Cyber risk remains the leading immediate concern

The Allianz Risk Barometer 2026 ranks cyber incidents as the leading global corporate risk for the fifth consecutive year. Business interruption remains closely connected because ransomware, cloud outages and attacks on service providers can stop operations without damaging a company’s own premises.

Underwriters are likely to increase scrutiny of identity controls, privileged access, multifactor authentication, backups, endpoint protection and incident-response testing. Companies should also map critical technology vendors. A cyber policy may not fully respond if the interruption originates at an unlisted or excluded service provider.

Artificial intelligence becomes an insurable governance issue

Artificial intelligence rose to second place in the Allianz 2026 risk ranking. The immediate insurance concern is not an autonomous machine acting independently; it is the use of AI inside existing business processes without clear accountability.

Potential loss scenarios include confidential-data leakage, inaccurate automated decisions, intellectual-property disputes, defective outputs, discrimination allegations and cascading operational errors. These exposures may touch cyber, professional indemnity, directors and officers liability, product liability and general liability policies.

Businesses should create an inventory of material AI use cases, identify the accountable owner, document human review and test how an error could affect customers or operations. Insurers will increasingly expect evidence of this governance.

Business interruption extends beyond the insured location

Supply chains remain vulnerable to conflict, trade restrictions, transport bottlenecks, cyber events and natural hazards. Yet many business-interruption models still focus on damage at the insured’s own premises.

Companies should identify suppliers and customers whose failure would materially affect revenue, including second-tier dependencies that may not appear in procurement reports. Policy reviews should examine contingent business interruption, denial of access, utilities, ports, cloud providers and transport interruption.

Climate losses increase pressure on data quality

Munich Re reported global natural-disaster losses of approximately $224 billion in 2025, of which around $108 billion was insured. The long-term underwriting response is likely to include greater use of location-level modelling, hazard-specific deductibles and prevention requirements.

For buyers, a generic statement that a site is protected is no longer sufficient. Insurers may request elevation data, drainage capacity, roof condition, wildfire buffers, water supply, emergency power and evidence that previous recommendations have been completed.

Parametric coverage may supplement traditional indemnity insurance where rapid liquidity is more important than exact loss adjustment. It should be designed carefully because a trigger can fail to match the company’s actual loss.

Geopolitical and economic risks influence policy structure

The World Economic Forum’s Global Risks Report 2026 identifies geoeconomic confrontation as the most severe near-term global risk. For insurance buyers, this can affect sanctioned territories, cargo routes, political violence, trade credit, contract frustration and access to reinsurance capacity.

Policies should be reviewed when operations, counterparties or routes change. A programme designed around last year’s supply chain may contain territorial limitations or notification requirements that no longer fit the business.

What insurers will ask for

From 2026 to 2028, underwriting is expected to become more data-intensive. Businesses should prepare:

• accurate, geocoded asset schedules;
• current replacement values;
• tested cyber and business-continuity plans;
• supplier and customer dependency maps;
• AI governance and model-use inventories;
• evidence that risk-engineering recommendations have been closed;
• scenario-based business-interruption calculations.

Actions before the next renewal

The most effective renewal begins months before insurers receive the submission. Risk managers should test two or three severe but credible scenarios, identify where coverage is uncertain and decide which exposures to insure, mitigate or retain.

The objective is not to predict every event. It is to understand how a shock would move through the organisation and to ensure that policy wording, limits and recovery plans follow the same path.

Conclusion

Cyber, AI, climate and supply-chain risks are converging. Companies that manage them as separate insurance purchases may overlook the most damaging connections. A coordinated risk and insurance strategy will improve underwriting outcomes and make the organisation more resilient when a loss occurs.

Next step: Request a 2026–2028 insurance programme stress test.