COMPOSITE ASSESSMENT, SYNTHETIC ENTITY: GOVERNANCE PATTERNS ARE CHARACTERISTIC OF THE SECTOR
01The Organisation
◈ This assessment represents a composite of real BreakPoint engagement patterns in the UK financial services sector. The company name and specific personnel are synthetic. The governance failures, structural findings, and regulatory exposures are real conditions observed in practice, and characteristic of the sector at this moment.
Organisation Profile
Cavendish Life is a mid-tier UK life insurer and protection provider. £2.4bn in-force premium. 680 employees. FCA and PRA dual-regulated. Products span term life, critical illness, income protection, and private health. Served primarily through IFA and employee benefits channels.
AI Deployment at Time of Engagement
AI operating across three material processes: initial claims triage and categorisation (since 2023), underwriting risk scoring for new business (since 2024), and personalised customer retention communications (since early 2025). Board approved an AI Governance Framework in Q3 2024.
Regulatory Context
FCA Consumer Duty (effective July 2023) requires firms to demonstrate good outcomes for customers, including where AI influences those outcomes. PRA SS1/23 addresses model risk management with specific expectations for AI-driven models. A "Dear CEO" letter in January 2025 flagged AI governance as a supervisory priority for the life sector.
Board's Understanding at Engagement Start
The board believed they were compliant. They had a published AI policy, a framework document, an AI register, and a CRO who reported quarterly on AI risk. The Chief Claims Officer had signed off that human oversight of AI-assisted claims decisions was operational. The underwriting lead believed the scoring tool was advisory only.
02What Brought BreakPoint In
"We have an AI Governance Framework. We have an AI register. Our CRO reports on model risk quarterly. We need to know whether, if the FCA walked in tomorrow and asked us to prove that humans are in control of our AI-shaped decisions, we could actually do it, or whether we'd be reaching for documents that don't say what we think they say."
Chief Executive Officer · trigger for BreakPoint engagement
The CEO had read the FCA's January 2025 letter. The CRO had attended a PRA roundtable where the question of evidential governance, not policy documents, but operational proof, had been raised explicitly. Neither was confident the answer was yes. BreakPoint was commissioned to produce a written AI control gap determination: where does human authority over AI-shaped decisions actually hold, and where does it fail?
What BreakPoint asks
Where does meaningful human authority over AI-shaped decisions fail first - under pressure, at speed, when it matters most?
What it is not
Not a framework review. Not a compliance checklist. Not a maturity model. A control gap determination - specific, evidenced, and defensible.
What it produces
A written determination the board can act on, defend to a regulator, and use as the baseline for genuine governance architecture.
03What BreakPoint Found
BreakPoint examines governance as it operates under realistic pressure, not as it appears in documentation. Each finding is classified as it actually exists.
AI categorises 43% of incoming claims at intake - determining pathway, timeline, and initial assessment criteria. No named individual holds documented override authority at this stage. The Chief Claims Officer's sign-off was at policy level, not operational authority level. These are not the same thing.
The underwriting scoring tool is described by the team as "advisory." The actual override rate is 1.8% of cases. A tool overridden in fewer than 2 in 100 decisions is not advisory, it is determinative. The distinction matters acutely to the FCA under Consumer Duty outcome rules.
Underwriters and claims handlers see AI outputs without confidence indicators. A 94%-confident AI recommendation and a 61%-confident one are presented identically. Reviewers are ratifying, not reviewing. The volume makes meaningful scrutiny structurally impossible.
The board-approved framework describes "human review at each decision stage." The operational reality is that human review happens after AI categorisation has shaped which options appear available - not before. Governance by documentation and governance by practice are different things.
Complaints and corrections logs do not distinguish AI-originated errors from human ones. The firm cannot tell the FCA what proportion of adverse customer outcomes had an AI decision in their causal chain. This is not a data gap - it is a governance blindspot with regulatory consequence.
The CRO is named as the ultimate escalation authority for AI model decisions. No formal deputy authority is documented. If the CRO is unavailable, the authority chain has no written continuation. In three of the firm's five regional claims teams, governance authority is understood informally, not operationally documented.
AI-generated customer retention communications were approved for low-risk, non-regulated correspondence. BreakPoint found the scope has extended - with limited review - into communications that touch policy terms. The governance approval does not cover the current operational scope.
The underwriting scoring model has not undergone independent validation since deployment in 2024. PRA SS1/23 expects ongoing model validation, particularly where model outputs influence material business decisions. The current validation schedule does not meet the spirit of that expectation.
Board minutes demonstrate active engagement with AI risk at a strategic level. The AI register is maintained and updated. There is genuine appetite at board and executive level to govern AI well. The gap is between strategic intent and operational reality, and that gap is closeable.
04The Two ABSENT Findings - In Detail
These are the findings that carry immediate regulatory consequence. Both require structural remediation: not policy updates, not additional review layers, but constitutional changes to how authority is held and exercised.
What BreakPoint Found
- ✕43% of claims are triaged and categorised by AI at intake - this categorisation determines which pathway the claim follows, what priority it receives, and what assessment framework applies.
- ✕The Chief Claims Officer signed off "human oversight is operational" - but this referred to the policy framework, not to named operational authority at the triage stage itself.
- ✕Claims handlers review AI triage outputs - but after categorisation has shaped which options they see. Reviewing within the AI's decision space is not oversight of that decision space.
- ✕No documented override authority exists at triage stage. No named individual. No override threshold. No record of overrides made. The control is assumed rather than exercised.
Why This Matters Now
- ›FCA Consumer Duty requires firms to demonstrate that AI-influenced customer outcomes are subject to genuine human oversight, not human review that occurs after the consequential decision has been shaped.
- ›A regulatory examination would look for: who holds authority at the triage stage, what evidence of that authority being exercised exists, and what the override trail shows. Cavendish currently cannot answer any of these questions from operational records.
- ›"We have a framework" is not a sufficient answer. The FCA's Dear CEO letter was explicit: governance must be operational, not documentary.
- ›The remediation is structural and achievable: name the authority holder at triage, define override thresholds, build the evidence trail. This is control architecture work, not technology change.
What BreakPoint Found
- ▲The underwriting AI scoring tool is described internally and in the AI register as "advisory." Underwriters retain final decision authority. The tool "supports" the underwriting decision.
- ▲Override rate: 1.8% of cases in the twelve months to March 2026. This is not compatible with the claim that the tool is advisory. A genuinely advisory tool would generate substantively higher override rates as underwriters apply their judgment.
- ▲Underwriters, when interviewed, describe reviewing AI scores, not making independent underwriting decisions and checking them against AI scores. The sequence matters: AI decides, human reviews. That is not human authority.
- ▲No confidence signals are surfaced. No source attribution. No threshold for flagging low-confidence outputs for elevated scrutiny. All outputs look identical to the reviewing underwriter.
The Regulatory Consequence
- ›PRA SS1/23 is explicit: model risk includes the risk that model outputs are relied upon beyond their intended scope or without adequate oversight. A 1.8% override rate on a model described as advisory is a model risk concern by any reasonable reading.
- ›The FCA's position under Consumer Duty: where AI influences a product decision, such as underwriting acceptance or pricing, the firm must demonstrate that the outcome reflects genuine human judgment, not AI output ratification.
- ›The model has not been independently validated since deployment (May 2024). PRA expects ongoing validation for models with material business impact. This gap compounds the override-rate finding.
- ›Remediation: restructure the workflow so underwriters form an independent assessment before consulting the AI score. Introduce confidence signals. Set validation schedule. Document the revised process as the operational governance record.
05What Changed - and What the Board Now Has
Cavendish Life has the strategic intent and the board engagement to govern AI well. What it lacked, and what BreakPoint provided, was a written determination of where the gap between intent and operational reality actually exists. You cannot close a gap you cannot see. You cannot defend a position you have not verified. This engagement provided both.
Outcome 01
Written AI Control Gap Determination
A board-ready report. Specific findings, named failure modes, regulatory exposure mapped to FCA and PRA expectations. The document the CRO reaches for if the FCA walks in - not a policy framework, but an evidenced determination of where control actually holds.
Outcome 02
Three Structural Changes to Claims Governance
Named authority holder documented at triage stage. Override threshold defined and operational. Evidence trail built into the claims management system. Claims triage AI now operates with genuine human authority at the point of categorisation, not assumed oversight downstream.
Outcome 03
Underwriting Workflow Restructured
Sequence reversed: underwriters now form an independent assessment before consulting AI score. Confidence signals introduced to the interface. Validation schedule agreed with model risk team. Override rate is now a metric the firm monitors as a leading governance indicator.
Regulatory Position
Cavendish can now evidence - from operational records, not policy documents - that human authority over AI-shaped claims and underwriting decisions is named, exercised, and traceable. The board has a defensible position for FCA supervisory engagement.
Delivered in 8 Working Days
From initial diagnostic session to board-ready written determination. Not a six-week consulting project. Not a maturity framework. A specific, evidenced, actionable finding, the kind a regulated firm can put in front of its board and its regulator.
Follow-on Engagement
BreakPoint identified the structural failures. The board commissioned a Control Lens L1 review to produce a full governance architecture specification, covering all AI-active processes, not just claims and underwriting. The BreakPoint determination formed the foundation of the L1 scope.
Control Lens L1Governance Architecture Review
06What BreakPoint Established About Financial Services AI Governance
The Cavendish engagement confirmed a pattern BreakPoint encounters consistently in regulated financial services: the gap between documented governance and operational governance is real, material, and almost always invisible to the board until something goes wrong, or a regulator asks.
A framework document is not governance
Every firm BreakPoint has worked with in the financial sector has an AI Governance Framework. None of them are wrong. Most of them are incomplete, because they describe intended governance, not actual governance. The FCA and PRA are asking for the latter. BreakPoint determines which one you actually have.
Advisory is a word, not a mechanism
Describing an AI tool as "advisory" without measuring override rates, structuring the decision workflow to enforce genuine independent human judgment, and building a traceable authority record is governance by aspiration. The 1.8% override rate is the number that matters, not the word in the policy document.
Downstream review is not upstream authority
Humans reviewing AI outputs after AI has shaped the decision space is not human authority over the AI decision. It is human ratification of it. Regulators are increasingly alive to this distinction. Governance architecture must place human authority before AI consequence, not after it.
Regulatory exposure is not evenly distributed
Cavendish had six AI-active processes. Two of them carried acute regulatory exposure. Four were manageable. BreakPoint finds the two. It does not treat the organisation as uniformly at risk, it locates where the risk actually lives, and tells the board why it matters there and not elsewhere.
The board needs a determination, not a score
Maturity models give scores. Compliance checklists give lists. BreakPoint gives a written determination, a finding the board can act on and defend. There is no score to hide behind and no rating to negotiate. The finding is what it is. That is what makes it useful.
Note on this assessment: Cavendish Life is a synthetic organisation created to demonstrate the type, depth and specificity of BreakPoint engagement output in the UK financial services sector. All governance failure patterns, regulatory exposures, and structural findings described are characteristic of real conditions observed in the sector. The firm name, personnel details, and specific metrics are illustrative. Any resemblance to a named organisation is coincidental.
Luminary Diagnostics · BreakPoint: AI Control Gap Assessment
The question is not whether your AI governance framework exists.
It is whether it holds - when it matters, under pressure, in front of a regulator.
BreakPoint produces a written determination of where human control over AI-shaped decisions is real, evidenced, and defensible - and where it is not. Delivered in 8 working days.
Book a BreakPoint conversation →