Is Your Cyber Insurance Keeping Up With AI Risks?

By Hunter Bruton and David Senter

This is the third and final installment in our series on aligning cyber insurance coverage with incident response planning before a crisis occurs. In Part 1, "Your Cyber Response Team Starts at Insurance Renewal," we addressed securing approval for trusted counsel and vendors. Part 2, "Does Your Cyber Policy Match Your Incident Response Plan?" examined how policy requirements can affect an organization's response. This final installment considers a rapidly evolving challenge: whether existing coverage adequately addresses risks involving artificial intelligence (AI). 

AI Is Changing the Risk Landscape

AI is transforming how organizations operate, but it is also changing the nature of cyber threats and the potential losses organizations face.

Cybercriminals can use AI to create increasingly convincing phishing emails, impersonate executives through synthetic audio or video, and automate aspects of cyberattacks. At the same time, organizations' own use of AI tools can introduce new vulnerabilities involving sensitive information, automated decisions, and third-party technology providers. Those risks are especially acute when the AI is public or customer facing.

These developments raise an important question for policyholders: Will their existing cyber insurance apply when AI plays a role in an incident?

The answer depends on the circumstances and the specific policy language. Organizations should not assume that every AI-related incident falls within traditional cyber coverage. 

Understand Where Coverage May Fall Short 

Many cyber policies provide coverage for familiar risks such as unauthorized network access, ransomware, and certain business interruption losses. The use of AI to facilitate an otherwise covered attack does not necessarily change that coverage.

But other AI-related incidents may not fit neatly within traditional policy definitions.

Consider several potential scenarios:

• AI-enabled fraud: A criminal uses a convincing deepfake of an executive to authorize a fraudulent wire transfer. Depending on the circumstances, the loss may implicate social engineering or crime coverage rather than traditional cyber coverage.
• Disclosure of sensitive information: An employee enters confidential business or customer information into a third-party AI platform, potentially exposing information without a conventional network intrusion.
• AI system failures: An automated tool produces inaccurate results or makes an erroneous decision that causes financial harm. The resulting claim may fall outside the scope of a cyber policy.
• Third-party AI incidents: A vendor's AI platform experiences a security failure that compromises the organization's data or disrupts operations, raising questions about dependent business interruption and third-party liability coverage.
• Prompt injection and manipulation: A user manipulates a customer-facing AI tool into disclosing other customers' information, offering unauthorized discounts or refunds, or producing offensive content. Because the tool is used as intended rather than accessed without authorization, the incident may not meet a policy's definition of a security event.
• Consumer data collection and privacy claims: A website chatbot or AI-powered tool records, analyzes, or shares consumer conversations, prompting wiretapping or consumer protection claims. Many cyber policies exclude or sublimit wrongful collection claims, and these losses may not involve any security failure.

These scenarios illustrate why organizations need to understand not only whether their policies address AI, but also which types of AI-related losses are covered. 

Look Beyond the Cyber Policy

Not every AI-related exposure belongs under a cyber insurance policy. Depending on the organization's operations and the nature of the loss, coverage may also implicate commercial crime, technology errors and omissions, professional liability, media liability, or other insurance policies.

For example, a deepfake-related fraudulent payment may raise different coverage questions than a data breach caused by an AI-enabled phishing attack. Similarly, claims involving inaccurate AI-generated content, intellectual property infringement, or automated business decisions may require consideration of other policy types.

Organizations should work with their brokers and counsel to evaluate how these policies interact and identify potential gaps or overlapping exclusions. 

Ask the Right Questions at Renewal

The growing use of AI makes insurance renewal an important opportunity to reassess coverage.

Before renewing, organizations should consider:

• Does our cyber policy cover attacks involving AI-generated phishing, deepfakes, or other AI-enabled techniques?
• How does the policy address social engineering and fraudulent funds transfers, and are separate limits or conditions applicable?
• Are incidents involving our own AI tools or third-party AI platforms covered?
• Could AI-related exclusions affect coverage that would otherwise apply to a traditional cyber incident?
• Do our cyber, crime, and other liability policies work together to address our organization's actual AI exposures?

Policyholders should also review any new AI-related endorsements or exclusions. Where coverage is unclear, organizations may be able to negotiate language that better reflects their risks before the policy is bound. 

Account for AI in Incident Response Planning

Insurance coverage is only part of the preparation.

Organizations should also consider how AI-related incidents fit within their existing incident response plans. For example, a deepfake fraud attempt may require coordination among finance, information security, legal, and executive leadership, even when no network intrusion has occurred.

Similarly, an incident involving an AI vendor may require the organization to understand what information the vendor maintains, who is responsible for investigating the incident, and what notification obligations may apply.

Incorporating these scenarios into incident response planning and tabletop exercises can help identify potential gaps before an incident occurs. 

The Bottom Line

AI is introducing new risks, but organizations do not necessarily need to start from scratch when evaluating their insurance coverage. The more immediate priority is understanding how existing policies respond to AI-related incidents, where coverage may be limited, and whether additional protections are needed.

As this series has emphasized, the best time to address those questions is before a crisis. Reviewing provider approvals, response requirements, and emerging AI exposures together can help organizations build a more coordinated approach to cyber risk.

Smith Anderson's privacy and cybersecurity attorneys regularly help clients review cyber insurance policies, evaluate emerging risks, prepare for renewal discussions, and coordinate incident response planning. For questions about these issues, please contact Hunter Bruton, David Senter, or your regular Smith Anderson attorney.