The aviation sector faces escalating cyber risks as digitalisation deepens across flight operations, maintenance, and passenger services. Cyber threats are becoming increasingly sophisticated, targeting critical systems such as avionics software, flight planning tools, and airport IT infrastructure. A successful breach could disrupt navigation, compromise safety, or ground entire fleets, leading to severe financial and reputational losses. Regulators are tightening cybersecurity compliance, pushing operators to invest in robust defences. Insurers are responding by expanding cyber liability offerings, often bundling them with traditional aviation policies, while introducing stricter risk assessment protocols and premium adjustments for operators with inadequate cyber resilience.

In September 2025, the UK Civil Aviation Authority published the electric Vertical Take-Off and Landing (eVTOL) Delivery Model in anticipation of commercial flight operations by the end of 2028. The Delivery Model provides a regulatory framework addressing certification, pilot licensing, vertiport integration, and operational approvals. The pioneering technology of eVTOLS represents a bold step toward a cleaner, smarter future for aviation — one that not only accelerates decarbonisation but redefines how we connect and move across the globe. eVTOL assembly and battery production facilities have been established in the UK to support certification and early production. By positioning itself at the forefront of aerospace innovation, the UK seeks to unlock new possibilities for sustainable travel and economic growth. As we edge towards commercial eVTOL operations, this is dialling up a need for a range of tailored advanced air mobility (AAM) insurance cover to include hull liability, war, passenger, cargo, third party liability, spares, hangar keeper and product liability insurance. In 2026, we will see the London and global aviation insurance market continuing to evolve, to respond to the needs of emerging AAM technology.

With ongoing advances in aviation automation and autonomous flight there is a need to reconsider related legal and regulatory frameworks. The UK Civil Aviation Authority, in conjunction with the Law Commission of England and Wales, is undertaking a three-year review of existing liability models relating to the future of flight modes including electric Vertical Take-Off and Landing (eVTOL), drones, novel air traffic management and air navigation services to uncrewed aircraft. A final report is scheduled to be published in early 2026. Included in the review are current mechanisms for attributing criminal and civil liability. In particular, the Law Commission is considering (i) where the law allocates responsibilities to a human (e.g. a pilot) and the issues that arise if functions are performed by autonomous systems and (ii) how to allocate civil and criminal responsibility where functions are performed by a system or shared between a human and a system. Meanwhile, in its general Discussion Paper ('AI and the Law') published in July 2025, the Law Commission, in provoking debate, suggested that the option of granting some AI systems legal personality is increasingly likely to be considered. One key objection against that argument is that AI systems might be used as 'liability shields' protecting those at fault from criminal and/or civil accountability. In the field of aviation, where safety, responsibility and accountability are paramount, we predict any such future proposals will be met with strong resistance.

The rise of AI shows no signs of abating, and the potential use cases are exponential. For athletes, data will increasingly be used alongside AI to prevent welfare issues, be they physical, mental or emotional. From mental health monitoring to bio-mechanical data to detect the risk of injury, and from wearables that warn of fatigue and poor recovery to instrumental mouthguards capable of detecting potential head injuries, expect technology to become increasingly prevalent in proactively managing welfare in elite sports. Technological change, particularly where it is likely to filter down from elite to lower and grass-roots level, will be a game changer for individuals, clubs and associations.

The growing incorporation of technology in the construction industry and pressure to reduce energy wastage has led to increasing numbers of buildings utilising smart technology. Smart buildings include analytical tools which can predict the needs of those using the building and monitor parts and systems, flagging them for repair or maintenance. Sensors in a smart building's infrastructure can have a positive effect in terms of reducing energy usage and carbon emissions. However, smart buildings are challenging to design and build, often requiring sophisticated construction techniques and complex mechanical and electrical infrastructure which can lead to claims against the contractor and professional team if they do not meet requirements. Smart buildings are also more at risk from cyberattacks than legacy buildings: a hacker who gains access to a building's system can cause chaos.

A new-ish but under-used industry Code will be written into more policies as the frequency and severity of water damage incidents on construction sites increases. Recognising the need for robust risk management, experts from both the insurance and engineering industries have developed a Joint Code of Practice for Escape of Water (EoW) Prevention and Management on Construction Sites and Buildings Undergoing Refurbishment. The Code applies across the supply chain to both permanent and temporary water systems and puts in place a collaborative risk-based approach that addresses the root causes of EoW during pre-construction and construction phases and mitigates the effect when it occurs. The focus on prevention includes the incorporation of modern technology to detect anomalous flow rates and then automatically isolate pipework and inform the planned emergency response. EoW incidents can lead to costly claims due to delayed handovers, damaged materials and wasted resources but they can also adversely impact a project's environmental and sustainability goals to monitor and reduce water consumption. Risk management is key and insurers should write in Code compliance to ensure that good practice is stringently followed.

AI is increasingly being used by financial services companies to drive operational efficiencies through automation and advanced analytics. It has fundamentally changed loan and investment decision-making by enabling the rapid analysis of vast amounts of data about a particular sector, supporting swift, robust and informed decisions. AI has also revolutionised fraud detection, customer service, risk management, and regulatory compliance. While AI delivers significant efficiencies and innovation, its widespread adoption raises concerns about overreliance. Where investors suffer a loss, this can lead to claims against financial institutions that deploy these technologies (as seen in Tyndaris v VWM). Oversight and ongoing monitoring are essential to mitigate these risks and ensure responsible use of AI in the financial sector.

As the sector seeks to unlock the value of its datasets for analytics and AI training, the tension between anonymisation and pseudonymisation is becoming ever more pressing. True anonymisation remains the gold standard but often strips away the richness that gives data its value. Pseudonymisation preserves that utility but keeps data within the scope of data protection law. The Court of Justice of the European Union's SRB decision brings welcome nuance, confirming that whether pseudonymised data counts as personal depends on the realistic means of re-identification available to the controller, not theoretical possibilities. This more contextual approach could open new space for innovation, provided businesses can show re-identification risks are genuinely low. Those in the sector that invest early in verifiable safeguards and governance frameworks will be best placed to harness data confidently and compliantly in the age of AI.

Agentic AI (systems made up of autonomous agents that are capable of independent interaction and decision making) poses heightened data protection risks. Although it brings notable benefits in terms of efficiency and innovation, representing another evolution beyond generative AI, it also introduces new challenges. Unlike some earlier AI systems, many typical agentic AI system use cases rely heavily on processing personal data, including special categories of personal data or other sensitive categories such as financial information. Although many organisations have so far managed to apply governance controls to the use of generative AI in the workplace, the reduced human oversight evident in agentic AI significantly increases the challenge of implementing the same controls. As a result, data protection risks are likely to intensify.

Over the next 12 months, we will see greater adoption of privacy enhancing technologies (PETs) and their closer integration with AI systems. For several years, PETs have been highlighted as having the potential to aid data protection compliance, in a variety of different contexts. In its 2023 guidance on PETs, the ICO specifically cited privacy by design and by default; data minimisation; security; and secure data sharing as capable of being supported by PETs. However, since then we have seen only intermittent PET adoption by organisations. In the coming year, PETs such as homomorphic encryption and federated learning will be used increasingly to train AI models.

As quantum technology develops, we expect cyber insurers to start considering the potential systemic risks associated with the post-quantum era. Developments in quantum technologies are advancing rapidly and will offer huge opportunities to improve our lives. However, quantum computing will also pose the next significant challenge to cybersecurity and organisations are being urged to take steps to prepare for this now. The National Cyber Security Centre has already published guidance on the timeline for the migration to post-quantum cryptography (PQC) which starts now by identifying information, systems and cryptography which is at risk and ends in 2035 with the complete migration to PQC for systems, services and products.

The insurance sector has embraced AI at speed, deploying it across underwriting, claims and customer engagement. Yet regulation is struggling to keep pace with the technology’s rapid evolution. Current frameworks were not designed with self-learning systems or generative models in mind, leaving gaps around accountability, transparency and bias. For now, regulators are watching closely, with guidance rather than enforcement. But history tells us that regulatory intervention often comes after the first high-profile failures or consumer harms. When that moment arrives, we can expect tighter controls on explainability, governance and oversight of AI. For the sector, the message is clear: use this breathing space to build robust controls now, before regulators mandate them.

The ever growing prevalence of lithium-ion batteries across a wide range of products is increasing the risk of fire losses to vessels and cargoes. Batteries have been identified as the cause of a recent spate of scrap fires on vessels leading to major casualties. The problem stems from hazardous materials, particularly batteries, being present in supposedly inert scrap cargoes due to improper disposal in household waste streams. These batteries can spontaneously ignite or cause fires during handling and transportation, leading to intense, difficult-to-extinguish blazes that endanger ships and crews. Insurers and safety organisations are issuing warnings and recommending better screening and handling procedures for scrap metal cargoes. Incidents of battery fires on mega yachts are also on the rise. Mega yachts use an increasing number of lithium-ion batteries to power their advanced electronics, luxury amenities, and growing fleet of electric tenders and water toys. Incorrect use and maintenance coupled with insufficient crew training can lead to significant losses.

As anticipated, the use of AI in clinical practice continues to become more prevalent, with an increasing trend in both primary and secondary care being the use of AI-assisted medical transcription tools for transcribing patient appointments. While there are benefits to the use of this technology – active listening, better quality consultations and reduced administration time, particularly for a reducing GP workforce – its greater use does lead to the increased risk of transcription errors and associated claims for compensation from any patients coming to harm, as well as an increased risk of claims based on alleged breaches of data protection laws. Healthcare providers and insurers dealing with any such claims will need to be alive to the ongoing uncertainty as to who has responsibility, or where the accountability lies, when something goes wrong with AI products generally. Given this uncertainty, it is entirely possible that certain jurisdictions will seriously consider the merits of a strict liability regime to deal with claims arising from AI errors. Indeed, this is already happening; in the European Union, for example, the new Product Liability Directive that came into force in December 2024 is a strict liability regime enabling consumers to pursue a claim where a defect in a product has caused personal injury or property damage. The scope of this directive is now wider in scope than previously and specifically includes software and AI.