Purpose of the Template
Your underwriting questionnaire likely covers MFA and EDR, but it may not address AI risk adequately. This template provides a structured set of questions to evaluate how an applicant uses AI tools, what data flows through them, and where liability concentrations exist.
This gap is significant. Clients often assume their Stand-Alone Cyber Policy covers AI-related losses automatically, but it doesn't. If you're not asking about AI usage in your Underwriting Questionnaire, you're exposing yourself to unassessed risks.
This template fills that gap. Use it as a standalone AI risk supplement or integrate the questions into your existing Underwriting Questionnaire. Either way, you'll gather the information needed to price AI exposure accurately and identify where your E&O risk resides.
Prerequisites
Before deploying this questionnaire:
Confirm your policy language. Ensure your questions align with any AI-specific endorsements or exclusions in your policy. Avoid asking about AI development if your policy excludes it. Don't promise coverage for AI hallucination losses if your form doesn't cover them.
Train your underwriters on the implications of the answers. A simple "yes" to "Do you use AI tools?" isn't enough. Your team must understand the difference between using ChatGPT for email drafts and training a proprietary model on customer data. The risk profiles differ significantly.
Define your risk appetite. This questionnaire will reveal risks you may not want to cover. If you're not willing to insure AI developers, state this upfront. If you won't cover risks involving Nonpublic Information in third-party AI platforms, make that a binding requirement.
The Template
Copy this section directly into your application or use it as a standalone supplement:
AI TECHNOLOGY USAGE ASSESSMENT
1. AI Tool Deployment
Does your organization use AI-powered tools or services in any business function? (Yes/No)
If yes, identify all categories that apply:
- Customer service (chatbots, automated responses)
- Content generation (marketing copy, documentation, code)
- Data analysis and business intelligence
- Cybersecurity tools (threat detection, vulnerability scanning)
- Software development (code completion, debugging)
- Decision support systems (underwriting, credit decisioning, HR screening)
- Proprietary AI model development
- Other (describe):
2. Data Flow and Training
For each AI tool category identified above, answer:
a) What types of data does the AI system process? (Check all that apply)
- Customer personal information
- Employee records
- Financial data
- Health information
- Proprietary business data
- Publicly available data only
- Source code or intellectual property
b) Where is this AI processing performed?
- Third-party cloud service (name provider):
- On-premises infrastructure
- Hybrid environment
- Unknown
c) Do you use customer data, employee data, or proprietary information to train or fine-tune AI models? (Yes/No/Unknown)
3. AI Development Activities
Does your organization develop, license, or sell AI models, algorithms, or AI-powered products to third parties? (Yes/No)
If yes, provide:
- Annual revenue derived from AI products: $_______
- Number of external clients using your AI systems: _______
- Primary use cases for your AI products (describe):
4. Vendor and Third-Party AI Risk
List all third-party AI platforms your organization uses (e.g., OpenAI, Google, Microsoft, Anthropic):
For each vendor:
- Is there a written contract governing AI use? (Yes/No)
- Does the contract include liability provisions for AI errors or data breaches? (Yes/No/Unknown)
- Have you reviewed the vendor's AI data retention and training policies? (Yes/No)
5. AI Governance and Controls
Does your organization have:
a) A written AI acceptable use policy? (Yes/No)
- If yes, date last updated: _______
b) Technical controls restricting what data can be input into AI tools? (Yes/No)
- If yes, describe controls:
c) A designated person or team responsible for AI risk management? (Yes/No)
- If yes, title/role:
d) Incident response procedures specific to AI system failures or errors? (Yes/No)
6. AI-Related Incidents
In the past 36 months, has your organization experienced:
- AI system errors that affected customer decisions or outcomes? (Yes/No)
- Data leakage through AI platforms? (Yes/No)
- Customer complaints or regulatory inquiries related to AI use? (Yes/No)
- Bias, discrimination, or fairness concerns raised about AI systems? (Yes/No)
If yes to any, provide details including dates, resolution, and financial impact:
Customization Options
Adjust the lookback period. The 36-month incident window matches standard cyber applications, but you may prefer a shorter period if you're focusing on startups where AI adoption is recent.
Tailor data categories to your risk appetite. If you cover healthcare risks, expand the health information subcategories. If you focus on financial services, add questions about AI in credit decisioning or fraud detection.
Add class-specific questions. For technology E&O risks, ask about AI model accuracy testing and validation processes. For retail risks, inquire if AI systems make automated pricing or inventory decisions. For professional services, ask if AI tools generate client deliverables without human review.
Integrate with existing controls questions. If your current questionnaire covers third-party vendor management, add AI vendors as a required subcategory. If you ask about incident response plans, include a question about AI system failures in tabletop exercises.
Scale complexity to risk size. For risks under $5 million in revenue, the core six-question structure is sufficient. For larger risks or those with significant AI revenue, expand section 3 to include questions about model testing, accuracy metrics, and professional liability coverage for AI products.
Validation Steps
After receiving a completed questionnaire, validate the answers before quoting:
Cross-check against public information. If the applicant claims no AI development activity but their website advertises AI-powered products, you have a material misrepresentation risk. Flag it before binding.
Review vendor contracts when available. If the applicant uses third-party AI platforms and claims contractual liability protection, ask for the relevant contract sections. Many standard terms of service explicitly disclaim liability for AI errors.
Test controls claims. If the applicant says they have technical controls preventing sensitive data input into AI tools, ask how those controls work. "We tell employees not to" isn't a technical control. Data loss prevention rules that block API calls to unauthorized AI endpoints are.
Reconcile AI revenue with overall exposure. If 40% of revenue comes from AI products but the applicant treats AI as a minor operational tool, your pricing is wrong. AI product revenue should trigger tech E&O underwriting review, not just cyber.
Confirm governance structure. If the applicant claims a dedicated AI risk management role, verify it's a real position with defined responsibilities, not just someone's additional duty. Ask for the person's name and title. If they can't provide it, the governance claim is hollow.
Look for consistency across the application. If the cyber questionnaire says no third-party data processing but the AI supplement lists three cloud AI vendors, something doesn't add up. Resolve the discrepancy before you quote.
The goal isn't to catch applicants in lies. It's to identify where your actual exposure sits before a claim forces you to find out the hard way.
