Insuring AI risks: is your business (already) covered?

Artificial intelligence has the potential to transform how we work and do business – some of these changes are already taking place, and others may take years for the full impact to be felt and understood. One thing that is for certain is that AI is here to stay; approximately 1 in 6 businesses use at least one type of AI already ¹, and recent research indicates that the global AI insurance market size is expected to surpass around 141 billion dollars by 2034 ² .

However, as with the emergence of any new technology-driven paradigm shift, not all of the changes brought by AI can be said uniformly positive; while AI presents vast opportunities, it also brings with it significant risks.

Risks of AI

The nascent nature of AI technology, the swift pace at which it is being developed and implemented, and the particular nature of generative AI means care must be taken to mitigate AI-related risk.

Fundamentally, corporates must understand how the AI solutions that they use work, what could go wrong, and what risks they are exposed to. Only then can they assess whether they are adequately protected by the suite of insurance presently in place.

Different companies face different risk profiles depending on how they are using AI and that feeds through into what sort of insurance protections will be required.   To give a few examples:

• A consulting firm uses a particular AI tool to crunch market data for analysis which is then provided to a client. A bug in the tool (such as a coding issue, biased data set or an incorrectly implemented algorithm) results in the analysis performed incorrectly; the firm’s client has relied on it and has suffered serious loss as a consequence. This results in a negligence claim under a PI policy.
• A director faces third party claims or a regulatory investigation, alleging a failure to oversee / mitigate risks of an AI implementation which has resulted in financial losses or reputational damage for the director’s firm; Directors and Officers insurance would be relevant here. 
• Claims made against manufacturers of AI-enhanced products for property damage or bodily injury claims resulting from AI malfunction or a violation of product liability regulations; product liability insurances would be relevant here.
• A business implements AI-enhanced hiring practices, but in doing so inadvertently introduces bias, leading to claims for unfair employment practices; employers liability or employment practices liability insurance would be relevant here.

A recent Deloitte board governance survey indicates that for many companies, discussion of AI is relatively infrequent at a board level, but the interest in doing so is plainly there; 46% of respondents to the same survey indicated they were either concerned or not satisfied with the amount of time spent by the board on AI topics ³. A sharp incline in the levels of engagement is likely to occur in the near future. As the benefits of AI become more apparent, so too will the potential risks, both short and long term; ensuring that your suite of insurance adequately captures those emerging risks (and if not, making sure you’ve plugged the gaps) will be a fundamental to good governance going forward. 

Coverage of AI risks

Whether AI-related risks are in fact covered under the relevant insurance policy is very much dependent on the applicable terms. It is therefore very important for policyholders to consider when purchasing or renewing insurance whether their particular AI liability risks would be covered under the terms and conditions of the relevant insurance.

Broadly, there are two ways in which AI risks may be covered by insurance:

• Silent AI cover

Silent AI cover is where coverage of AI risks is provided via existing policies. Existing policies such as Professional Indemnity, Business Interruption, D&O, Crime, Product Liability and Employers Liability may provide coverage for AI liability. Particular attention should be given to the language of these policies, policy limits and any AI exclusions. However, exclusions are not currently market standard.

Insurers often look to limit their potential exposure to new or developing risks, so, as the AI risk profile develops and becomes better understood, it is entirely possible that we will see AI-specific exclusions being implemented to ‘business standard’ insurance policies. And if that happens, what then?

• Affirmative AI cover

Standalone or bespoke ‘AI cover’ is not (yet) market standard, so as it stands, AI-related risks will primarily fall to be dealt with under existing insurance policies. However, should AI exclusions begin to be implemented, the need for affirmative coverage may become more prevalent.

The market is showing signs of evolution in this space. Recently, Armilla Insurance Services launched an AI liability insurance product underwritten by Lloyd’s underwriters. The product is one of the first to offer affirmative coverage for unique AI-related losses rather than relying on protections in existing policies. However, companies would be well advised to take care in ensuring they are not paying for something already covered.

Whilst AI risks may be covered by existing policies now, clarity of cover may become a priority in the coming years for both insurers and policyholders alike. Those businesses adopting AI to a significant degree may need to seek positive (affirmative) cover from insurers, affirmatively covering AI-related risks (rather than just relying on the fact AI risks are not expressly excluded).

Appetite for affirmative cover may be particularly acute in the context of the intersection of AI and cyber risk, there being obvious concerns around security of data and also the integrity of the AI systems themselves. Existing cyber cover might encompass certain AI-related liabilities, but the cyber market is unlikely to be the answer on its own, for reasons of both appetite and capacity.

Practical steps to consider

For corporate policyholders, it is crucial to adopt a proactive approach to AI risk. Here are some practical considerations for organisations to think about now:

• Identify AI risks. Identify the current and future risks that their AI use could expose them to.
• Conduct internal AI policy and training. Implementing a comprehensive AI policy and training staff on how to use AI may protect from things going wrong.
• Review AI coverage. When it comes to purchase and renewal of insurance, pay attention to whether cover sufficiently protects against identified risks, both in scope of coverage and coverage limits, and negotiate wording and limits with insurers accordingly.

We can help corporate policyholders by reviewing their insurance cover, advising on coverage, assisting on claims notifications and acting in situations where insurance claims are denied by insurers.

Please visit our dedicated insurance hub InCrowd where you will find a collection of ‘Insurance Essentials’ short videos explaining how insurance can help your business thrive, covering topics such as political risk insurance, embedded insurance, and insurance for directors and information about how we can help you with your insurance issues.

Authored by Lydia Savill, Matt Steven, and Erin Davies.