AI Answer Summary

In insurance defense, carriers are now writing the AI rules. The Hartford, for example, conditions every panel assignment on fifteen AI obligations, including a written firm AI policy, disclosure of AI use in each time entry, records sufficient to recreate that use, audit rights for the carrier and its third-party auditor, and indemnity for any breach.

Those audit rights can collide with the insured's confidentiality. Under ABA Formal Opinion 01-421, a lawyer may not give the insured's confidential information to a third-party auditor hired by the insurer without the insured's informed consent, and the insurer cannot give that consent on the insured's behalf.

The best place to start is the carrier's own list of non-billable overhead, which includes indexing medical records, OCR and Bates numbering. Automating that work costs the firm nothing in revenue, because the carrier was never paying for it.

What Makes AI Different in Insurance Defense

AI for insurance defense firms raises every question other firms face, plus one that only this practice has: who consents, when the party paying for the work is not the party whose information is in it.

The reason is the three-way relationship at the centre of the practice. The carrier pays for the defense and sets the rules. The insured is the client. Defense counsel sits between them, owing the insured independent professional judgment while working inside the carrier's guidelines.

Most of the time these three want the same thing, which is an efficient, competent defense. This article is about the places they do not, and those places multiply once AI enters the file.

Where Insurance Defense Firms Should Start With AI: The Carrier's Own Overhead List

Start with the work your carrier has already told you it will not pay for.

The Hartford's billing guidelines, revised in April 2026 and adapted from the DRI Guidelines, list tasks the carrier treats as overhead that cannot be charged separately. Several of them are exactly the work automation handles well.

Our article on legal billing automation argued that the safest work to automate is work a firm is already writing off. In insurance defense the payer has published the list. Every item above is work the firm does, pays staff to do, and cannot bill. Automating it costs nothing in collected revenue, because none was ever coming.

The same guidelines add a threshold worth knowing. For any matter expected to involve roughly 1 GB of electronically stored information or more, the firm must discuss data management and anticipated document review with the carrier at the outset. That is the natural moment to raise an automated review process, before the volume arrives rather than after. Our article on AI document review covers how courts have treated machine-assisted review since 2012.

Lower risk is not the same as no risk, though. Because overhead goes unbilled, the carrier's requirement to flag AI in a time entry never arises for it. The carrier's general disclosure obligation still applies, and indexing medical records means handling the insured's confidential information under every confidentiality rule that governs the rest of the file.

What Carrier AI Guidelines Require of Panel Counsel

The Hartford conditions acceptance of every assignment on fifteen AI obligations, and the agreement survives the end of the relationship. It is one carrier, but a large one, and the structure is a useful map of what to look for in any panel's guidelines.

Carrier guidelines checked 29 September 2026. Both pages show a revision date of 20 April 2026.

Disclosure and Billing Rules

Every time generative AI is used for a legal task, the time entry has to say so, using the terms "Generative AI," "Gen AI" or "GAI," and has to name the specific program. That sits on top of the carrier's existing line-item rules: block billing is not acceptable, and vague entries will not be paid. The guidelines give "legal research" itself as an example of an entry too vague to honour, since the reasonableness of each task is assessed on the description counsel provides.

Confidentiality and Tool Restrictions

Before any nonpublic information goes into an AI system, the firm has to check that provider's confidentiality, security and retention protocols, and then use only as much nonpublic information as the task needs. One restriction is absolute on its face: no nonpublic information in an open-source AI system. The section on ChatGPT below looks at what that wording means in practice.

Records, Audits and Indemnity

This is the group that turns AI governance into a contract term. The firm must maintain written AI policies. It must keep records of inputs, prompts, data and decisions detailed enough to recreate any generative AI use. It must let the carrier, or the carrier's third-party auditor, audit that use and the related billing. And it must defend and indemnify the carrier against claims arising from a breach. Our article on law firm AI policy argued that a firm should write these rules for itself. On this panel, the carrier has written them for you, and made you liable for them.

Can You Bill for AI Time in Insurance Defense?

Only for the time you spent, and never for the tools.

On Hartford panel work, the firm may charge for time spent crafting or refining prompts and reviewing or editing what comes back, and may not charge for subscriptions, licences or similar fees. The first half matches ABA Formal Opinion 512, which requires hourly work to be billed at the time spent. The carrier adds the second half explicitly.

Put the two together and the economics on billable panel work are clear. Every efficiency gain reduces the invoice, and the cost of the tool comes out of the firm's margin. A faster defense still serves the insured, so none of this argues against using AI on billable work. It does explain why overhead is the right place to start, since overhead is the one area where automation improves the firm's economics on carrier work without shrinking what the carrier pays.

The disclosure rule also changes what an auditor can see. Once every AI-assisted entry is flagged and names its tool, the auditor knows exactly which tasks involved AI, and can compare the time charged against what the task ought to have taken.

When the Carrier's Auditor Wants Your AI Records

Before a third-party auditor sees prompt records containing the insured's confidential information, you are likely to need the insured's consent, and the insurer cannot give it for them.

The collision builds in three steps.

The carrier's side. The guidelines require records of inputs, prompts and data sufficient to recreate AI use, and give the carrier or its third-party auditor the right to audit that use.

The ethics side. ABA Formal Opinion 01-421, issued in 2001, addresses lawyers working under insurance company guidelines. It holds that a lawyer may share the insured's confidential information, including detailed work descriptions and bills, with the insurer where the lawyer reasonably believes that advances the insured's interests. It also holds that the lawyer may not share that information with a third-party auditor the insurer has hired without the insured's informed consent. Summaries of the opinion explain the reasoning: the auditor is an outside vendor, the disclosure may not be essential, and it risks waiving privilege. Montana's Supreme Court went further in 2000, requiring the insured's contemporaneous informed consent before invoices go to an outside auditor.

The collision. In a defense matter, prompt records will often contain precisely the information 01-421 protects, including medical records and personal information about the insured.

The carrier supplies its own way through. Its billing guidelines state that it does not expect firms to follow any guideline that conflicts with applicable law, court rules or ethical directives. So the answer is sequencing rather than refusal: obtain the insured's informed consent to AI use, and to third-party audit of AI records, at the outset of the representation. That fits alongside a conversation 01-421 already expects, since the opinion says a lawyer should tell the insured early about the limits the insurer's control places on the representation.

One limit needs stating plainly. Opinion 01-421 predates generative AI by roughly two decades. Applying it to prompt records is our reading of how its reasoning extends, not a holding from any court or committee, and a firm should take its own counsel's view before relying on it.

Can Panel Counsel Use ChatGPT on Carrier Work?

Not with nonpublic information, on a literal reading of at least one carrier's guidelines, and the reason is worth resolving in writing.

The Hartford's guideline bars entering nonpublic information into "any open-source AI system," and gives ChatGPT as the example. ChatGPT is not open-source in the technical sense, and enterprise tiers of several general-purpose tools come with contractual commitments against training on customer data and on how long data is kept.

That leaves an ambiguity worth being careful about. The example suggests the carrier intends to exclude the product. The separate obligation to check a provider's confidentiality and retention protocols before use suggests a vetted enterprise deployment might meet the purpose behind the rule. The words point one way and the apparent purpose another, and a firm has no reliable way to know which the carrier means.

So do not guess. Ask each carrier, in writing, which tools and which tiers it accepts on its work, and keep the answer on file with the panel agreement. It is a five-minute email that removes a real exposure.

A Compliance Checklist for AI on Insurance Defense Work

Six things to have in place before AI touches a panel file:

• Read every panel's current AI and billing guidelines. They differ by carrier, and carriers revise them
• Get the insured's informed consent at the start, covering AI use and any third-party audit of AI records
• Get each carrier's written position on which tools and tiers it accepts
• Flag AI in every time entry in the carrier's required wording, naming the program
• Keep prompt and output records per matter, retrievable by matter, for the retention period
• Price AI tool costs as overhead, since panel work will not let you pass them through

Every item on that list is a record or a consent. Not one is a technology decision, which is the same conclusion our AI policy article reached about law firms in general.

How Codebridge Works with Insurance Defense Practices

We build the two workflows that matter most in this practice.

The first is document triage, so an incoming record set arrives indexed, classified and ready for a lawyer to review. That is work carriers treat as overhead, which means your firm is paying for it today and recovering nothing. The second is billing narrative cleanup, so time entries meet a carrier's specificity and block-billing rules before they reach the auditor rather than after an adjustment.

The records a carrier now asks for, inputs, prompts and decisions sufficient to recreate AI use, are part of the build rather than something assembled under pressure when an audit notice arrives.

One workflow goes live in three weeks, wired into the systems your firm already runs. Your firm owns the repository, the prompts and the configuration from day one.

We are not coverage counsel, and we do not advise on carrier agreements or on insured consent. Those decisions stay with lawyers.

The closest reference we can offer, labelled for what it is: Knowledge Cloud, built for a Big Four tax and legal practice, runs an expert review queue with an immutable audit log, so a senior practitioner approves each output before the firm acts on it. A research platform rather than an insurance defense system. What it demonstrates is the audit pattern.

Our founding team spent more than a decade at KPMG.

If you want to find out which carrier overhead is costing your practice the most, book a 20-minute call.