Broking & Risk Advisory, said his firm has already documented what staff can and cannot do.
"At Stone Lane we have clear expectations and boundaries around what the approved AI tools are that staff can use and in particular, how client information should be handled," he told Insurance Business. "We manage this as part of our AI Integration Guidelines; a document that each staff member receive and are expected to follow in their day to day responsibilities."
He said the work does not stop once the document exists. "I'm confident we have very strong oversight and visibility over this and recognise that such a dynamic and everchanging technology requires ongoing training and attention as AI technology grows and changes exponentially."
Brady said the regulatory setting is what makes the distinction between approved tools and actual use matter. "Insurance is already a heavily regulated industry, particularly when it comes to how client information is collected, used and protected. That makes it especially important that firms understand not just which AI tools they have officially approved, but what their staff are actually using day to day."
He added: "The development and improvement of AI tools easily outpaces that of human-based tech and firms need to make sure they implement safeguards to keep client and company data safe and contained."
Cynthia Yap, managing director of Dynamic Insurance Services, drew the same line but was more cautious about how much any principal can claim to know.
"I would distinguish between knowing which AI tools have been approved and knowing how they are actually being used," she said. "Before claiming complete confidence, I would want to verify both the tools people are using and the client information they are entering. An approved list alone does not establish that visibility."
Yap said the risk is not confined to staff who are trying to cut corners. "Employees may be trying to improve efficiency, but good intentions do not protect client confidentiality." She said someone "can introduce a privacy risk simply by uploading a client's policy schedule or claims information into an unapproved AI tool, even when their intention is to provide faster service".
From December 10 2026, organisations covered by the Privacy Act must state in their privacy policies when computer programs, including AI, make decisions that could significantly affect a person's rights or interests. The rule also applies where a program's output is substantially and directly related to a decision a person makes. The requirement is set out in a new Australian Privacy Principle, APP 1.7. The explanatory memorandum to the 2024 amending legislation uses a life insurance contract as an example of a decision it covers.
To comply, a brokerage first needs to know which tools staff are putting client information into. Smaller brokerages should check with their advisers whether, and how, the obligation applies to them.
Read next: AI is coming for insurance's middle – but brokers still own the moment that matters
For licensees running authorised representative networks, the question is not only what employees are doing. Yap said the structure itself changes the scope of the task.
"ARs operate their own businesses and are not employees of the licensee," she said. "Oversight therefore needs to extend beyond the licensee's internal staff to how its representatives use AI."
That means the licensee "needs visibility of the tools used across those businesses, including by their staff", she said, adding: "I would only claim confidence after checking actual practices, rather than relying on a policy or an approved list."
Yap said licensees can reduce the problem by making approved tools genuinely usable. "Providing an approved, useful alternative also reduces the incentive to use personal AI accounts."
Some networks are building AI into the systems brokers already use, rather than leaving brokers to find tools themselves. Community Broker Network has rolled out insurtech COVA across its authorised broker network. More than 400 of its 1,400-plus brokers use it for policy comparisons, pre-renewal reports and client summaries. CBN says those brokers save more than five hours a week on average. That figure has not been independently verified.
"This is not about replacing brokers. It is about empowering them," said Nese Akay, CBN's executive general manager of strategy and innovation.
CBN chief executive Richard Crawford told IBTV that AI can make information easier for brokers to access. He also warned that if it pushes broking towards a purely transactional model, brokers could lose some of the skills needed for complex risks.
Read next: Most financial institutions now use AI, survey finds
The December start date gives principals a deadline for a basic review. That means identifying which AI tools staff use and what client data goes into them, and deciding which tools are approved. It also means making sure a person checks AI-assisted work before it reaches a client. Firms should then assess whether any of that use feeds into decisions the privacy policy will now need to disclose.
Yap said the assessment of a tool should go further than whether the firm is paying for it. It "should examine where information is stored, who can access it, how long it is retained and whether the provider can use it to train its models. A paid subscription alone is not assurance that client information is protected."
She said rules should also cover what goes in. "Wherever possible, users should work with de-identified information and provide only what is necessary for the task. Removing a client's name alone may not be enough if other details still identify them."
For AR networks, she said, those requirements "should form part of the licensee's compliance framework, supported by practical training, declarations of tools used, periodic checks and a clear process for reporting accidental disclosures".
Brady said training is the part his firm treats as continuous rather than one-off. "We implement AI specific training sessions for all employees to help maximise the benefits of AI while managing the associated risk as best we can."
Both brokers landed in the same place on what the technology does not change. As Yap put it: "AI can assist a broker, but it cannot replace professional judgement."
