Does your cyber policy cover AI risks?

Does your cyber policy cover AI risks?

One of the most common questions risk managers are asking right now is: "Does our cyber insurance policy cover AI-related risks?"

The short answer is it depends.

As organizations increasingly embed AI into business-critical processes, boards, legal teams and risk managers are looking to cyber insurance as a potential source of protection against AI-related losses. However, it is important to understand that AI is not a separate coverage trigger under most cyber policies. The mere involvement of AI in an incident does not automatically determine whether cover applies.

Instead, insurers will typically focus on two fundamental questions:

1. Does the claim arise from a covered cyber event?
2. If so, does the policy respond to the specific financial loss that has been incurred?

For risk managers evaluating their AI risk transfer strategy, these questions are a useful framework for assessing whether existing cyber insurance arrangements are likely to respond.

Does the claim arise from a covered cyber event?

In many cases, AI will simply be the mechanism through which a traditional cyber event occurs. Where this is the case, coverage should generally respond in the same way it would if AI were not involved.

For example:

• A threat actor uses AI tools to facilitate a ransomware attack, resulting in business interruption losses or incident response costs.
• An employee uses a generative AI application and inadvertently exposes confidential or personal data, triggering a data breach response.
• AI-enabled phishing techniques are used to compromise systems or credentials.

In each scenario, the presence of AI shouldn’t be the determining factor in the coverage analysis. Instead, insurers will focus on whether the underlying event falls within the policy's insuring clauses.

Put simply, cyber insurance is typically concerned with the nature of the event and the resulting loss, rather than the technology used to cause it.

Does the policy cover the financial loss that has arisen?

The more important issue for risk managers is often whether the resulting financial loss falls within the scope of cover under their organization’s cyber policy. The involvement of AI does not create coverage where none existed previously. Even where an incident qualifies as a covered cyber event, the policy will only indemnify losses expressly contemplated by the policy wording.

Consider the following example:

An organization suffers a security breach affecting an AI model. The incident attracts regulatory scrutiny under emerging AI-specific legislation, resulting in investigation costs and potential penalties. While the cyber policy may provide cover for investigations arising under privacy or data protection laws, it may not automatically extend to investigations arising under AI regulation.

Subject to the policy wording, there is a meaningful distinction between (1) privacy regulation and (2) AI-specific regulation.

As governments around the world continue to develop AI legislation, risk managers should not assume that cover designed for privacy-related regulatory exposures will automatically extend to AI regulatory risks.

How is the cyber insurance market responding?

To date, the cyber insurance market has generally avoided introducing broad AI exclusions. Most insurers continue to assess AI-related incidents through the lens of existing cyber policy frameworks, rather than treating AI as a fundamentally separate category of risk. As a result, the emergence of AI has not, thus far, led to a significant restriction of cover under cyber policies.

That said, insurers are closely monitoring the potential systemic risks associated with AI adoption. The increasing capability of AI tools to scale cyber-attacks, automate vulnerability discovery and accelerate threat actor activity has understandably attracted significant attention within the market.

Nevertheless, the cyber insurance sector has repeatedly demonstrated its ability to adapt to evolving threats. Rather than restricting cover, many insurers are currently focusing on understanding AI-related exposures and developing solutions that address emerging coverage challenges.

Where coverage gaps can begin to emerge?

While it is encouraging that the market has largely avoided a knee-jerk reaction to AI, it is equally important to recognize that AI introduces new categories of financial exposure that may not fit neatly within traditional cyber insurance coverage.

In our discussions with clients, we have identified a number of scenarios where organizations could face significant uninsured losses despite maintaining a comprehensive cyber policy.

Examples may include:

• AI-specific regulatory investigations.
• AI-related business interruption scenarios that do not arise from a traditional cyber trigger.
• Costs associated with AI incident response activities that fall outside standard cyber policy definitions.

For risk managers, these exposures highlight the importance of moving beyond the question of whether AI itself is covered and instead focusing on which AI-related losses are covered and which are not.

The Willis AI endorsement

To address these emerging coverage gaps, Willis has developed an AI endorsement that can be added to cyber insurance programs. The endorsement has been specifically designed to respond to AI-related financial exposures that may fall outside the scope of a conventional cyber policy, including protections relating to:

• Incident response costs.
• Business interruption losses.
• Certain regulatory exposures arising from AI-related events.

The endorsement reflects Willis' view that cyber insurance must continue to evolve alongside technological innovation. Early market feedback has been highly positive, both from clients seeking greater certainty around AI-related risk transfer and from insurers who recognize the importance of maintaining the relevance and value of cyber insurance in the AI era.

One of the first clients to add endorsement to its cyber program, a global professional services organization, described the solution as a truly innovative enhancement that delivers meaningful additional protection for AI-related exposures.

What risk managers should do next?

The key message for risk managers is do not assume that AI-related losses are either automatically covered or automatically excluded.

Existing cyber policies should generally continue to respond to covered cyber events involving AI. However, the more challenging question is whether the specific financial consequences of those events fall within the policy's indemnities.

As organizations accelerate AI adoption, risk managers should:

• Evaluate how AI is being deployed across the business.
• Identify the financial losses that could realistically arise from AI-related incidents.
• Assess whether those losses fall within existing cyber coverage.
• Consider whether additional insurance protection is required to address identified gaps.

The Willis AI endorsement has been developed specifically to help organizations bridge those gaps and strengthen their cyber resilience as AI adoption continues to increase.

For further information, please contact your Willis cyber representative.