Search for AI insurance requirements and most of what comes back concerns the other side of the desk: the rules a carrier follows when it uses AI to price your policy. Useful to somebody. Not to you. The question facing a company of 50 to 500 people is narrower. Your cyber renewal now has an AI section, your largest client’s security review has one too, they ask close to the same thing, and both are answered out of one thin folder. One line in that folder cannot be produced on the morning the form arrives.
Why the question appeared on the form
For years AI sat inside your policies without being named. Lawyers call that silent AI: covered because nothing excluded it. That era closed on a schedule you can look up.
Verisk’s ISO division, which publishes the standard policy language most US admitted-market carriers build on, put three generative-AI exclusion endorsements into circulation for commercial general liability with a January 2026 effective date. CG 40 47 strips Coverage A and Coverage B of bodily injury, property damage and personal and advertising injury arising out of generative AI; CG 40 48 does the same to Coverage B alone; CG 35 08 applies it under Products and Completed Operations. The forms define generative AI as a machine-based learning system or model trained on data that can create content or responses, including text, images, audio, video or code. That reaches a marketing assistant drafting a case study, not only a model you built.
Brokers are fighting it in public. Marsh chief executive John Doyle called broad AI exclusions “real confusion and uncertainty” on the firm’s October 2026 earnings call, noting very limited claim activity to date, and Aon and WTW have taken the same side. Some carriers are moving the other way and writing AI coverage in affirmatively, so the market direction tells you nothing about your own renewal.
Fenwick’s June 2026 analysis names the part that catches companies out: “The primary challenge is not simply the presence of AI exclusions, but the fragmentation and quiet erosion of coverage across multiple policy lines.” It arrives through revised base forms and carve-backs rather than one conspicuous clause, so reading your renewal for the word “artificial” proves nothing.
Carriers cannot price what they cannot see, so they started asking. IBM’s Cost of a Data Breach Report 2026 found unapproved AI tools in 43% of breached organizations, up from 20% a year earlier, and 92% of those with an AI-related breach lacked AI access controls. Your carrier read that report too.
What your carrier asks
The AI section is short, uneven across the market, and not yet on every form. Where it exists it clusters into seven questions. The right-hand column is what an underwriter treats as an answer, rarely what the company first offers.
| The question | What counts as an answer |
|---|---|
| Which AI tools do your staff use? | A dated inventory covering paid tools, free tools, AI features switched on inside software you already own, and anything reached by API. “We don’t really know” is itself a data point, and not a good one. |
| Do you have a written AI use policy? | A document with a named owner, an approval date, a review cadence, and the data categories that may not be entered anywhere. |
| What stops sensitive data reaching those tools? | Named controls and whether each one blocks or only alerts. Underwriters now separate the two, and so should you. |
| Have staff been trained on AI use? | Completion records tied to names and dates. |
| Do you monitor for unapproved AI use? | Detection, not prohibition. A policy banning something is not a control that finds it. |
| Does AI touch client-facing work product? | Where, what review it gets before delivery, and what your contracts say. Professional liability forms ask this more sharply than cyber forms. |
| How do you verify payment changes? | Callback steps that survive a convincing synthetic voice. |
Three of the seven have nothing to do with buying software, and most companies answer them worse than the technical ones.
What your client asks, and why the list runs longer
The same quarter the renewal lands, your biggest customer sends a security review, longer and more specific and carrying more revenue risk.
The Standard Information Gathering questionnaire from Shared Assessments, a standard form in third-party risk reviews, now carries Artificial Intelligence as one of its 21 risk control domains, mapped to NIST AI 100-1 and ISO/IEC 42001:2023. The Cloud Security Alliance released its AI Controls Matrix in July 2025, 243 controls across 18 domains, with an AI-CAIQ questionnaire buyers now send to vendors. Neither was written with a 60-person firm in mind, and neither cares.
Client questions overlap the carrier’s and add four of their own:
- Will AI touch our data, and which AI? Named tools, named processing, named subprocessors.
- Is our material used to train anything? The vendor’s current terms, read rather than assumed, and true for the tier you actually bought.
- What gets disclosed in deliverables? Whether AI assistance is disclosed, when, and in which document.
- Who at your company owns this? A name. Committees read as nobody.
The work transfers one way only: a folder that satisfies a security review covers the insurance form almost entirely. Assemble for the harder audience.
One folder, two audiences
Six items answer most of both question sets. Build it once, date it, keep it where two people can find it.
| Evidence item | What the carrier wants from it | What the client wants from it |
|---|---|---|
| AI tool inventory | Scope of exposure to price | Which systems may touch their data |
| AI use policy | A control on paper and in practice | Prohibited data categories, named |
| Named owner and review cadence | Accountability that is not a committee | A person to escalate to |
| Data controls, with block or alert noted | Loss prevention | Evidence their material cannot leak sideways |
| Access and activity logs | A trail to follow after an incident | An audit trail they can request |
| Training records | Human-layer control | Proof your people know the rules |
Two of those six are configuration rather than purchase: what your licenses already record is covered in our guide to logging and auditing company AI use, and the block-versus-alert question in our piece on data-loss prevention for AI assistants. Neither needs the platform most vendor pages here are selling; our review of AI governance tooling puts that purchase later than the sales cycle does.
The answer that creates the exposure
Here is the part the compliance checklists skip. A signed application is not a survey. It is a set of representations the carrier underwrites on, and the signature block usually says so.
Travelers Property Casualty Company of America v. International Control Services shows what that means. Travelers filed in federal court in Illinois on July 6, 2022 seeking to rescind a cyber policy. ICS had represented that it used multifactor authentication to protect its digital assets; after a ransomware attack that May, the carrier found ICS “only utilized MFA to protect its firewall and did not use MFA to protect any other digital assets.” The case was dismissed on August 26, 2022 with judgment for Travelers after ICS agreed to let the court rescind the policy. That was a stipulated rescission rather than a ruling on the merits, so commentary calling it a holding overstates it. The materiality test is the durable part: courts ask whether the underwriter would have accepted the risk had the truth been disclosed.
Map that onto the AI section. You attest to an AI use policy and controls keeping sensitive data out of AI tools. A breach investigation then finds half your account team pasting client material into personal assistant accounts. Same shape of fact as the MFA case. The policy did not create that exposure; the confident answer did.
So the discipline before renewal is narrow answering. Describe what you can evidence, qualify what is partial, and let your broker handle how a hedged answer reads. A qualified yes prices worse than a clean yes and far better than a clean yes that turns out wrong. Client questionnaires work the same way, except the representation lands in a contract instead.
The line no document covers
Five of the six folder items can be assembled in a week by a capable operations lead. Training records cannot, and both counterparties ask about training by name.
It is written into the frameworks, not bolted on. NIST’s AI Risk Management Framework states it in GOVERN 2.2: “The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.” The playbook expects it to cover the laws that apply, the harms these systems can cause, your own AI policy and what trustworthy AI means, tailored by role rather than one session for everyone.
In Europe the duty is statutory. Article 4 of the EU AI Act has applied since February 2, 2025 and requires providers and deployers to ensure a sufficient level of AI literacy among staff and anyone operating these systems on their behalf, judged against role and context. US companies with European staff or customers sit inside that scope.
A policy nobody was taught does not change what people paste into a chat window, and the questionnaire asking for your policy also asks for completion records. We wrote about that gap in the safe AI use playbook. Underwriters and enterprise buyers read it the same way: the document is cheap, the behavior pays claims, and the training record is the only evidence anyone addressed behavior.
Which is why AI enablement belongs in a risk conversation at all. The companies answering these forms well are not the ones with the longest policy. They are the ones whose staff can say which tool handles which work, what never leaves the building, and how to check an answer before it ships. That is built rather than bought with a license, the argument in the AI enablement manifesto.
What it costs to be able to answer
Most of this is internal hours rather than spend. The inventory is a week of someone’s attention across sign-in records, expense reports and a direct question to every team lead. The policy is drafting; the owner and cadence are a decision. Logging and data controls are usually a seat-tier conversation with vendors you pay already.
Training is the line with a market price. Hands-on AI enablement sessions for a mid-market team run roughly $2,000 to $15,000 depending on headcount, how many role-specific tracks you need, and whether the work runs against your own documents or generic examples. That last choice matters for the folder as much as the learning: a session worked through real client material leaves a record naming what was covered.
The cost worth avoiding is a governance platform bought in renewal week to answer what configuration already answers.
If you are staring at an AI section you cannot answer cleanly, a free AI-readiness call will tell you which of the six items you already have faster than another week of archaeology.
The six weeks before renewal
- Get the form. Ask your broker for the current application and any AI supplement now rather than at renewal, and your three largest clients’ procurement contacts for theirs. You cannot prepare for questions you have not read.
- Inventory. Sign-in records, expense reports, gateway telemetry, one honest conversation per team. Expect tools nobody mentioned.
- Policy and owner. Name the owner first. A short policy with a name on it beats a long one from a template.
- Controls. Open the admin consoles, record what blocks and what only alerts, fix the cheap gaps.
- Training. Run the session, keep the roster. This is the item with lead time, which is why it is not last.
- Answer narrowly. Fill the forms from the folder, and where the folder is thin, say so.
Run the sequence once and the second year takes days. Improvise it in renewal week and you either take worse terms or write something you would not want read back after an incident.
Frequently asked questions
What are the AI insurance requirements for a mid-market company in 2026?
There is no single standard. Carriers writing cyber, technology errors and omissions, and management liability now ask for an inventory of AI tools in use, a written AI use policy with a named owner, controls keeping sensitive data out of those tools, staff training records, and monitoring for unapproved tools. Expect them as a supplement to your existing application.
Does my current cyber policy cover an AI-related incident?
Check the endorsements, not the base form. Coverage is fragmenting through revised definitions and carve-backs across cyber, errors and omissions, directors and officers, and general liability, so no single clause answers it. Ask your broker for a written position on three scenarios: staff leaking data through an assistant, a deepfake payment instruction, and a client claim over AI-assisted work.
What is the ISO generative AI exclusion?
Three endorsement forms from Verisk’s ISO division, effective January 2026, that let general liability carriers exclude claims arising out of generative AI. CG 40 47 removes Coverage A and Coverage B, CG 40 48 removes Coverage B alone, and CG 35 08 applies it under Products and Completed Operations. A carrier may attach them or not; whether yours did is a question for your renewal documents.
Can an insurer deny a claim because we answered the AI questions wrong?
A material misstatement on an application can support rescission of the whole policy, which is worse than one denied claim. In Travelers v. International Control Services the carrier sought rescission over a multifactor authentication answer and the policy was rescinded by agreement in August 2022. The test is whether the underwriter would have accepted the risk had the truth been disclosed. Answer narrowly.
What do client security questionnaires ask about AI?
The same ground as insurers, plus which AI systems touch the client’s data, whether that data trains any model, what gets disclosed in deliverables, and who owns AI use at your company. The Shared Assessments SIG carries Artificial Intelligence as one of its 21 control domains, and the Cloud Security Alliance’s AI-CAIQ goes directly to vendors.
Do we need ISO 42001 certification to pass these reviews?
Rarely at this size. ISO/IEC 42001:2023 is the AI management system standard, and both the SIG and the Cloud Security Alliance matrix map to it, which makes it a useful way to organize answers. Certification is a multi-month program with audit costs. Mapping your six evidence items to its clauses buys most of the credibility; revisit certification when a client names it as a condition.
Is AI security training for employees required or just recommended?
Both, depending where you operate. NIST’s AI Risk Management Framework makes personnel training a named control in GOVERN 2.2, which matters because questionnaires map to it. EU AI Act Article 4 has required sufficient AI literacy among staff since February 2, 2025, reaching US companies with European staff or customers. Outside that scope it is not statutory, and still the hardest line on the form to answer honestly.
Who should own the AI questionnaire response inside a 100-person company?
Whoever already owns your security questionnaires, usually an operations, compliance or IT lead, with the AI use policy owner named alongside them. One person assembling the folder, one person signing. The failure mode is a group that meets about it and produces no dated documents.
Key takeaways
- Your carrier and your largest client ask nearly the same AI questions in the same quarter. Build one evidence folder for the harder audience, the client, and the insurance form answers itself.
- Six items carry both reviews: a dated tool inventory, a written AI use policy, a named owner with a review cadence, data controls marked block or alert, access logs, and training records.
- Coverage is eroding through endorsements and narrowed definitions rather than one visible clause. Get a written broker position on three scenarios instead of searching for the word “artificial.”
- Application answers are representations the carrier relies on. The exposure is the confident answer an incident later contradicts, as Travelers v. ICS shows.
- Training records are the only item that cannot be produced in a week, and the only one evidencing behavior rather than paperwork. NIST GOVERN 2.2 and EU AI Act Article 4 both name it.
Dirk Jan van Veen, PhD
