There is a version of the build-versus-buy conversation being had across UK insurance technology right now that starts from a false premise: that buying a technology capability transfers the risk that comes with it. Under UK financial services regulation, that is not how it works. And under the operational logic of building a genuinely differentiated business, it may not be how it should work either.
Eugene Owusu, director of transformation and global compliance at Liberty Mutual Insurance, opened the Insurance Business UK Leaders Network's debut digital transformation roundtable with a formulation that captures both the regulatory and strategic dimension in a single sentence. "You can outsource capability, but you can't outsource the accountability. So from a regulatory perspective, that very much sits with us."
At Liberty, the test that follows from that principle is specific: "Which capabilities can we outsource to vendors, or can we use third-party vendors for, versus what do we keep in-house? It's very important that when it comes to our products, customers, that controls our risk appetite - we always retain that level of knowledge and capability in-house."
George Dagnall, NED at Hotspot Cover and director of insurance and partnerships at Concentrix, puts the same logic in terms that apply directly to a broker or specialist insurer. "When relying on vendors, it will be commodity, infrastructural, cloud hosting, CRM tools, standard communication rails - anything that doesn't really involve our core IP. But from a business that deals with intelligence, triage protocols, and how we intervene, which is where our bread and butter is, we have to take ownership of that because that's us."
His articulation of the competitive risk is precise. "If everyone's relying on the vendors and that's their IP, then someone at some point will do it better. So it's about knowing where we fit in and where the vendors fit in."
The formulation he returns to is the most useful in the conversation. "We buy the utilities, but we sort of build our soul as a business."
For FCA-regulated firms, the outsourcing reality is governed by SYSC 8, which requires firms to remain in control of material outsourcing arrangements. Since March 2025, UK operational resilience rules have additionally required that important business services remain within impact tolerances even when supplier-dependent. The Bank of England's designation of Critical Third Parties means that technology providers serving multiple regulated firms at scale are now themselves subject to regulatory oversight.
The FCA's 2025 AI Update reinforced the accountability point: responsibility for AI-driven decisions, including those produced by third-party vendor models, cannot be outsourced to the model or the vendor. SM&CR accountability remains with the regulated firm's senior managers regardless of how the technology capability was sourced.
As one legal analysis of the regulatory position noted: "Outsourcing the build never outsources your accountability. Under UK rules, a regulated firm stays fully responsible for services it hands to a third party."
A recent survey of executives across industries found that 87% believe third-party risk is more important than it was three years ago. In insurance, where data includes sensitive personal and commercial information and a breach can trigger FCA enforcement alongside client claims, that is not an abstract concern.
The discipline Dagnall describes for vendor selection is applicable more broadly than specialist lines. Understanding what data a vendor is providing, in what format, through what mechanism, and with what guarantees of accuracy are not questions to be answered after a contract is signed. They are the questions that determine whether a vendor relationship can deliver what the buying firm needs.
"Making sure that the systems that we're taking that data from are sending it in a way that we can receive through an API, but that the data lands correctly and cleanly" is Dagnall's technical minimum. But the deeper question - whether a vendor relationship can actually be governed, and whether a firm can demonstrate to the FCA what that vendor is doing on its behalf - is the one most firms are not asking rigorously enough.
Owusu frames the governance test for vendor selection directly. A technology solution that cannot provide audit trails, data lineage, and evidence of customer outcomes is not a compliant solution for a UK-regulated insurer or broker, regardless of what it does to efficiency metrics.
Paul Waring, director of IT and CISO at Blagrove Underwriting Agency, has reached a different conclusion entirely and built the infrastructure to support it. "We do everything in-house pretty much. We have our own in-house platform that does underwriting, claims, accounts, reporting, pretty much everything apart from email." The incremental change model that results - updating the production system several times a week rather than one big change quarterly - keeps the firm in control of its own architecture without the disruption of large-scale vendor transitions.
Not every firm has the capacity to do what Blagrove does. But the principle holds regardless of the answer. Utilities can be bought. Where the answer to "what makes us different" starts to implicate a technology decision, accountability for what that technology does will remain with the firm - whether it built the capability or bought it.
