AI is creating new questions for the cyber insurance market, with industry leaders debating whether emerging risks should be covered under existing policies or eventually warrant a dedicated line of insurance.
At KYND’s inaugural Cyber Drop Live, senior cyber market participants examined how insurers should respond as artificial intelligence becomes more deeply embedded in business operations. While views differed on whether AI requires its own insurance category, delegates highlighted several areas where existing coverage could face pressure.
One point of agreement was that the involvement of AI does not automatically make an incident a cyber risk. The cause of a loss will continue to influence which insurance product responds. For example, litigation linked to AI-washing could fall under directors and officers (D&O) insurance, while discriminatory decisions made by an AI recruitment tool could create an employment practices exposure.
However, delegates also identified a potential gap around losses caused directly by an AI system producing an incorrect or unreliable outcome. This raises questions for cyber underwriters about whether issues such as model drift or hallucinations should be treated as technology failures, cyber incidents or something else entirely.
The discussion included an example involving an AI coding agent that was operating under a code freeze but deleted a company’s production database. The system initially reported that everything was functioning normally before acknowledging the failure when it could no longer produce a recent sales record. No attacker was involved, and the incident did not necessarily constitute a conventional network outage, but the business was nevertheless disrupted.
That scenario highlights a potential challenge for traditional cyber policies. System failure coverage can depend on an unplanned outage or material degradation of a network. An AI system can continue operating while producing incorrect outputs, potentially leaving businesses with losses that do not fit neatly within existing definitions of a cyber event.
One estimate raised during the session suggested that only around half of 50 plausible AI hallucination scenarios could fall within existing cyber coverage. While the figure was presented as part of the discussion rather than as established market data, it illustrates the uncertainty insurers face when assessing AI-related exposures without extensive historical claims information.
Another concern discussed was the growth of so-called shadow AI. Attempts to tightly control which AI tools employees can use could encourage some staff to turn to unauthorised services on personal devices. For insurers, this creates another layer of exposure that may be difficult to identify during underwriting because organisations may not have complete visibility over how AI is being used internally.
The issue has parallels with the development of silent cyber risk, where cyber exposures were embedded within policies that were not originally designed to cover them. The emergence of AI could create a similar challenge if businesses adopt the technology faster than insurers can establish clear coverage definitions and exclusions.
The discussion also pointed to the pace at which AI adoption could accelerate. One attendee cited a global restaurant business that expects to be operated end-to-end by AI by 2027, raising questions about whether existing insurance products will be capable of responding to increasingly autonomous business operations.
For the cyber insurance market, the challenge is therefore not simply determining whether AI needs its own line of cover. It is establishing where responsibility sits when AI changes the underlying cause, scale and nature of an existing risk, while claims data remains limited.
Read the full KYND analysis now
Copyright © 2026 FinTech Global
