AI risk begins with the business process

The phrase “AI risk” is too broad for insurance analysis. A useful assessment starts with the process in which the system is used. A customer-facing recommendation engine creates a different exposure from an internal productivity assistant, an automated credit decision or an industrial control application.

For every material use case, the company should identify the data used, the decision produced, the person responsible for oversight and the financial consequence of an error. This converts a technology inventory into a set of insurable scenarios.

Where corporate policies may respond

Cyber insurance

Cyber policies may respond to privacy breaches, security failures, data restoration, incident response and interruption caused by a qualifying network event. Questions arise when an AI system releases confidential information without a conventional cyberattack, when a third-party model provider fails or when an automated action damages physical operations.

Professional indemnity and errors and omissions

Professional liability coverage may be relevant when a company’s AI-enabled service produces advice, analysis or an output that causes a customer financial loss. Coverage depends on the definition of professional services, the insured entity and whether technology activities are expressly included.

Directors and officers liability

D&O exposure may arise when investors, regulators or other stakeholders allege that leadership failed to supervise AI adoption, misstated the capabilities of a system or ignored known governance weaknesses. The issue is usually not the technical error itself but the decision-making and disclosure surrounding it.

Crime and social engineering

AI-generated voices, video and correspondence can make payment fraud more convincing. Crime policies often contain specific requirements for verification procedures, authorised instructions and funds-transfer fraud. A loss may fall outside cyber coverage even when AI was used by the criminal.

Product, media and employment liability

AI can contribute to defective products, intellectual-property disputes, misleading content and discrimination allegations. These losses may engage several policies or expose gaps between them. Definitions and exclusions should be compared rather than reviewed separately.

Common coverage gaps

• The policy covers a security failure but not an inaccurate automated decision.
• A third-party model or cloud provider is outside the dependent business interruption definition.
• Professional services are defined too narrowly for the company’s AI-enabled offering.
• Contractual liability exceeds what the policy would cover in the absence of the contract.
• Intellectual-property, biometric information or discrimination exclusions remove a central scenario.
• Crime coverage requires a verification control that the business did not follow.

What underwriters will want to understand

A strong submission should describe material AI use cases, data sources, human review, vendor due diligence, model testing, access controls and incident escalation. The company should also explain how it detects inaccurate outputs and how it can suspend an automated process without stopping the wider business.

Governance should be proportionate. A low-impact internal drafting tool does not require the same controls as an automated system that approves payments, makes employment decisions or controls machinery.

Test the programme with scenarios

1. A model provider outage stops a revenue-generating customer service.
2. An automated decision creates customer financial loss and regulatory scrutiny.
3. A deepfake instruction causes an employee to transfer funds.
4. Confidential data is included in an AI output sent outside the company.
5. An AI-enabled product repeatedly produces a defective result.

For each scenario, identify the policy, trigger, waiting period, deductible, sublimit and exclusions. Any uninsured amount should be treated as an explicit retained risk.

Conclusion

AI insurance is not a single product decision. It is a coordination exercise across governance, contracts, cyber security and several insurance lines. Companies that can describe their AI use clearly and quantify credible loss scenarios will be better positioned to negotiate coverage and respond when an incident occurs.

Next step: Request an AI risk and insurance programme review from Kompetenz.