It is likely that the government's proposed ransomware payment ban, impacting public sector bodies and operators of critical national infrastructure (CNI), will come into force in 2026 and marks a significant shift in the UK's national cyber policy. The exact scope of the legislation remains to be seen, particularly whether the ban will extend to privately owned organisations within the public and CNI sectors, as well as their suppliers. In response, insurers will likely reassess underwriting appetite to reflect a changed risk exposure where ransom payments are no longer a viable recovery option. The objective of the legislation is to reduce the attractiveness of public and CNI sector targets to ransomware groups. However, this theory is untested and the removal of ransom payments as a recovery option could increase the financial exposures of the sector. In the short term, this could lead to an impact on the availability of cyber insurance capacity, limits of indemnity, and amendments to policy conditions, or the emergence of separate specialised cyber products for public bodies and operators of CNI.

Following a Court of Appeal decision in 2025, insurers may look to revise composite policy wordings to limit exposure. The ruling clarified that, unless explicitly stated otherwise, each insured under a composite policy is entitled to a separate limit of indemnity. To mitigate this, insurers may introduce clearer aggregate limit clauses, redefine the structure of composite contracts, or implement sub-limits per entity. Insurers will need to manage any changes fairly and transparently.

Policy wordings are evolving to reflect the increased role of AI in day-to-day business operations. Policyholders, and indeed brokers, continue to seek clarification on the adequacy of their insurance programmes and be keen to see policy wordings affirming AI-related risks. We expect to see more product innovation in the market, as well as insurers seeking to limit or condition riskier AI-related exposures. Policyholders should review policies for AI-specific exclusions, ensure ethical AI practices, and stay informed about how insurers use AI in pricing, risk assessment and claims handling.

We will likely see further development in terrorism policy wordings as a result of the 2025 update to Pool Re's Treaty. The update introduced several amendments which we will see carried forward into policy wordings. Changes include a bifurcation of risks into conventional and non-conventional terrorism, which insurers may seek to replicate into their wordings. We anticipate further innovation and expect a shift away from standalone terrorism cover towards an embedded cover that reintroduces cover into standard commercial property wordings.

Insurers are likely to undertake a comprehensive review of policy wordings, particularly in home and travel insurance, in 2026. In the latter part of 2025, Which? submitted a 'super-complaint' to the Financial Conduct Authority focusing on several problems identified in home and travel insurance. Consequently, and despite insurers having undertaken significant steps over the last few years to simplify their wordings in light of various regulatory pressures, insurers may seek to undertake a root-and-branch review of such products, including a focus on clear policy wordings.