Your team just discovered that an automated system approved a batch of fraudulent transactions overnight. No employee clicked "approve." No one bypassed a control. The AI tool you deployed to speed up payment processing made the decision on its own.
Now you're filing a claim. And your insurer is asking a question your policy language wasn't written to answer: Who made the mistake?
This checklist helps you evaluate whether your current Stand-Alone Cyber Policy or Cyber Endorsement addresses AI-driven incidents. You'll identify coverage gaps, strengthen governance practices, and prepare for renewals where AI exposures will increasingly shape underwriting decisions.
What This Checklist Covers
Use this to assess three areas:
- Whether your policy language explicitly addresses AI system actions
- How your internal governance reduces the likelihood of AI-related claims
- What specific coverage triggers apply when AI tools contribute to a loss
This isn't a security audit. It's a coverage and risk management review designed to surface gaps before you need to file a First Notice of Loss.
Prerequisites
Before you begin, gather:
- Your current Cyber Insurance policy declarations and full policy wording
- A list of AI tools your organization uses (both approved and shadow IT instances)
- Your employee data handling policies
- Any incident response playbooks that reference automated systems
You'll also need input from your IT, legal, and risk teams. AI governance sits at the intersection of all three functions.
Checklist Items
1. Review Your Policy's Definition of "Employee" or "Authorized User"
Action: Locate the definitions section of your policy. Check whether coverage triggers require an individual to commit an error or whether the language includes "systems acting on behalf of the insured."
What good looks like: Your policy either explicitly includes automated systems in the definition of covered actions, or your insurer has provided written clarification that AI system errors fall under existing coverage grants for network security or privacy liability.
2. Confirm Coverage Limits for Social Engineering and Financial Fraud
Action: Identify the sublimit for social engineering or funds transfer fraud. Many Cyber policies include coverage for these incidents but carry lower limits than other cyber losses.
What good looks like: Your sublimit reflects the maximum single transaction your finance team can authorize without secondary approval. If AI-generated voice or text impersonation could bypass your controls, your limit should account for that exposure.
3. Verify Whether Your Policy Covers Third-Party AI Vendor Breaches
Action: Check whether your privacy liability or network security coverage extends to incidents originating from third-party service providers, including AI platforms where employees upload data.
What good looks like: Your policy includes contingent liability coverage or explicitly covers breaches at vendors who process or store your data. You've confirmed this applies to generative AI platforms, not just traditional hosting providers.
4. Document Which AI Tools Employees Are Authorized to Use
Action: Create a written list of approved AI platforms. Define what types of data employees may enter into each tool.
What good looks like: You've published internal guidance that prohibits pasting customer data, financial records, or nonpublic information into public AI platforms. IT monitors usage and flags violations.
5. Implement a Private LLM Instance for Sensitive Workflows
Action: If your team regularly uses generative AI for tasks involving confidential information, deploy a private instance where data remains under your control.
What good looks like: Your legal, finance, and product teams use an internal AI tool with defined data retention policies. No sensitive information leaves your environment.
6. Train Employees on AI-Specific Social Engineering Risks
Action: Update your security awareness training to include examples of AI-generated phishing emails, deepfake voice calls, and automated fraud attempts.
What good looks like: Employees know to verify urgent financial requests through a secondary channel, even when the voice or email appears authentic. Your training includes recent examples of AI-driven impersonation attacks.
7. Confirm How Your Policy Treats Automated Decision-Making Errors
Action: Ask your broker or insurer how the policy would respond if an AI system independently makes a mistake that causes financial harm or exposes data.
What good looks like: You've received written confirmation from your insurer clarifying whether automated system errors qualify as covered events under your privacy liability or technology errors and omissions coverage.
8. Review Your Underwriting Questionnaire for AI-Related Questions
Action: Check whether your most recent renewal application asked about AI tool usage, governance policies, or employee training on AI risks.
What good looks like: You've disclosed your use of AI tools accurately. If the application didn't ask, you've proactively provided this information to your underwriter to avoid potential Application Fraud Warranty issues at the time of a claim.
9. Evaluate Whether Your Breach Coach Has Experience with AI Incidents
Action: Confirm that your pre-approved breach counsel understands how AI-related privacy incidents differ from traditional data breaches.
What good looks like: Your breach coach has handled cases involving generative AI platforms and can advise on notification obligations when data is exposed through an AI tool rather than a traditional database breach.
10. Assess Coverage for AI-Generated Content Errors
Action: Determine whether your policy covers claims arising from inaccurate information generated by an AI system you operate.
What good looks like: If your organization uses AI to generate customer-facing content, you've confirmed whether errors and omissions coverage applies. If it doesn't, you've considered whether a separate technology E&O policy is necessary.
Common Mistakes
Assuming all AI incidents are covered because they involve technology. Many Cyber policies assume human error triggers coverage. If your policy language hasn't evolved, automated system mistakes may fall outside traditional definitions.
Failing to disclose AI tool usage during renewal. Underwriters are starting to ask about AI adoption. If you don't disclose it and later file a claim involving an AI platform, your insurer may argue you misrepresented your risk profile.
Treating all AI tools the same. A private LLM instance with strict data controls presents different risks than employees pasting confidential information into a public chatbot. Your governance should reflect that distinction.
Ignoring sublimits on social engineering coverage. AI makes impersonation attacks more convincing. If your sublimit is $50,000 but your CFO can approve wire transfers up to $500,000, you've got a gap.
Next Steps
Schedule a policy review with your broker before your next renewal. Bring this completed checklist and ask three questions:
- Does our current policy language explicitly cover AI system errors?
- Should we request manuscript endorsements to clarify coverage for automated decision-making?
- Are our social engineering and privacy liability limits adequate given our AI tool usage?
If you're implementing new AI tools mid-policy term, notify your insurer. Don't wait until renewal. A proactive disclosure now prevents a coverage dispute later.
Your policy was likely written before your organization adopted generative AI. That doesn't mean you're uncovered, but it does mean you need to verify assumptions before you're in the middle of a claim.
