Policy Coverage Gap Worksheet: AI Risk Edition

Purpose of the Template

Your cyber insurance policy might not cover the latest AI-driven threats. Although global cyber insurance market rates dropped 5% this year, AI-related cyber losses could surpass your current coverage limits. This isn't just a hypothetical issue; it's a real disconnect between pricing and risk that you need to address.

This worksheet helps you identify coverage gaps between your Stand-Alone Cyber Policy and emerging AI-driven threat scenarios. You'll review your current policy, compare it with AI-specific attack vectors, and build a case for coverage adjustments during your next renewal negotiation.

Use this when preparing for renewal discussions, conducting quarterly risk reviews, or responding to board questions about AI exposure. The output provides a structured gap analysis you can present to your broker with specific coverage requests, rather than vague concerns about "AI risks."

Prerequisites

Before you start, gather these documents:

• Your current Stand-Alone Cyber Policy declarations page and full policy wording
• Your most recent Underwriting Questionnaire responses
• Any Cyber Endorsements or manuscript language added to your policy
• Your organization's AI usage inventory (if you don't have one, list known AI tools in customer-facing systems, HR, and operations)
• Last year's cyber risk assessment or Cyber Maturity Assessment results

You'll also need 90 minutes of uninterrupted time and input from at least one person who understands your technical environment.

The Coverage Gap Worksheet

POLICY COVERAGE GAP WORKSHEET: AI RISK EXPOSURE
Prepared by: _________________ Date: _________________
Policy Number: _________________ Renewal Date: _________________

SECTION 1: CURRENT COVERAGE BASELINE
─────────────────────────────────────────────────────────
Policy Limit (per occurrence): $_________________
Policy Limit (aggregate): $_________________
Retention/Deductible: $_________________
[Business Interruption Coverage](/glossary/business-interruption-coverage) sublimit: $_________________
[Cyber Extortion Coverage](/glossary/cyber-extortion-coverage) sublimit: $_________________
[Data Restoration Coverage](/glossary/data-restoration-coverage) sublimit: $_________________

SECTION 2: AI SYSTEM INVENTORY
─────────────────────────────────────────────────────────
List all AI/ML systems your organization uses or provides:

System Name | Function | Customer-Facing? | Data Access Level
__________|__________|__________________|__________________
          |          | Yes / No         | PII / Financial / Public
          |          | Yes / No         | PII / Financial / Public
          |          | Yes / No         | PII / Financial / Public

SECTION 3: ATTACK VECTOR MAPPING
─────────────────────────────────────────────────────────
For each AI system above, assess exposure to these vectors:

Vector 1: Prompt Injection Leading to Data Exfiltration
Affected systems: _________________________________
Does your policy explicitly cover data theft via AI manipulation? 
☐ Yes, explicit coverage  ☐ Silent (not mentioned)  ☐ Unclear
Relevant policy language (quote section/page): _________________

Vector 2: AI-Generated Phishing at Scale
Estimated employee exposure (headcount): _________________
Does your policy cover social engineering losses without a human verification step?
☐ Yes, explicit coverage  ☐ Requires dual control  ☐ Excluded
Relevant policy language: _________________________________

Vector 3: Model Poisoning Causing Operational Failure
Could poisoned AI output trigger Business Interruption Coverage?
☐ Yes, covered under BI  ☐ Only if network down  ☐ Unclear
Waiting period for Business Interruption Coverage: _______ hours
Relevant policy language: _________________________________

Vector 4: Deepfake-Enabled Fraud
Does your policy cover losses from deepfake impersonation of executives?
☐ Yes, explicit coverage  ☐ Only with authentication protocol  ☐ Excluded
Relevant policy language: _________________________________

Vector 5: AI Training Data Breach (Third-Party Liability)
Does your policy cover third-party claims if your AI training data is compromised?
☐ Yes, under third-party coverage  ☐ Limited by [Nonpublic Information](/glossary/nonpublic-information) definition  ☐ Unclear
Third-party liability limit: $_________________

SECTION 4: SUBLIMIT ADEQUACY TEST
─────────────────────────────────────────────────────────
Scenario: AI-driven attack compromises your primary revenue system

Estimated revenue per day: $_________________
Business Interruption Coverage waiting period: _______ hours
Business Interruption Coverage sublimit: $_________________
Days of coverage at current sublimit: _______ days

Gap identified? ☐ Yes  ☐ No
If yes, recommended sublimit increase: $_________________

SECTION 5: EXCLUSION AUDIT
─────────────────────────────────────────────────────────
Review your policy for these exclusions that could block AI-related claims:

☐ Does your policy contain a [State-Backed Cyber-Attack Exclusion](/glossary/state-backed-cyber-attack-exclusion)?
   If yes, does it require attribution or just "characteristics of"? _______

☐ Does your policy exclude losses from "software defects"?
   Could this block claims where AI output causes operational failure? _______

☐ Does your policy exclude "contractual liability"?
   Could this block claims from AI SLA failures with customers? _______

☐ Does your policy exclude "professional services" errors?
   Could this block claims if your AI provides advice/analysis? _______

SECTION 6: [INSURER CONSENT REQUIREMENT](/glossary/insurer-consent-requirement) REVIEW
─────────────────────────────────────────────────────────
Your policy likely requires insurer consent for incident response vendors.

Do you have pre-approved IR vendors for AI-specific incidents?
☐ Yes  ☐ No  ☐ Don't know

Does your [Breach Coach](/glossary/breach-coach) have AI forensics experience?
☐ Yes  ☐ No  ☐ Don't know

Time lag for insurer approval of non-panel vendors: _______ hours/days

SECTION 7: COVERAGE ADJUSTMENT RECOMMENDATIONS
─────────────────────────────────────────────────────────
Based on gaps identified above, recommend these changes for next renewal:

1. Increase policy limit to: $_________________
   Justification: _________________________________

2. Increase BI sublimit to: $_________________
   Justification: _________________________________

3. Add manuscript language for: _________________________________
   Draft language: _________________________________

4. Request clarification on: _________________________________

5. Request removal/modification of exclusion: _________________

Customizing the Worksheet

Start with Section 2. If you don't have a formal AI inventory, focus on systems that handle customer data or financial transactions. Include third-party AI tools embedded in your SaaS platforms; your policy doesn't distinguish between AI you built and AI you licensed.

In Section 3, the attack vectors aren't exhaustive. Add rows for threats specific to your industry. If you're in financial services, add "AI-driven market manipulation." If you're in healthcare, add "AI diagnostic error leading to patient harm."

For Section 4's sublimit adequacy test, use your actual revenue figures. If you don't know daily revenue, divide annual revenue by 250 business days. The waiting period matters; most Business Interruption Coverage doesn't start until 8 or 12 hours after an incident. Calculate whether your sublimit actually covers a realistic outage.

Section 6 is critical but often overlooked. During an AI-driven incident, you'll need forensics expertise that traditional IR firms might not have. If your policy requires insurer consent before engaging non-panel vendors, and your panel doesn't include AI specialists, you've got a procedural gap that could delay containment by days.

Validation Steps

After completing the worksheet, validate your findings:

1. Cross-check policy language: For every "unclear" box you checked, email your broker with the specific policy section and ask for written clarification. Don't accept verbal interpretations.

2. Test the sublimit math: Take your Business Interruption Coverage sublimit and divide it by your daily revenue. If the result is less than 14 days, you're likely underinsured for a sophisticated AI-driven attack that could take weeks to remediate.

3. Review with legal: If Section 5 identified exclusions that could block AI-related claims, have your legal team review whether those exclusions would survive a coverage dispute in your jurisdiction.

4. Quantify the ask: Before your renewal meeting, convert each gap into a specific coverage request with a dollar figure. "We need better AI coverage" gets you nowhere. "We need a $2M increase in our BI sublimit and manuscript language confirming that AI-generated social engineering is covered without a dual-control requirement" starts a negotiation.

5. Document the market context: Rates are down 5% this year. That's your leverage. If your broker pushes back on coverage expansions, remind them that the market is softening while your risk profile is hardening. You're not asking for charity; you're asking for coverage that matches the premium environment.

This worksheet doesn't eliminate your AI exposure. It documents the gap between your policy and your actual risk, which is the first step toward closing it. Update this quarterly, not annually. AI threats move faster than policy renewal cycles.