Outlook
Business insurance outlook to 2027: the FCA rule calendar from PS25/21 to the March 2027 incident reporting start
A dated UK rule calendar for business insurance to 2027: PS25/21, CP25/37 rules, the CP26/22 consultation and PS26/2 incident reporting, plus PII limits.
What to take away
- PS25/21 finalised simplified insurance rules, in force from 9 December 2025.
- Rules finalised from CP25/37 came into force mostly on 26 June 2026, with the remainder on 27 July 2026.
- CP26/22 is a consultation that closed on 19 September 2026, so its proposals are not final rules.
- The operational incident and third-party reporting rules in PS26/2 come into force on 18 March 2027.
- This calendar covers rules that apply across the UK. It does not forecast premiums.
The dated events
The table lists the rule events that can be checked at source, each with the FCA instrument that carries it.
| Date | Instrument | Event | Who it touches |
|---|---|---|---|
| 9 December 2025 | PS25/21 Simplifying the insurance rules | Finalised rules in force | Insurers, intermediaries, funeral plan firms |
| 26 June 2026 | CP25/37 final rules | Most of the insurance rules in force | Firms with PPI, packaged bank accounts, value measures reporting |
| 27 July 2026 | CP25/37 final rules | Remainder in force | Same firms |
| 19 September 2026 | CP26/22 | Consultation closes | Insurers and intermediaries |
| Q4 2026 | CP25/36 | Final rules and guidance expected | Insurers and intermediaries |
| 18 March 2027 | PS26/2 | Incident and third-party reporting in force | Regulated firms |
What the June and July 2026 rules cover
The CP25/37 package, titled Targeted clarifications of Handbook materials, produced finalised rules covering several insurance items. They remove specific rules for PPI and packaged bank accounts, delete product governance rules, change pricing practices and value measures reporting, and remove the minimum 12-month product review for funeral plans.
Most of the insurance rules came into force on 26 June 2026, with the remainder coming into force on 27 July 2026. For a small business buying cover, the practical effect is indirect, because the changes bind insurers and intermediaries.
Earlier, PS25/21 finalised rules which came into force on 9 December 2025. Its changes are optional, to give firms greater flexibility. Ask your broker whether they have changed their product reviews or disclosures as a result.
CP26/22: what is proposed and what is not final
CP26/22 asked for comments by 19 September 2026, after the response period was extended by two weeks. Among its proposals is amending the currency denomination of minimum professional indemnity levels for insurance intermediaries from euros to pounds sterling, without changing the underlying levels.
The consultation paper's own table lists the current limits. For firms carrying on insurance distribution activity under MIPRU 3.2.7R, the limit for a single claim is €1,300,380 and the aggregate limit is €1,924,560.
That is a proposal until final rules appear. Consultants who buy their own cover should read professional indemnity insurance for consultants, and treat any rule change as a question for the broker.
March 2027: PS26/2 incident reporting
PS26/2 is the FCA policy statement on operational incident and third party reporting. The new rules will come into force on 18 March 2027. The incident rules stay in scope for all firms, and the rules include firms with a Part 4A permission and payment service providers.
The duty belongs to the provider. For a buyer, it is evidence of how a provider handles outages. Add a question to your renewal file about how the insurer and broker will report and recover from a serious incident. Two years after implementation, a review is planned.
Cyber cover: one lever for small firms
Any UK organisation with a turnover under £20m that achieves Cyber Essentials certification covering the whole organisation is automatically entitled to Cyber Liability Insurance arranged by IASME, the scheme's delivery partner. The cost of certification starts at £320 plus VAT.
Read whether cyber insurance for small businesses is worth buying separately, and compare limits and exclusions in writing. Record how personal data is handled in the data protection file.
A renewal plan for 2027
- Ask the broker which customer category applies to your business.
- Ask how the insurer and broker will report serious incidents from 18 March 2027.
- Check whether Cyber Essentials would give you the free cover.
- Review risk scenarios and decide which losses you cannot carry yourself.
- Record the answers in a planning template and date them.
For demand and pricing, see the market outlook article.
Checklist
- Diary 18 March 2027 as the incident reporting start date.
- Ask which customer category your business falls into.
- Treat CP26/22 proposals as unconfirmed until final rules appear.
- Check eligibility for Cyber Essentials free cover.
- Date every answer you collect.
Common questions
Do the 2027 reporting rules apply to my small business?
Not as a buyer. Incident reporting applies to regulated firms, such as insurers and intermediaries with a Part 4A permission. It matters to you as a question to put to your provider.
Will premiums rise in 2027?
No source cited here forecasts small-business premiums, so this page does not. Compare quotes on the same basis at each renewal.
Which proposal could change a broker's costs?
CP26/22 proposes moving minimum professional indemnity levels for intermediaries from euros to pounds sterling, without changing the underlying levels. It was a consultation, so it is not yet a rule.
In this guide
- What will move business insurance in 2027, from incident reporting to evidence-led comparisonTrack six evidence-based business insurance trends for England in 2027, with current baselines, forecast limits and practical review triggers.
- Business insurance AI applications: intake, document checks and claimsPractical business insurance AI applications for UK firms: intake extraction, document comparison, triage and claims support, with UK GDPR and FCA controls.
- How to build a business insurance market outlookBuild a business insurance market outlook with UK evidence, small-business cover lines, renewal scenarios, triggers and a practical register.
- Five risk scenarios to test operational response and insurance policy questions, from cyber to injuryFive business insurance risk scenarios — cyber, premises, AI, supplier and injury — to test detection, notification, evidence and the policy questions raised.
