The Singapore Reinsurers' Association recently warned that reinsurers could face significant portfolio losses if multiple insurers rely on the same AI models, cloud infrastructure, or technology providers. A shared failure, the Association noted, could paralyze underwriting and claims processing at scale. It advised reinsurers to assess how their cedants' use of AI could affect the risks they take on.
That advice landed in a lot of team chats. The questions below are the ones we hear most from underwriters and actuaries trying to turn it into something operational. Where we offer a framework, it's our own thinking, not a regulatory requirement.
Q1: Isn't this just the old cloud concentration problem with a new label?
Partly, yes. Cloud concentration is a known aggregation driver, and your Aggregation Exposure Analysis may already cover it. What's different with AI is the layer. Several cedants can sit on different clouds and still share the same underlying model or vendor, so geography and hosting diversity don't protect you. Worse, a model failure can be quiet. An outage is obvious. A degraded or biased model can keep running while it misprices risk or mishandles claims, and you may not see it until loss ratios drift.
Q2: What does a shared AI failure actually look like on our book?
Think in two buckets. The first is operational paralysis: if cedants route underwriting intake or claims triage through the same provider and it goes down, quoting, binding, and claims handling stall together. That can push up reporting delays and loss development uncertainty across many treaties at once. The second is correlated error: the model keeps working but produces consistently flawed outputs, such as skewed risk selection or systematic claims leakage. Both create the thing reinsurance is least built for, which is many cedants suffering the same problem at the same moment. Neither maps neatly to a single peril, so they can slip between classic modeling categories.
Q3: How do we find out which cedants share a vendor? They won't all volunteer it.
Put it in the Underwriting Questionnaire and your treaty renewal submission process. Ask for the following:
- Which AI models or platforms are used in underwriting, pricing, claims triage, and fraud detection
- Who supplies them, and whether they are third-party, white-labeled, or built in-house
- Which cloud and infrastructure providers host them
- Whether the cedant has a fallback process if the system is unavailable
Then map the answers across your portfolio. A simple matrix of cedant by vendor by function will show you clusters faster than any narrative response. Expect gaps. Some cedants won't know what sits underneath a vendor's product, which is itself a finding.
Q4: Can we model this, or is it too new?
You can't run a clean Frequency-Severity Modeling exercise on thin history, so don't pretend to. What you can do is scenario-based aggregation. Define a handful of plausible events, such as a primary provider outage, a flawed model update pushed to all customers, or a compromised model supplier. Then estimate how many cedants and how much exposure each event touches, using your vendor map from Q3. Treat the output as a range, not a point estimate, and document your assumptions so they can be challenged and refined. The goal is to know which concentrations would hurt, not to produce a precise loss number nobody can defend.
Q5: Where might this surface in coverage terms?
Look at where your cedants' policies and your treaties could respond to a shared technology failure. Contingent Business Interruption is the obvious one, since an insured losing income because a vendor failed is exactly that exposure. Check how your underlying cyber policies define covered dependent providers and whether AI or software vendors are in scope. Also read your own treaty wording for aggregation and event definitions. If a single vendor failure could be treated as one event across many cedants, that affects limits, retentions, and reinstatement behavior. Don't assume the wording was drafted with shared-AI scenarios in mind. If it's ambiguous, raise it at renewal rather than at First Notice of Loss.
Q6: What do we actually ask cedants to do about it?
Ask for resilience evidence, not promises. Reasonable asks include documented fallback procedures for manual underwriting and claims handling, evidence those procedures were tested, vendor due diligence records, and contractual rights around notification and recovery with key AI suppliers. Human oversight of high-impact model outputs belongs on the list too. Frameworks you already know help here. The NIST CSF Core Functions give you a common language, particularly Govern, Identify, and Recover, and a CSF Organizational Profile can show how a cedant treats AI vendor dependency. Where cedants are subject to the Insurance Data Security Model Law, its third-party service provider oversight expectations are a natural hook for the conversation. Tie your asks to pricing and capacity conversations so they carry weight.
Where to go for more
Start with the Singapore Reinsurers' Association's guidance, as reported by Insurance Asia, since it frames the reinsurer's side of the question directly. Then look inward: review your current Aggregation Exposure Analysis for technology dependencies, check whether your Underwriting Questionnaire asks about AI at all, and read your treaty event definitions with a shared-vendor failure in mind. If your cedants operate in the EU or serve critical entities, the Network and Information Security Directive (NIS2) supply chain security provisions are worth a look for how they push your cedants to manage supplier risk. None of this requires a new department. It requires asking one more question at renewal, and actually mapping the answers.
