AI makes that exposure more complicated.

A client may claim:

“You promised this AI system would work—and it didn’t.”

That allegation can potentially turn a disappointing technology project into a costly professional-liability dispute.

What Does “Failure to Perform” Mean?

Imagine you’re hired to implement an AI customer-service system for an online retailer.

The contract says the system should:

• Integrate with the client’s CRM
• Categorize customer inquiries
• Generate suggested responses
• Route difficult cases to humans
• Reduce response times
• Operate within agreed technical requirements

Six months later, the client says the implementation failed.

The AI:

misclassifies requests

produces inaccurate responses

fails to escalate important cases

and

doesn’t integrate correctly with the CRM.

The client alleges that your company failed to deliver the professional services it was hired to provide.

It demands:

$600,000 in damages.

This is the type of dispute where technology E&O coverage may become relevant—depending on exactly what happened and how the policy is written.

What Is Technology E&O Insurance?

Technology E&O is a form of professional liability coverage designed for businesses providing technology-related professional services or products.

Depending on the policy, it may address claims alleging:

• Professional negligence
• Errors
• Omissions
• Inaccurate advice
• Failure to deliver contracted services
• Technology-service failures
• Software-related mistakes

The Insurance Information Institute explains that professional liability coverage can protect professionals against financial losses arising from client lawsuits alleging failures in professional services.

For an AI consultant, that can be highly relevant.

General Liability Isn’t the Same Thing

Suppose you’re an IT consultant visiting a client’s office.

You accidentally knock over an expensive monitor.

That sounds more like a traditional:

property-damage liability claim.

Now consider something very different.

You configure an AI workflow incorrectly.

The client’s automated system sends inaccurate information to thousands of customers.

The client loses money and sues you for professional negligence.

That’s a:

professional-services exposure.

Commercial general liability and professional liability serve different purposes. Triple-I specifically notes that professional liability/E&O is designed for claims involving professional mistakes, negligence or failure to perform as promised.

Why AI Creates New E&O Questions

Traditional software is already complicated.

AI introduces additional uncertainty.

An AI implementation can involve:

Client data

Third-party models

APIs

Prompts

Retrieval systems

Automated workflows

Human decisions

Cloud infrastructure

A failure anywhere in that chain can potentially affect the final result.

And when something goes wrong, the client may simply say:

“You built it.”

Scenario 1: AI Hallucinations Cause Financial Loss

Suppose a consulting company implements a generative-AI assistant for a financial-services client.

The system is supposed to help employees find internal information.

Instead, it occasionally generates inaccurate answers.

An employee relies on one.

The client suffers a significant financial loss.

Now everyone starts asking:

Was the model defective?

Was the consultant negligent?

Was the prompt architecture inadequate?

Was the client’s data wrong?

Should human review have been required?

Did the client use the system outside its intended purpose?

That complexity is exactly why AI contracts and E&O coverage deserve careful attention.

NIST’s Generative AI Profile recognizes that generative AI introduces or intensifies specific risks and recommends managing those risks throughout the AI lifecycle.

Scenario 2: The Integration Doesn’t Work

A retailer hires you for:

$150,000

to integrate an AI inventory-forecasting system.

You complete the project.

But the system repeatedly produces poor forecasts because the integration uses incomplete inventory data.

The client claims it suffered:

$750,000 in lost sales and excess inventory costs.

The dispute becomes:

Who was responsible for validating the data?

Your company?

The client?

The software vendor?

This is why your contract and your E&O policy must work together.

Scenario 3: AI Automation Takes the Wrong Action

Now imagine an AI system isn’t merely generating information.

It can take actions.

An automated agent can:

issue refunds

change orders

approve transactions

send communications

update customer records.

A configuration mistake causes the system to issue thousands of incorrect refunds.

The client claims:

$400,000 in losses.

The key question isn’t merely:

“Did the AI make a mistake?”

It becomes:

“Did the consultant negligently design, test or deploy the system?”

AI Agents Increase the Stakes

Generative AI is moving beyond:

Question → Answer

toward:

Goal → Decision → Action.

That changes the risk profile.

A chatbot giving an inaccurate answer may create one type of loss.

An AI agent capable of taking autonomous actions can potentially create a much larger chain of consequences.

NIST’s AI Risk Management Framework emphasizes that AI risks should be addressed throughout design, development, deployment, evaluation and use. Its framework organizes AI risk management around four functions:

Govern → Map → Measure → Manage.

For consultants, documenting those processes can become increasingly valuable.

Your Client May Blame You Even When the Vendor Failed

Imagine you implement a third-party AI model.

The model provider experiences a technical problem.

Your client’s application stops working.

The client loses revenue.

The consultant says:

“That wasn’t our system—it was the AI vendor.”

The client replies:

“You recommended the vendor.”

Now the dispute may involve:

vendor selection + professional advice + integration + contractual responsibility.

That’s why consultants should review whether their E&O policy addresses claims arising from services involving third-party technology.

Don’t Assume “AI” Is Automatically Covered

This is critical in 2026.

You may have purchased technology E&O five years ago.

At the time, your company provided:

website development + software consulting + cloud integration.

Today you’re providing:

LLM implementation + AI agents + automated decision systems + custom model integrations.

Your business has changed.

Has your insurance?

Ask your broker or insurer whether your policy’s description of professional services accurately includes your current AI activities.

The Professional Services Definition Matters

Find this section in your policy:

Professional Services

or equivalent wording.

Suppose it describes your company as:

“Information technology consulting services.”

Does that encompass:

AI model implementation?

Generative AI consulting?

AI agent development?

Prompt engineering?

Machine-learning integration?

AI governance consulting?

Don’t assume.

Ask.

If necessary, request that your insurance professional confirm how your current services are treated.

Your Insurance Application Matters Too

Suppose your application says:

80% website development

20% IT consulting

but your actual business has become:

70% AI implementation

30% software consulting.

That discrepancy could matter.

Keep your insurer informed when your business materially changes.

Your coverage should reflect what you actually do—not what you did three years ago.

Contractual Liability Can Create a Gap

Imagine your contract promises:

“The AI system will achieve 99.99% accuracy.”

That’s a dangerous promise.

Why?

Because you may have voluntarily accepted a contractual obligation far beyond what your insurance policy covers.

An E&O policy does not necessarily guarantee every contractual promise you make.

Review provisions concerning:

contractual liability

and contractual assumptions of liability.

Your lawyer and insurance broker should review significant technology contracts together where appropriate.

Be Careful With Performance Guarantees

AI consultants should be particularly cautious about promises such as:

“100% accurate.”

“Zero hallucinations.”

“Guaranteed 50% productivity improvement.”

“Completely unbiased.”

“Fully autonomous and error-free.”

These statements can create unrealistic client expectations.

AI systems inherently involve uncertainty.

NIST’s AI RMF specifically emphasizes understanding the limitations and uncertainties associated with AI systems.

Use measurable and realistic project specifications instead.

Define What “Success” Means

Instead of:

“Implement a successful AI assistant.”

define:

Supported use cases

Data sources

Testing criteria

Accuracy methodology

Escalation procedures

Human-review requirements

Deployment milestones

Excluded use cases

Client responsibilities

Acceptance testing

Now both parties have a clearer understanding of what:

“performed successfully”

actually means.

Human Oversight Can Reduce Risk

Consider an AI system generating customer refunds.

Option A:

AI decides → refund automatically issued.

Option B:

AI recommends → employee reviews → refund issued.

Option B introduces another control.

Not every AI workflow requires human approval, but high-impact actions deserve careful consideration.

NIST’s framework encourages organizations to identify, evaluate and manage AI risks throughout the system lifecycle.

Testing Is Your Best Defense

Before deployment, document:

What did we test?

What data did we use?

What failed?

What was corrected?

What limitations remain?

What did the client approve?

This documentation can be valuable if a dispute arises later.

Imagine a client claims:

“You never told us the model could generate inaccurate answers.”

You produce:

Testing report

Risk assessment

Written limitation disclosure

Client acceptance

Training records.

That doesn’t guarantee you’ll avoid liability.

But it creates a much stronger factual record.

Create an AI Acceptance Test

Before production deployment, consider agreeing with the client on measurable acceptance criteria.

For example:

CRM integration: Passed

Required data retrieval: Passed

Response latency: Within agreed range

Escalation workflow: Passed

Security testing: Completed

Human-review process: Implemented

Known limitations: Documented

Client approval: Received

The exact test should match the project.

Document Client Responsibilities

AI implementations are rarely consultant-only projects.

Clients may need to provide:

• Accurate data
• System access
• Subject-matter experts
• Security requirements
• Legal requirements
• User testing
• Final approval
• Human oversight
• Employee training

If the client provides inaccurate data and the system produces inaccurate results, responsibility can become disputed.

Your contract should clearly identify:

who is responsible for what.

Data Quality Can Become an E&O Problem

AI performance often depends heavily on data.

Think:

Poor data → poor output.

Suppose your client provides outdated product information.

The AI uses it.

Customers receive inaccurate product recommendations.

Who is responsible?

The answer may depend on:

contract + implementation + testing + representations + policy wording + applicable law.

NIST emphasizes data and system evaluation as important parts of managing AI risk.

Cyber Insurance and E&O Can Overlap

AI implementation can create both:

professional liability risk

and

cyber risk.

Suppose your AI integration accidentally exposes customer data.

The client alleges:

Professional negligence

while affected customers raise:

privacy claims.

Which policy responds?

Potentially:

Technology E&O

Cyber liability

or a combined:

Tech E&O + Cyber policy.

Coverage depends on the actual policies.

Consultants should understand how the two policies interact.

Intellectual Property Is Another AI Risk

Generative AI can create questions involving:

• Copyright
• Training data
• Generated content
• Software code
• Trademarks
• Confidential information

A client might claim that your implementation produced content creating an intellectual-property dispute.

Does your E&O policy cover that?

Maybe.

Maybe not.

Check:

IP exclusions + media liability + technology coverage + AI-related endorsements.

Do not assume professional liability automatically covers every intellectual-property claim.

What About Confidential Client Data?

Suppose an employee enters confidential client information into an unauthorized public AI service.

That information becomes exposed.

This isn’t purely:

an E&O issue.

It may involve:

cyber liability + privacy + contractual liability + professional negligence.

Tech consultants working with AI should therefore consider their entire insurance program rather than buying E&O in isolation.

Most E&O Policies Are Claims-Made

This is extremely important.

Triple-I explains that most professional liability policies are written on a claims-made basis.

That means timing matters.

Depending on the policy, you may need coverage in effect when:

the claim is made

and potentially need the relevant wrongful act to occur after the applicable:

retroactive date.

Never cancel an E&O policy casually after finishing an AI project.

A client could complain:

months or years later.

Understand the Retroactive Date

Suppose:

AI project completed: 2025

Client discovers alleged error: 2027

Lawsuit filed: 2027

Whether your 2027 policy responds can depend partly on its claims-made terms and retroactive date.

If you switch insurers, protect:

prior acts coverage

where appropriate.

A gap can be expensive.

Defense Costs Matter

Suppose a client demands:

$800,000.

You believe you did nothing wrong.

You still need attorneys.

Professional-liability insurance can cover legal defense against qualifying claims, subject to policy terms and limits.

But ask:

Are defense costs inside or outside the limit?

If they’re inside:

$1 million limit

minus

$300,000 defense costs

could leave substantially less available for a settlement or judgment.

How Much E&O Coverage Does an AI Consultant Need?

There is no universal answer.

Consider:

Contract value

Maximum foreseeable client loss

Size of clients

Services provided

Degree of automation

Data sensitivity

Contractual requirements

Defense costs

Number of projects

A consultant charging:

$25,000 per project

to small businesses may have very different exposure from a consultancy implementing:

$5 million AI systems

for financial institutions.

$1 Million May Not Always Be Enough

Imagine:

E&O limit: $1 million

A failed AI implementation generates:

Legal defense — $250,000

Client settlement — $850,000

Potential total:

$1.1 million.

If defense costs erode the same limit, the available insurance may be insufficient.

This is only an illustration, but it shows why limits should reflect your actual projects.

Review Your Largest Client

One useful exercise is:

What happens if our largest client alleges our biggest AI project failed completely?

Estimate:

• Potential remediation cost
• Client lost revenue
• Replacement-system expense
• Legal defense
• Contractual damages
• Third-party claims

Then compare the scenario with your:

E&O limit + deductible/retention + sublimits + exclusions.

Don’t Forget Your Deductible or Retention

A policy might provide:

$2 million E&O limit

with:

$25,000 retention.

Your company needs to be capable of funding that retention during a dispute.

A high limit with an unaffordable retention can still create a cash-flow problem.

Red Flags in AI Consulting Contracts

Before signing a major AI implementation agreement, pay particular attention to:

• Unlimited liability
• Broad indemnification
• Guaranteed performance
• Guaranteed accuracy
• Guaranteed regulatory compliance
• Broad intellectual-property warranties
• Responsibility for third-party platforms
• Consequential damages
• Liquidated damages
• Aggressive service-level guarantees

These aren’t automatically unacceptable.

But they should be reviewed against:

your actual ability to perform + your insurance coverage.

Your Contract and Insurance Should Match

Suppose your contract requires:

$5 million professional liability coverage.

Your policy provides:

$1 million.

Problem.

Or your contract accepts:

unlimited consequential damages

while your insurance excludes or limits some contractual exposures.

Another problem.

Your contract should not casually create liabilities far beyond your insurance program.

AI Risk Management Can Help Your Insurability

Good AI governance isn’t just for large corporations.

A consultant should be able to show:

Risk assessment

Testing

Human oversight

Change control

Data governance

Incident response

Client acceptance

Monitoring

NIST’s AI RMF provides a useful voluntary structure organized around Govern, Map, Measure and Manage.

This can help transform:

“We think our AI implementation is safe.”

into:

“Here is how we manage and document the risk.”

What to Ask Your E&O Insurer in 2026

Before renewing your coverage, ask:

1. Does my professional-services definition include AI consulting?
2. Are generative AI implementations covered?
3. Are AI-agent projects covered?
4. Does coverage include software development?
5. Does it include systems integration?
6. Are claims involving third-party AI platforms covered?
7. Are failure-to-perform allegations covered?
8. Are contractual liability claims restricted?
9. Are intellectual-property claims covered or excluded?
10. Does the policy include cyber liability?
11. Are privacy claims covered?
12. Are defense costs inside the limit?
13. What deductible or retention applies?
14. What is my retroactive date?
15. Is prior-acts coverage included?
16. What happens if I switch insurers?
17. Are regulatory investigations covered?
18. Are there AI-specific exclusions or endorsements?
19. Do subcontractors qualify under the policy?
20. Does the insurer need to approve major changes in our services?

AI Consultant Risk Checklist

Before deploying an AI system:

• Define the project’s scope.
• Define measurable acceptance criteria.
• Document AI limitations.
• Avoid unrealistic performance guarantees.
• Define client responsibilities.
• Review data quality.
• Test integrations.
• Test failure scenarios.
• Establish human oversight where appropriate.
• Document third-party AI dependencies.
• Review cybersecurity.
• Review privacy requirements.
• Document client approval.
• Maintain change-control records.
• Monitor production performance.
• Maintain incident-response procedures.
• Review contracts with counsel where appropriate.
• Confirm E&O covers your actual services.
• Review cyber coverage.
• Maintain continuous claims-made coverage where needed.

Frequently Asked Questions

What is E&O insurance for tech consultants?

Errors & Omissions insurance is professional liability coverage that can protect technology consultants against qualifying claims alleging professional errors, negligence, misrepresentation or inaccurate advice. IT consultants and software developers are among the professionals Triple-I identifies as candidates for professional liability insurance.

Can E&O cover a failed AI implementation?

Potentially. If a client alleges that your professional services were negligent or failed to meet applicable obligations, technology E&O may respond. However, coverage depends on the claim, policy wording, exclusions and endorsements.

Does general liability cover software mistakes?

General liability and professional liability address different exposures. Professional E&O is generally the more relevant coverage when a client alleges financial loss caused by mistakes in professional technology services.

Is AI automatically included in technology E&O?

Don’t assume so. Review your professional-services definition and any AI, technology, cyber, data or intellectual-property exclusions and endorsements.

What if the AI vendor caused the failure?

The client could still allege that you negligently selected, configured, integrated or recommended the vendor. Whether your policy responds depends on the allegations and coverage terms.

Does E&O cover AI hallucinations?

Potentially, if the hallucination leads to a covered professional-liability claim against your company. But AI-specific exclusions, contractual obligations and the circumstances of the loss can affect coverage.

Do I need cyber insurance as well?

Often it is worth considering. E&O generally focuses on professional-service failures, while cyber insurance can address data breaches, privacy events, ransomware and related cyber exposures. Some technology policies combine both.

Why does the retroactive date matter?

Most professional-liability policies are claims-made, so the timing of the alleged wrongful act and claim can be critical.

Can I guarantee my AI system will be accurate?

Be very cautious about absolute guarantees. AI systems can have limitations and uncertainty, and NIST recommends identifying and managing AI risks throughout their lifecycle.

Is the NIST AI Risk Management Framework mandatory?

The NIST AI RMF is a voluntary framework intended to help organizations manage AI risks and improve trustworthy AI development and use.

Final Thoughts

For technology consultants, AI changes the scale and complexity of professional liability.

A traditional software mistake might cause:

a broken feature.

An AI implementation mistake could potentially cause:

incorrect outputs → automated decisions → customer impact → lost revenue → client claim.

That doesn’t mean every failed AI project creates an insured E&O claim.

It means consultants should think carefully about the connection between:

AI project scope + contracts + testing + documentation + risk management + insurance.

The strongest defense isn’t simply:

“We have a $1 million E&O policy.”

It is:

Clear scope → realistic promises → documented testing → human oversight where appropriate → client acceptance → suitable E&O and cyber coverage.

As AI projects become more autonomous, consultants should make sure their insurance evolves alongside the services they provide.

You may have seen this claim online:

“60% of small businesses close within six months of a cyberattack.”

I do not recommend publishing that statistic as fact.

It has been repeated widely for years, but there is no strong, current primary source establishing that 60% of small businesses actually close after a cyberattack.

A stronger and more credible introduction for Insurance Guide Book is:

“Cyberattacks can create severe financial and operational disruption for small businesses, which often have fewer resources available for recovery.”

That statement is supported by current evidence. Verizon’s 2026 Data Breach Investigations Report says small organizations are disproportionately affected by ransomware and often have fewer resources available to respond.

Why Cyber Risk Is a Small-Business Problem

Many business owners still picture cybercriminals targeting:

banks + multinational corporations + government agencies.

But small businesses are attractive targets too.

They may store:

• Customer names
• Email addresses
• Payment information
• Employee records
• Login credentials
• Financial information
• Proprietary business data

And smaller organizations don’t necessarily have:

24/7 security teams + dedicated incident-response departments + large cybersecurity budgets.

Verizon’s 2026 DBIR analyzed thousands of incidents affecting small and medium-sized organizations and found ransomware remains a disproportionate problem for smaller organizations.

So the question isn’t simply:

“Could somebody hack us?”

A more useful question is:

“If something happens tomorrow, can we afford the recovery?”

That’s where cyber insurance enters the conversation.

What Is Cyber Liability Insurance?

Cyber insurance is designed to help businesses manage certain financial consequences arising from cyber incidents.

But “cyber insurance” isn’t one single standardized package.

Policies can differ substantially.

The FTC recommends that businesses consider whether they need:

first-party coverage, third-party coverage, or both.

Understanding that distinction is essential before deciding whether:

$1 million is enough.

First-Party Cyber Coverage

First-party coverage generally addresses losses suffered directly by your business.

According to the FTC, this can include costs associated with:

• Legal counsel
• Data recovery
• Customer notification
• Call-center services
• Lost income from business interruption
• Crisis management
• Public relations
• Cyber extortion
• Fraud
• Forensic investigation
• Certain fees, fines and penalties

Imagine your company’s systems are encrypted by ransomware.

Your immediate expenses might include:

Forensic investigation

↓

System restoration

↓

Legal consultation

↓

Customer notification

↓

Business interruption

↓

Public relations

A serious cyber incident can therefore generate multiple expenses simultaneously.

Third-Party Cyber Liability

Now imagine hackers steal customer information.

Customers allege that your company failed to protect their data.

That creates a different category of exposure.

Third-party cyber coverage can potentially address costs associated with:

• Claims from affected individuals
• Lawsuits
• Legal defense
• Regulatory inquiries
• Settlements
• Judgments
• Certain related expenses

The FTC specifically identifies these types of expenses when explaining third-party cyber coverage.

So a good cyber policy may need to protect both:

Your company’s own financial losses

and

Your liability to other people.

Why $1 Million Is a Common Starting Point

A small company shopping for cyber insurance may receive options such as:

$250,000

$500,000

$1 million

$2 million

$5 million

or higher.

Seeing a $1 million limit can feel reassuring.

After all:

$1,000,000 sounds like a lot of money.

For some small businesses, it may indeed provide substantial protection.

For others, it could be inadequate.

The correct question isn’t:

“Is $1 million a good cyber limit?”

It is:

“What could one realistic cyber incident cost my particular business?”

The Anatomy of a Cyber Claim

Consider a hypothetical online retailer.

It has:

25 employees

40,000 customer records

$4 million annual revenue

and relies heavily on its website for sales.

A ransomware attack shuts its systems down.

Potential costs could include:

Forensic Investigation

Cybersecurity specialists need to determine:

• What happened?
• How did attackers enter?
• What systems were affected?
• Was information stolen?
• Is the attacker still inside?

Legal Counsel

Specialist lawyers may need to determine:

• Notification obligations
• Regulatory requirements
• Contractual obligations
• Potential liability

Data Restoration

Servers, databases, applications and backups may need restoration.

Business Interruption

The website may be unavailable.

Orders stop.

Revenue falls.

Customer Notification

Affected customers may need to be notified depending on applicable laws and circumstances.

Crisis Management

Customers may begin asking:

“Is my information safe?”

The business needs a coordinated response.

Third-Party Claims

Customers or business partners may pursue claims.

Regulatory Response

Regulators may become involved depending on the data, jurisdiction and incident.

Suddenly:

$1 million doesn’t look quite as enormous.

Don’t Use IBM’s Average as Your Insurance Limit

IBM reported that the global average cost of a data breach in its 2025 research was approximately:

$4.44 million.

For the United States, the reported average was:

$10.22 million.

Those are striking numbers.

But they do not mean the average small business needs a $10 million cyber policy.

IBM’s study covers organizations and incidents of different sizes and characteristics.

Using a broad breach average as your personal insurance-limit recommendation would be misleading.

Instead, use your company’s actual exposure.

Start With Your Data

Ask:

How much sensitive information do we hold?

Consider:

• Customer records
• Employee records
• Payment information
• Health information
• Financial information
• Login credentials
• Confidential client files

A company storing:

500 relatively basic customer records

may have a very different exposure from one holding:

500,000 sensitive records.

Then Consider Your Revenue Dependency

This is often overlooked.

Suppose your business generates:

$30,000 per day.

A cyberattack takes your systems offline for:

10 days.

Potential lost revenue:

$300,000.

And that’s before considering:

forensics + legal fees + restoration + notification + PR + liability.

For a company highly dependent on technology, business-interruption exposure can consume a large portion of a cyber limit.

Ask How Long You Could Operate Offline

This is a powerful question.

Could your company function for:

1 hour?

Probably.

1 day?

Maybe.

1 week?

Problem.

30 days?

Potentially catastrophic.

Businesses especially vulnerable to downtime include:

• E-commerce stores
• SaaS companies
• Online marketplaces
• Medical practices
• Professional-services firms
• Payment processors
• Logistics companies
• Digital agencies
• Technology businesses

For these companies, cyber insurance shouldn’t be evaluated only as:

data-breach insurance.

Downtime may be equally important.

Ransomware Remains a Major Concern

Verizon’s 2026 DBIR reported that ransomware appeared in 48% of breaches in its dataset, up from 44% the previous year. It also found continued disproportionate effects on smaller organizations.

This makes ransomware coverage an important area to review.

But don’t ask only:

“Does my policy cover ransomware?”

Ask:

“Exactly which ransomware-related expenses are covered?”

Those are different questions.

Cyber Extortion Coverage

A cyber policy may potentially address expenses associated with an extortion event.

But check:

• Extortion sublimit
• Consent requirements
• Incident-response requirements
• Sanctions-related restrictions
• Exclusions
• Waiting periods
• Deductible or retention

The FTC specifically recommends asking whether a cyber insurer will help pay ransom demands in ransomware situations.

Coverage remains subject to policy terms and applicable law.

Business Interruption May Be More Important Than Ransom

Imagine:

Ransom demand: $100,000

but:

Lost income during recovery: $450,000.

The ransom isn’t necessarily the largest financial problem.

That’s why businesses should carefully examine:

Cyber business interruption coverage.

The FTC lists lost income from business interruption among expenses that first-party cyber insurance may cover.

Check how your policy defines:

Waiting period

Covered interruption

Period of restoration

Net income

Continuing expenses

Dependent business interruption

Your Vendor Can Be Hacked Instead of You

Here’s another scenario.

Your company’s network is secure.

But your:

cloud provider

or

payment processor

or

software vendor

gets compromised.

Your business stops operating.

Verizon’s 2026 DBIR reported that breaches involving third parties rose 60% from the previous year’s dataset and reached 48% of breaches.

The FTC also specifically recommends checking whether cyber insurance covers attacks involving data held by vendors and other third parties.

This makes third-party dependency increasingly important.

Ask About Dependent Business Interruption

Suppose your website depends on a cloud provider.

The cloud provider suffers a covered cyber event.

Your systems are fine.

But:

your website goes offline anyway.

Does your cyber policy respond?

Potentially—but don’t assume.

Look for coverage commonly described as:

Dependent Business Interruption

or similar terminology.

Check the actual wording.

Social Engineering Is Another Major Gap

Consider this example.

Your finance employee receives an email appearing to come from the CEO:

“Urgent. Transfer $175,000 to this supplier today.”

The employee complies.

Later, everyone discovers:

the email was fraudulent.

Is that covered?

Maybe.

But cyber policies and crime policies may treat social-engineering losses differently.

You need to check:

• Social engineering coverage
• Funds transfer fraud
• Computer fraud
• Crime coverage
• Applicable sublimits
• Verification requirements

Don’t assume:

“It involved a computer, so cyber insurance covers it.”

Watch the Sublimits

This is one of the biggest traps.

Your declarations page says:

Cyber Liability Limit: $1,000,000.

Excellent.

Then you read further:

Social Engineering: $100,000

Cyber Extortion: $250,000

PCI Expenses: $100,000

Reputational Loss: $50,000

The headline:

$1 million

doesn’t necessarily mean every type of cyber loss has $1 million available.

Always review:

sublimits.

Does Defense Cost Reduce Your Limit?

This can make a huge difference.

Suppose your policy has:

$1 million limit.

A cyber liability lawsuit generates:

$300,000 legal defense costs.

If defense costs are:

inside the limit,

you may have only:

$700,000

remaining for covered settlements or other amounts subject to the same limit.

Ask:

Are defense costs inside or outside my policy limit?

Never assume.

Understand Your Retention

Cyber policies often have a:

retention

similar in concept to a deductible.

Suppose:

Covered claim: $150,000

Retention: $25,000

Your business may need to absorb the first:

$25,000

before applicable insurance responds according to the policy.

Choose a retention your company could realistically fund during a crisis.

Is $1 Million Enough for a Freelancer?

Potentially.

Imagine an independent marketing consultant who:

• Has no employees
• Holds relatively little sensitive information
• Has modest revenue
• Uses reputable cloud services
• Maintains good cybersecurity
• Has limited contractual cyber exposure

A $1 million limit could potentially be substantial relative to the company’s exposure.

But even here:

review the policy rather than relying on the number.

Is $1 Million Enough for an E-Commerce Business?

The answer becomes more complicated.

An online retailer may have:

• Large customer database
• Payment-related exposure
• Heavy website dependency
• Third-party vendors
• Business-interruption risk
• Privacy obligations
• International customers

For such a company, $1 million may or may not be sufficient.

You need a realistic loss scenario.

Is $1 Million Enough for a Medical Practice?

Potentially sensitive exposure can be much greater.

A medical practice may hold:

• Patient identities
• Health information
• Insurance information
• Billing information
• Employee records

It may also face industry-specific privacy and regulatory requirements.

A generic:

“Every small business needs $1 million”

recommendation would therefore be inappropriate.

Is $1 Million Enough for a SaaS Company?

Again, perhaps—but not automatically.

A SaaS business may have relatively few employees while supporting:

thousands of customers.

If a cyber event causes customer downtime, potential claims can extend beyond the company’s own recovery costs.

Contractual obligations become extremely important.

Review:

customer contracts + limitation-of-liability clauses + service-level agreements + cyber policy.

Revenue Isn’t the Only Measure

A company with:

$2 million revenue

could potentially have more cyber exposure than another company with:

$10 million revenue.

Why?

Because cyber exposure depends on:

data + operations + contracts + technology dependency + industry + customers.

Revenue is only one factor.

Build a Realistic Worst-Case Scenario

Instead of randomly selecting:

$1 million

try this exercise.

Estimate a serious but plausible incident.

These numbers are illustrative only, not industry averages.

But the exercise reveals something important.

A $1 million limit could be exhausted without the incident becoming a spectacular multinational breach.

Another Business Could Need Far Less

Consider a small local contractor.

The company:

• Stores minimal customer data
• Doesn’t process online payments
• Can operate manually for several days
• Has 5 employees
• Has limited contractual exposure

Its realistic cyber loss scenario might be significantly lower.

That’s why cyber limits should be:

exposure-based

rather than:

headline-based.

A Simple Cyber Limit Formula

There’s no universal formula, but businesses can start with:

Incident response costs

Data restoration

Business interruption

Potential customer notification

Potential legal liability

Regulatory exposure

Contractual obligations

Vendor-related exposure

=

Estimated severe cyber loss

Then compare that estimate with:

policy limit + sublimits + retention + exclusions.

Don’t Forget Aggregates

Your policy may have an:

aggregate limit.

Suppose you experience:

Incident 1 — $400,000

and later:

Incident 2 — $750,000.

If both draw from a:

$1 million annual aggregate,

you may encounter a coverage problem.

Businesses should understand both:

per-incident limit

and

aggregate limit.

Cyber Insurance Isn’t a Substitute for Cybersecurity

Buying $5 million of insurance while using:

password123

is not a risk-management strategy.

Insurers increasingly expect businesses to maintain cybersecurity controls.

Common controls may include:

• Multi-factor authentication
• Regular backups
• Software patching
• Endpoint protection
• Access controls
• Employee training
• Incident-response planning
• Vendor-risk management

The FTC recommends regular software updates, backups, cybersecurity policies and third-party risk assessments as part of small-business cybersecurity.

MFA Matters

Multi-factor authentication adds another verification step beyond a password.

This can make stolen credentials less useful to attackers.

Businesses should prioritize MFA for:

• Email
• Remote access
• Cloud systems
• Administrator accounts
• Financial systems

A strong cyber-insurance application should accurately describe your controls.

Never claim you have a security measure that isn’t actually implemented.

Backups Need to Be Recoverable

A company says:

“We’re safe. We have backups.”

Then ransomware strikes.

The company discovers:

the backups were also encrypted.

A backup strategy should consider:

• Frequency
• Isolation
• Access control
• Testing
• Restoration procedures

A backup you cannot restore isn’t much of a backup.

Create an Incident Response Plan

Imagine discovering ransomware at:

2:00 AM Saturday.

Who gets called?

Your:

IT provider?

Cyber insurer?

Attorney?

CEO?

Forensics company?

Don’t decide this during the attack.

The FTC recommends checking whether your cyber insurer provides a 24-hour breach hotline.

Save that number somewhere accessible even if your systems are offline.

Know Your Insurer’s Response Requirements

Some policies may require you to contact the insurer before hiring:

lawyers + forensic investigators + PR firms + negotiators.

The insurer may have an approved vendor panel.

If you hire outside providers without authorization, reimbursement could potentially become complicated depending on the policy.

Know the process before an incident.

Questions to Ask Before Buying Cyber Insurance

Ask your broker:

1. Does the policy cover both first-party and third-party losses?
2. What is the total aggregate limit?
3. What sublimits apply?
4. What is the retention?
5. Are defense costs inside the limit?
6. Is ransomware covered?
7. What cyber-extortion limit applies?
8. Is social engineering covered?
9. Is funds-transfer fraud covered?
10. Is business interruption covered?
11. What waiting period applies?
12. Is dependent business interruption covered?
13. Are cloud-provider outages covered?
14. Are third-party vendor breaches covered?
15. Are regulatory investigations covered?
16. Are notification expenses covered?
17. Are forensic expenses covered?
18. Is data restoration covered?
19. Is reputational harm covered?
20. Is there a 24/7 incident-response hotline?

The FTC specifically recommends evaluating first-party and third-party protection, data breaches, third-party data incidents, litigation/regulatory defense and breach-response support.

Signs $1 Million May Be Too Low

Consider evaluating higher limits if your business:

• Stores large amounts of sensitive data
• Processes significant online transactions
• Depends heavily on digital systems
• Could lose substantial revenue during downtime
• Serves large corporate clients
• Has contractual cyber requirements
• Operates in a regulated industry
• Depends heavily on cloud providers
• Has significant third-party liability exposure
• Would face expensive customer notification
• Has operations across multiple jurisdictions

None automatically means you need more than $1 million.

They mean:

run the numbers.

Signs $1 Million Might Be Reasonable

A $1 million limit may deserve consideration when:

• The business is relatively small
• Sensitive-data volume is limited
• Downtime exposure is modest
• Contractual liabilities are limited
• Strong cybersecurity controls are in place
• Your realistic loss modelling falls comfortably within the limit

Again, that’s not a recommendation that $1 million is sufficient.

Your broker or insurance professional should evaluate your actual exposure.

Cyber Insurance Checklist for 2026

Before renewing:

• Inventory sensitive data.
• Estimate daily revenue dependency.
• Calculate realistic downtime exposure.
• Identify critical vendors.
• Review customer contracts.
• Review regulatory obligations.
• Confirm first-party coverage.
• Confirm third-party liability coverage.
• Review ransomware protection.
• Review social-engineering coverage.
• Check business interruption.
• Check dependent business interruption.
• Review sublimits.
• Review retention.
• Check whether defense costs reduce the limit.
• Confirm incident-response procedures.
• Enable MFA where appropriate.
• Test backups.
• Patch critical systems.
• Train employees.
• Compare several coverage-limit options.

Frequently Asked Questions

Do 60% of small businesses really close after a cyberattack?

There isn’t strong current primary-source evidence supporting the widely repeated claim that 60% of small businesses close within six months of a cyberattack. Avoid presenting it as an established statistic.

There is, however, strong evidence that cyberattacks present substantial risks to smaller organizations. Verizon’s 2026 DBIR specifically reports that small organizations are disproportionately affected by ransomware.

Is $1 million of cyber insurance enough?

It can be enough for some businesses and insufficient for others. Consider data volume, business-interruption exposure, regulatory obligations, customer contracts, third-party liability and applicable sublimits.

What does small-business cyber insurance cover?

Depending on the policy, first-party coverage may address forensics, legal assistance, data recovery, notification, business interruption, crisis management and cyber extortion. Third-party coverage can address claims and lawsuits from others.

Does cyber insurance cover ransomware?

Some policies provide ransomware-related protection, but coverage terms, sublimits, exclusions and legal restrictions vary. Review the actual contract.

Does cyber insurance cover lost income?

Cyber business-interruption coverage can potentially cover qualifying lost income following a covered cyber incident. The FTC identifies lost income from business interruption as a potential first-party cyber coverage.

Does cyber insurance cover a hacked vendor?

Some policies may provide relevant coverage for incidents involving third-party vendors or dependent businesses. The FTC specifically recommends checking protection for cyberattacks involving data held by vendors and third parties.

Does cyber insurance cover phishing?

Potentially, but don’t assume it does. Social-engineering and funds-transfer fraud losses can have separate coverage provisions and relatively low sublimits.

How much cyber insurance should a small business buy?

There is no universal amount. Estimate a severe but realistic cyber incident and compare the potential total cost with available limits, sublimits, deductibles/retentions and exclusions.

Final Thoughts

The biggest mistake a small business can make isn’t necessarily buying:

$1 million instead of $2 million.

It’s choosing a number without understanding the exposure behind it.

Your cyber limit should reflect:

How much data do you hold?

How long could you survive offline?

How much revenue could you lose?

What could customers claim against you?

What do your contracts require?

What sublimits exist inside the policy?

A $1 million policy could be substantial protection for one small company and dangerously inadequate for another.

And don’t build the article—or your insurance decision—around the questionable:

“60% of small businesses close after a hack”

statistic.

The current evidence is compelling enough without it: Verizon’s 2026 research shows ransomware continues to disproportionately affect smaller organizations, while the FTC warns that recovering from a cyberattack can be costly.

The better strategy is:

Strong cybersecurity + realistic loss modelling + appropriate insurance coverage + a tested incident-response plan.

For consumers, the biggest change is not simply that “AI makes insurance cheaper.”

Instead, AI can potentially make pricing more individualized.

Your premium may increasingly reflect a more detailed picture of risk based on the data legally available to an insurer, its approved rating methodology, your jurisdiction and the type of insurance involved.

That creates both an opportunity and a concern:

Better risk information can improve pricing accuracy—but poorly designed models can also produce unfair or discriminatory outcomes.

Insurance Pricing Is Becoming More Data-Driven

Insurance has always relied on data.

An auto insurer might traditionally consider factors such as:

• Driving history
• Vehicle
• Location
• Annual mileage
• Claims history
• Coverage limits
• Deductibles

A property insurer might consider:

• Location
• Construction type
• Replacement cost
• Claims history
• Fire protection
• Catastrophe exposure

AI doesn’t eliminate these fundamentals.

Instead, it can allow insurers to analyze much larger and more complex datasets and detect relationships that conventional models might not identify as quickly.

The NAIC says AI adoption in insurance has been driven partly by the availability of large datasets, greater computing power and cloud technology.

Think of Traditional Pricing vs. AI-Assisted Pricing

A simplified traditional model might look like:

Age + location + vehicle + driving record → premium

A more data-intensive system might evaluate:

Traditional rating variables

Driving or property information

Behavioral patterns where permitted

Historical claims patterns

Large-scale risk models

↓

More detailed risk assessment

That does not mean every insurer uses every type of data.

Insurance rating variables are regulated, and what can legally be used varies by jurisdiction and insurance line.

But the direction is clear:

insurance underwriting is becoming increasingly computational.

AI Can Find Patterns Humans Might Miss

Imagine an insurer has information from millions of claims.

A human analyst cannot manually compare every relationship among:

location + vehicle + weather + claim severity + repair cost + mileage + driving patterns.

Machine-learning systems can analyze enormous datasets and identify correlations.

That may help insurers estimate:

How likely is a claim?

and:

How expensive might that claim be?

Those two questions sit at the heart of insurance pricing.

AI Doesn’t Set Every Premium by Itself

This distinction is important.

“AI pricing” can sound as though a computer simply decides:

John pays $1,420.

Sarah pays $1,880.

Real insurance pricing is much more constrained.

Insurers operate under state insurance laws, rate-filing requirements and rules prohibiting unfair discrimination.

AI can support:

risk classification + underwriting + modelling + pricing decisions,

but those processes still have to comply with applicable insurance laws.

Texas regulators reinforced that point in June 2026, telling regulated insurance entities that decisions made or supported by AI remain subject to laws addressing unfair practices and unfair discrimination.

Auto Insurance Is a Natural Home for AI

Auto insurance provides enormous amounts of potentially useful data.

Modern vehicles and telematics systems can generate information relating to:

• Mileage
• Braking
• Acceleration
• Driving time
• Routes
• Vehicle use
• Collision events

Usage-based insurance programs can use permitted driving information to differentiate risk.

Consider two drivers.

Driver A

Drives:

4,000 miles per year

mostly during daylight and has relatively cautious driving behavior.

Driver B

Drives:

25,000 miles per year

and exhibits significantly more risky driving patterns.

Historically, insurers might have had less direct visibility into these differences.

Telematics and advanced analytics can provide more information.

That can make insurance increasingly:

behavior-sensitive.

Good Behavior Could Potentially Help

For some consumers, increased personalization can be beneficial.

Suppose you:

• Drive relatively little
• Avoid aggressive braking
• Maintain a strong driving record
• Participate successfully in an insurer’s usage-based program

An insurer may potentially view you as a better risk than another otherwise similar driver.

That can result in more favorable pricing under some programs.

But consumers should check the terms carefully because telematics programs differ.

Poor Behavior Could Work the Other Way

Personalization cuts both ways.

If a program identifies:

high mileage + repeated speeding + aggressive braking + risky driving times,

that information could potentially produce less favorable pricing depending on the insurer and jurisdiction.

This creates a fundamental trade-off:

More individualized pricing can reward lower risk.

But:

It can also expose higher-risk behavior.

AI Is Changing Home Insurance Too

Property insurance is another area where sophisticated modelling is becoming increasingly important.

Consider wildfire.

An older pricing approach might rely heavily on:

ZIP code + historical wildfire experience.

Modern catastrophe modelling can evaluate risk at a much more granular level.

Potential factors can include:

• Vegetation
• Terrain
• Fire history
• Building characteristics
• Nearby structures
• Wind patterns
• Mitigation
• Regional catastrophe exposure

California provides a significant example.

Its insurance reforms now permit approved forward-looking wildfire catastrophe models in the rate-setting process, and the California Department of Insurance says mitigation and home-hardening measures can be reflected in insurance rates.

That isn’t simply “AI determining your premium.”

But it demonstrates the broader movement toward sophisticated forward-looking risk modelling.

Your Property’s Individual Characteristics Matter More

Imagine two houses located relatively close together.

House A

Has:

• Fire-resistant roof
• Cleared vegetation
• Defensible space
• Updated construction
• Lower surrounding fuel exposure

House B

Has:

• Older combustible roof
• Dense vegetation
• Higher wildfire exposure
• Limited mitigation

Historically, geographic pricing might group them relatively broadly.

More granular risk modelling can potentially distinguish them more precisely.

That creates an important opportunity:

Risk mitigation may become increasingly measurable.

AI Could Make Insurance More Preventive

Traditional insurance often works like this:

Something bad happens → claim occurs → insurer pays.

Technology can shift part of the model toward:

Risk detected → warning issued → loss potentially prevented.

For example, insurers and technology providers can potentially use data to identify:

• Water leaks
• Unsafe driving
• Equipment failure
• Fraud patterns
• Property vulnerabilities

Preventing a claim can benefit both sides.

The customer avoids disruption.

The insurer avoids a loss.

AI Is Changing Claims Too

Pricing isn’t the only area being transformed.

The NAIC identifies claims handling and fraud detection among the insurance functions where AI is being used.

Imagine a relatively straightforward vehicle claim.

Instead of:

Claim filed → adjuster scheduled → inspection → estimate → review

technology may help with:

Digital claim submission → image analysis → damage assessment → fraud screening → adjuster review.

For relatively simple claims, that can potentially reduce processing time.

Faster Claims Could Eventually Affect Costs

Claims administration costs money.

Insurers pay for:

• Adjusters
• Inspections
• Fraud investigation
• Administration
• Customer service
• Documentation

If automation makes some processes more efficient, it could reduce certain operating costs.

But consumers should not assume:

AI efficiency = automatic premium reduction.

Premiums are affected by many much larger factors, including:

• Claim frequency
• Claim severity
• Medical inflation
• Repair costs
• Litigation
• Catastrophe losses
• Reinsurance
• Construction costs

AI is only one part of the equation.

AI May Detect Fraud Faster

Insurance fraud ultimately contributes to claim costs.

Machine-learning systems can potentially identify unusual patterns across enormous claim datasets.

For example:

Claim A

looks normal individually.

But the system notices that:

same address + related phone numbers + repeated repair shop + similar loss pattern

appeared across numerous previous claims.

That might trigger additional review.

AI can therefore help investigators prioritize potentially suspicious claims rather than manually reviewing everything.

But AI Can Make Mistakes

Now consider the opposite problem.

Your legitimate claim resembles a statistical pattern associated with fraud.

The system flags it.

You did nothing wrong.

This is why human oversight matters.

A risk score should not automatically become:

proof of wrongdoing.

Texas’s 2026 AI guidance emphasizes human oversight, fairness, accuracy, transparency, privacy, security and accountability in insurance AI governance.

The Biggest Concern: Unfair Discrimination

Insurance necessarily differentiates among levels of risk.

That is fundamental to underwriting.

But there is a critical distinction between:

lawful risk classification

and

unfair discrimination.

AI can potentially create problems when:

• Training data contains historical bias
• A variable acts as a proxy for a protected characteristic
• Data is inaccurate
• Models produce unexplained disparities
• Third-party data isn’t adequately validated

Regulators are paying increasing attention to exactly these issues.

“The Algorithm Did It” Isn’t a Defense

Suppose an insurer purchases a third-party AI underwriting model.

The vendor builds it.

The insurer uses it.

Consumers are affected.

If the model produces decisions that violate applicable insurance law, the insurer generally cannot assume responsibility disappears simply because another company supplied the technology.

The NAIC’s AI Model Bulletin specifically emphasizes insurer responsibility for AI systems, including systems developed by third parties.

Texas similarly states that its expectations extend to third parties working with regulated entities.

That is becoming a major theme in insurance AI regulation:

Outsourcing the model doesn’t automatically outsource accountability.

Regulators Want AI Governance

The NAIC adopted its Model Bulletin on insurers’ use of AI in December 2023.

It establishes expectations around insurers’ governance of AI systems and reminds companies that AI-supported decisions remain subject to existing insurance law.

In 2025 and 2026, the NAIC has also been developing an AI Systems Evaluation Tool to help regulators examine insurer AI use, governance, risk mitigation, high-risk models and underlying data.

As of March 2026, the tool was being piloted by 12 states, with adoption anticipated at the NAIC’s 2026 Fall National Meeting.

That is an important development.

Insurance AI is moving from:

“Interesting new technology”

toward:

“Something regulators expect to examine.”

Regulators Can Ask How the Model Works

Texas’s June 2026 guidance is particularly instructive.

The Texas Department of Insurance says its monitoring may include questions concerning:

• Governance frameworks
• Risk management
• Data protections
• Privacy
• Internal controls
• Specific uses of AI

It also says regulated entities should be able to provide information about their AI procedures and protections when requested.

The message to insurers is increasingly:

Don’t merely use AI.

Be able to explain how you’re controlling it.

Third-Party Data Is Becoming a Major Issue

Insurers don’t necessarily develop every model internally.

They can rely on:

vendors + data providers + external models + analytics platforms.

That creates a difficult regulatory question:

How does an insurer validate a model it didn’t build?

The NAIC created a Third-Party Data and Models Working Group specifically to develop a regulatory framework around third-party AI data and models used by insurers.

For consumers, this matters because the information influencing an insurance decision may originate outside the insurance company itself.

What If the Data Is Wrong?

Imagine an external dataset incorrectly indicates something that makes you appear riskier.

An algorithm uses that information.

Your insurance decision is affected.

Now the issue isn’t necessarily:

bad AI.

It might be:

bad data.

AI can process information extremely quickly.

But:

Fast analysis of inaccurate information is still inaccurate analysis.

Data quality therefore becomes just as important as model sophistication.

AI Could Create Hyper-Personalized Insurance

Traditional insurance groups many people into relatively broad risk categories.

Future insurance could become increasingly individualized.

Instead of:

“Drivers like you generally have this risk.”

the system moves toward:

“Your individual behavior indicates this risk.”

Similarly, property insurance could increasingly move from:

“Homes in this ZIP code”

toward:

“This specific property’s characteristics and surrounding hazards.”

That can improve precision.

But extreme personalization raises policy questions.

Insurance Depends on Risk Pooling

Insurance works because risk is pooled.

Many policyholders pay premiums.

Relatively few experience major losses at the same time.

If technology predicts individual risk with extraordinary precision, a philosophical question emerges:

How individualized should insurance become before risk pooling starts to weaken?

Suppose an algorithm predicts that one household has an exceptionally high probability of loss.

Should its premium become:

2× higher?

5× higher?

Should coverage become unavailable?

These aren’t purely technological questions.

They are:

regulatory + economic + social questions.

Climate Risk Makes This Even More Complicated

AI and catastrophe modelling are developing at the same time climate-related losses are reshaping property insurance.

Insurers increasingly need to understand:

• Wildfire
• Hurricane
• Flood
• Severe convective storms
• Changing construction costs
• Geographic concentration

California is already incorporating forward-looking catastrophe models into its modernized property-insurance framework.

This can improve forward-looking risk assessment.

But it can also make insurance pricing more sensitive to location-specific catastrophe exposure.

Your ZIP Code May Become Less Important—and Your Exact Property More Important

Traditional property rating may heavily reflect:

Where do you live?

Advanced modelling can increasingly ask:

What exactly surrounds your home?

How is your home constructed?

What mitigation have you completed?

What catastrophe exposure does this exact location face?

For some homeowners, greater granularity could help.

For others, it may reveal risk that broad geographic averages previously obscured.

AI May Also Change Life Insurance

Life insurers have traditionally relied on information such as:

• Age
• Medical history
• Lifestyle
• Occupation
• Coverage amount
• Underwriting information

Automation can help insurers process applications and assess qualifying risks faster.

For certain applicants, that can mean:

application → automated underwriting → faster decision

rather than weeks of traditional underwriting.

But the same principles apply:

Data accuracy matters.

Fairness matters.

Privacy matters.

Applicable law still matters.

Health Insurance Has Different Rules

Consumers should be careful not to assume AI affects every insurance line identically.

For example, U.S. Affordable Care Act rules prohibit health insurers in the individual and small-group markets from using health status or gender to set premiums, while permissible premium variation is limited to specified factors such as age, location, tobacco use and family enrollment.

So the statement:

“AI analyzes everything and determines everyone’s health premium”

would be misleading.

Insurance regulation differs significantly by:

product + state + market.

Commercial Insurance Could Become Much More Dynamic

Businesses generate enormous quantities of risk information.

A commercial insurer might potentially analyze:

• Fleet telematics
• Cybersecurity controls
• Building sensors
• Claims history
• Employee safety information
• Supply-chain exposure
• Property characteristics

This can move commercial underwriting away from:

once-a-year questionnaire

toward:

more continuous risk assessment.

That could particularly affect:

• Commercial auto
• Cyber
• Property
• Workers’ compensation
• Business interruption

Cyber Insurance Shows Where Things May Be Heading

Cyber insurance already demonstrates how rapidly changing risk can affect underwriting.

Insurers may ask organizations about:

• Multi-factor authentication
• Backups
• Endpoint protection
• Employee training
• Incident response
• Network controls

AI could help insurers analyze this information more efficiently.

Instead of asking only:

“Do you have MFA?”

a future underwriting system might evaluate:

How consistently is it deployed?

Which accounts lack it?

How quickly are vulnerabilities addressed?

That creates a potentially more dynamic relationship between:

risk controls → underwriting → premium.

The Positive Scenario

AI develops responsibly.

Insurers become better at identifying genuine risk.

Consumers who reduce risk receive more recognition.

Claims become faster.

Fraud declines.

Operational costs fall.

Insurance becomes:

more accurate + faster + more personalized + more preventive.

That is the optimistic future.

The Negative Scenario

Models become too opaque.

Poor-quality data spreads through underwriting.

Consumers cannot understand why decisions were made.

Proxy variables create unfair outcomes.

Automation removes meaningful human review.

Insurance becomes:

more complicated + less transparent + harder to challenge.

That is why regulation matters.

What Consumers Should Do in 2026

You don’t need to understand machine learning to protect yourself.

Focus on what you can control.

Check Your Information

Incorrect information can affect underwriting even without AI.

Review:

• Driving record
• Claims history
• Property details
• Vehicle information
• Credit-related information where legally permitted
• Other information used in your application

Ask About Telematics

Before joining a usage-based auto program, ask:

What information is collected?

Can my premium increase?

How long is the data retained?

Who receives it?

Document Property Improvements

If you’ve improved your home’s resilience, document it.

Examples include:

• Roof replacement
• Fire-resistant materials
• Defensible space
• Alarm systems
• Water-leak detection

Ask whether those improvements affect underwriting or discounts.

Shop Around

Different insurers can evaluate risk differently.

If one insurer’s model produces an unattractive price, another may produce a different result.

Ask Why

If you receive a major premium increase or underwriting decision, ask your insurer or agent:

What factors contributed to this decision?

Don’t assume:

“The computer decided it.”

is a sufficient explanation.

What Businesses Should Do

Businesses should increasingly treat insurance as a data-driven risk-management exercise.

Document improvements such as:

Fleet safety

↓

Telematics evidence

Cybersecurity

↓

Security controls

Property resilience

↓

Mitigation documentation

Workplace safety

↓

Loss-prevention records

Then provide this information to your broker and insurers.

As underwriting becomes more sophisticated, businesses capable of demonstrating risk quality may be better positioned than those that merely claim to be safe.

2026 AI & Insurance Checklist

Before your next insurance renewal:

• Review the information on your policy.
• Correct inaccurate property or vehicle information.
• Review your claims history.
• Ask whether telematics affects your auto pricing.
• Understand what telematics data is collected.
• Document home-safety improvements.
• Document wildfire mitigation where relevant.
• Review cyber controls for business policies.
• Ask which discounts are available.
• Ask what caused significant premium changes.
• Compare several insurers.
• Don’t assume AI automatically means cheaper insurance.
• Keep records supporting your risk improvements.
• Challenge inaccurate information through appropriate processes.
• Review your coverage—not only your premium.

Frequently Asked Questions

Are insurance companies using AI in 2026?

Yes. The NAIC says insurers use AI in underwriting, pricing, customer service, claims, marketing and fraud detection.

Can AI determine my insurance premium?

AI and advanced models may support pricing and underwriting, but insurance rates remain subject to applicable state laws, regulations and regulatory processes. AI isn’t free to ignore insurance law.

Will AI make my insurance cheaper?

Not necessarily. Better risk assessment may benefit some policyholders, but premiums also depend on claims costs, catastrophe exposure, repair costs, inflation, coverage and many other factors.

Can AI increase my premium?

Potentially, if permitted information or modelling indicates higher risk and the insurer’s applicable rating methodology allows it. The precise rules vary by insurance product and jurisdiction.

Can insurers use any data they want?

No. Insurers remain subject to insurance, privacy, consumer-protection and anti-discrimination requirements applicable in their jurisdictions.

Is AI allowed to discriminate?

Insurance AI decisions must comply with applicable laws prohibiting unfair discrimination. Texas’s 2026 AI bulletin explicitly reinforces this requirement.

Who is responsible if an insurer’s AI makes a mistake?

Insurers remain responsible for complying with applicable insurance laws when using AI, including when third-party technologies are involved.

Are regulators monitoring insurance AI?

Yes. The NAIC has developed a Model Bulletin and, as of March 2026, was piloting an AI Systems Evaluation Tool with 12 states to support regulatory review of insurer AI systems.

Is AI used only for pricing?

No. Insurers also use it in underwriting, claims, fraud detection, marketing and customer service.

Will human insurance agents disappear?

AI can automate many administrative and analytical tasks, but insurance still involves complex coverage decisions, regulation, claims disputes and risk advice where human expertise remains valuable.

Final Thoughts

The insurance industry of 2026 is increasingly moving from:

historical averages

toward:

more detailed risk prediction.

AI can analyze enormous amounts of information, identify patterns and help insurers make decisions faster.

That could create real benefits:

Faster underwriting

Faster claims

Better fraud detection

More individualized risk assessment

Greater recognition of risk-reduction efforts

But personalization has another side.

A model can be:

fast

and still be wrong.

It can be:

sophisticated

and still rely on poor data.

It can be:

automated

and still create unfair outcomes.

That’s why the future of insurance isn’t simply:

AI replacing human underwriting.

It is more likely:

AI + data + human oversight + regulation.

The NAIC’s ongoing work and Texas’s 2026 guidance both point in that direction: insurers are expected to manage AI through governance, risk controls and compliance with existing insurance law.

For consumers, the best strategy remains surprisingly traditional:

Understand your coverage → keep your information accurate → reduce your risk → ask questions → compare insurers.

Because even in the age of artificial intelligence, the cheapest premium isn’t necessarily the best insurance policy.