A data breach caused by an AI vulnerability, a product liability claim stemming from AI bias and many other scenarios could wipe out the gains created from using generative AI. Even worse, the company’s existence could be placed at risk. So an obvious question must be asked “Is the company truly insured for these risks?”
Obvious risks from using generative AI include:
- Data Poisoning: Malicious actors corrupting the training data.
- Bias and Discrimination: The risk of AI systems perpetuating or amplifying societal
biases. - Copyright Infringement: The risk that the AI output will violate another’s copyright or
intellectual property rights. - Privacy Violations: The risks related to the collection and use of personal data.
- “Hallucinations” and Inaccurate Outputs: The risk of AI generating false or misleading
information. - Security Vulnerabilities: The risks related to AI systems being exploited by hackers.
The Illusion of Coverage: Why Existing Policies May Fall Short
Don’t fall into the trap of thinking, “We have insurance, we’re covered.” Many business leaders assume their existing policies will protect them from AI-related mishaps. However, standard policies often have exclusions or limitations that can leave companies exposed. The excitement around new generative AI initiatives can overshadow the critical need to assess and insure against potential downsides, including accidental misuse, malicious attacks, or even unintended biases in the AI’s output.
The AI Insurance Boom: Lessons from the Cyber Insurance Rollercoaster
The market for AI risk insurance is poised for explosive growth, mirroring the rise of cyber insurance. But remember the lessons learned from cyber: (1) insurers excluded, or tried their best to exclude, cyber risks from standard policies to drive customers to buy their new cyber policies; (2) many of the insurers created complex cyber policies, with convoluted terms and conditions and limited buckets of coverage to protect themselves from large losses; and (3) the insurers aggressively contested claims. A similar pattern can be expected with AI.
A Cautionary Tale: How a Cyber Insurance Claim Was Rescinded After a Loss
Consider the cautionary tale of cyber insurance: One company answered questions truthfully on its insurance application but did not fully disclose the scope of its implementation of multi-factor authentication (MFA). Following a large loss after a breach occurred in an area without MFA, the insurer sued to rescind the entire policy, claiming misrepresentation. This highlights a critical point: after a loss, expect the insurer to scrutinize the application for even minor discrepancies to deny coverage. Be prepared for the same level of scrutiny with AI insurance.
Boardroom Responsibility: Understanding and Mitigating AI Risks
The board of directors has a fiduciary duty to understand and mitigate risks. With AI, that means proactively identifying potential failure points and ensuring adequate insurance coverage. Treat this like any other major strategic risk – conduct scenario planning, assess potential liabilities, and demand a clear insurance strategy.
Anticipate the Unthinkable
Use creative thinking when assessing risk. Generative AI is so new and rapidly evolving, there is not much history to rely on. Gather a team together and brainstorm the different ways an AI product can be misused or exploited by criminals with bad intentions. For instance, MITRE Adversarial Threat Landscape for AI Systems (ATLAS) maintains a knowledge base of adversary tactics and techniques based on real-world attack observations and realistic demonstrations from AI red teams and security groups. This would be a great place to start an analysis to learn how other AI-enabled products and services have been misused and exploited.
Beyond Crosswalks: Real-World AI Disasters and Insurance Blind Spots
Look at other AI-enabled product and service mishaps in the news. For instance, companies developing self driving cars initially anticipated pedestrians crossing in front of the cars only near crosswalks. Jaywalkers who crossed in front of the cars mid-street, and were sometimes killed, were not even considered as a possibility. Consider the implications for a health care company using AI for diagnostics: what if a malicious actor poisons the training data, leading to misdiagnosis and patient harm? Or what if the AI product diagnoses cancer incorrectly, leading to delayed treatment and patient death?
For a financial services firm: what if an AI-powered trading algorithm makes biased decisions that violate fair lending laws to unfairly deny loans to minority applicants? This could lead to regulatory investigations and class action lawsuits under fair lending laws.
A standard Commercial General Liability (CGL) policy provides product liability coverage. However, many of these policies also include a computer software exclusion by way of an endorsement. The exclusion states that insurance coverage “does not apply to ‘bodily injury’, ‘property damage’, or ‘personal and advertising injury’ arising out of the rendering of or failure to render any service in connection with the selling, licensing, franchising or furnishing of computer software, including electronic data processing programs, designs, specifications, manuals and instructions.” Bottom line: in these circumstances, the product liability coverage in a CGL policy likely will not pay the cost to defend a company from a lawsuit, let alone for any settlement or judgment entered against an individual.
Copyright Catastrophe: Will Insurance Cover AI-Generated Infringement?
Imagine a more innocuous use of generative AI: A marketing team uses generative AI to generate a catchy ad campaign. However, the AI pulls content that infringes on a competitor’s copyright. A lawsuit follows, alleging copyright infringement and unfair trade practices. Legal bills skyrocket, and the brand reputation takes a hit. Is insurance going to cover it? Dig deeper because the answer may not be what is expected …
Decoding a CGL Policy: What’s Covered, What’s Not
A CGL policy might seem like a safety net, but it has limitations. It might cover copyright infringement in advertisements, but what about AI-generated content used in one-on-one sales pitches, product descriptions, or investor reports? The definition of “advertisement” matters, and courts often interpret it narrowly. This means there would likely be no insurance coverage to provide a defense for a company for the sales pitch, product description, or investor report that violates a competitor’s copyright. Moreover, CGL policies have additional exclusions if a company is in the business of advertising or web design. Review standard policies carefully to see if they adequately cover AI-related risks.
Beyond CGL: Exploring Other Potential Coverage Options — and Their Limits
Next, look to the company’s other insurance policies:
- Cyber policies may offer some coverage for “media incidents,” but the definitions are
narrow and may not cover all AI-related risks. - Professional liability (E&O) policies and IP insurance are worth exploring, but they may
not be a perfect fit. - Many D&O policies exclude cyber risks, so be sure to check the fine print.
- Specific AI insurance policies may offer coverage, but it is important to critically analyze
the policy’s terms and conditions to see how the coverage is whittled away through
definitions, limitations, and narrow buckets of coverage. It is also important to vet the
insurer – do they have a history of paying claims or a reputation for denying claims and
suing their policyholders to disclaim coverage?
Do Not Wait for the Crisis: Proactive Steps to Protect the Company
Do not wait for a crisis to discover a company is underinsured. As an owner, officer, or director,
there is a responsibility to act now. Conduct a thorough insurance review with someone who
understands both AI and insurance. And demand a clear, comprehensive insurance strategy
that protects the company from the unique risks of generative AI.
