What we can and cannot say about cyber insurance AI questions
Nobody can tell you the exact wording on next year's proposal form, and anyone who claims to is guessing. Insurers differ, forms change, and brokers see variations that no general article can predict. What follows is a reasonable picture of the direction of travel, not a list of what any particular insurer asks.
What is safe to say: questions about cyber controls are long established, and questions about how a business uses AI tools are a natural extension of them. Clients are in the same position. Larger customers, government bodies and panel managers may send security and supplier questionnaires, and AI can be one more section in them.
The practical conclusion is simple. You do not need to predict the question. You need to know your own answers and be able to back them up.
Some of the confusion is vocabulary. Cyber policies are written around events such as ransomware, business email compromise and data breaches. An AI tool becomes relevant when it raises the chance of one of those, for example by sending client data somewhere you do not control or by making a convincing fake easier to produce. The insurer's interest is in the underlying risk, and the question wording follows.
The cyber basics still do most of the work
Before any AI-specific question, the established controls carry most of the weight. If these are shaky, an AI policy will not rescue the renewal.
These are dull and they matter. A business that can show all seven is in a stronger position than one with an impressive AI policy and no tested backup. If you can only fix one thing before renewal, fix the one that has been on the list longest.
- Multi-factor authentication on email, remote access and admin accounts.
- Backups that are kept separately and that someone has actually tested by restoring from them.
- Patching and supported software, including laptops and phones.
- Endpoint protection and email filtering.
- Removing access promptly when people leave or change role.
- A written plan for what happens in an incident, and who makes the first call.
- Some form of staff awareness training, with a record that it happened.
Where AI may appear in the questions
Notice that several of these are really about people and process. Whether staff may enter client information is a rule question. Whether you can show it was followed is an evidence question. The honest answer to the first is often 'we are in the middle of writing it', which is a reasonable thing to say if it is true and you can say when it will be done.
If you provide a professional service, expect interest in AI-assisted work product. An accountant, engineer or adviser who uses AI to draft advice may be asked how it is checked. 'A qualified person reviews and signs every document' is a much stronger answer than 'we are careful'.
These are the kinds of question you might reasonably expect, framed generally. Treat them as a rehearsal rather than a forecast.
- Do you have a written policy on staff use of AI tools?
- Which AI tools are in use, and are they approved by the business?
- Are staff allowed to enter client or personal information into AI tools, and how do you prevent it?
- Do you use AI to produce or check client deliverables, and does a person review the output?
- How do you assess the AI features and vendors you rely on?
- Have you had any incident involving an AI tool or the information entered into one?
Ask your broker, in writing, whether anything in your current policy wording or the renewal forms touches AI, and how they would like AI use disclosed. Also ask about funds transfer fraud and impersonation cover, because convincing fake voices and emails are part of the same conversation.
Clients ask too, and sooner than insurers
For many small and mid-sized businesses, the first AI questions arrive from a client rather than an insurer. They show up as a line in a supplier questionnaire, a clause in a renewed services agreement ('the supplier will not enter our data into generative AI tools without written consent'), or a phone call from someone in the client's procurement team.
Read those clauses properly. Some are narrow and easy to meet. Others, drafted generally, would catch things like an AI feature in your email software or a transcription tool used by one team member. If you have signed one of these, find out whether you are currently in line with it before the client asks.
This is also where a written policy and a tool register pay off. 'We have a policy, here are the approved tools and here is when we last reviewed them' is a short, credible answer.
Keep a copy of each questionnaire you answer and who answered it. When the same client asks again a year later, you can see what you said and whether it is still true.
Evidence beats assertion
A tick in a box is a statement. A document you can produce is evidence. If a claim is ever made, or a client audits you, the difference matters.
Start a folder, even a shared drive folder, with the things you would want to hand over: the dated AI policy, the tool register with a review date, a note of when staff were briefed, a screenshot or report showing multi-factor authentication coverage, a log of the last backup restore test, and the incident plan.
Calibre Forum's report includes a tool register based on what people say they use and a controls checklist of the kind insurers and clients tend to raise, with recommendations in priority order. It is not insurance advice, it does not certify anything, and your broker remains the person to ask about your policy.
Be cautious about overpromising on paper. A policy that says 'AI may never be used with client data' when three teams routinely do so is worse than one that admits current practice and sets a date to change it.
Answering honestly, including when you are not sure
Insurance runs on disclosure. In Australia, the Insurance Contracts Act sets out duties around what you tell an insurer, and inaccurate answers can create problems at the worst moment, which is when you claim. The safest habit is to answer what you can prove, and to say 'we are working on this' or 'in progress' rather than a confident yes you cannot support.
If you do not know what staff use, say so to yourself first. An owner who signs a form saying 'no AI tools are used' when three people use a personal chatbot has created a gap between the form and the facts. Finding out is cheap compared with explaining it later.
If a question is ambiguous, ask your broker what the insurer means by it. Get the answer in writing.
Fake supplier emails and cloned voices deserve a mention. Payment diversion fraud is already a source of loss for small businesses, and AI can make the fakes more convincing. A simple rule helps: any change to bank details is confirmed by phone, using a number you already hold, by someone other than the requester.
A sensible order of work before renewal
About three months out, find out what is in use: ask everyone, check the admin consoles and read the AI-related clauses in any client agreements. Then decide what is approved and write it down. Fix the cheap, high-value control gaps first, such as multi-factor authentication and a tested restore.
A month out, brief staff, date your documents and talk to your broker about what has changed in the business. At renewal, answer from the folder, not from memory. Afterwards, put a quarterly reminder in the calendar so the evidence does not go stale before next year.
None of this needs a consultant. It needs an afternoon of ownership, an honest look at what is in use and a folder.
Common questions
Will my cyber insurer ask about AI at renewal?
Possibly, but we cannot speak for any insurer. Some proposal forms and client questionnaires may include questions about AI policy, approved tools or entering client data into them. Your broker will know what your insurer currently asks. Preparing a short policy, a tool list and honest answers puts you in a good position whatever the form says.
Does using ChatGPT void my cyber insurance?
There is no general rule that it does. What matters is the wording of your policy, its conditions and exclusions, and whether your answers on the proposal were accurate. Ask your broker in writing whether anything in your policy touches AI tools, and tell them how your business actually uses them.
What evidence should I keep for cyber insurance and AI?
Keep documents you could hand over: a dated AI policy, a tool register with review dates, a record of staff briefings, proof of multi-factor authentication coverage, a recent backup restore test and your incident plan. Store them in one folder and refresh them each quarter, so they match what you say on forms.
Should I tell my insurer that staff use AI tools?
If a question asks, answer accurately, and ask your broker how to describe it. Insurance depends on honest disclosure, and the Insurance Contracts Act sets duties around it. Do not ignore the issue because the form is silent: ask your broker whether anything about your AI use is material to your cover.
This guide is general information, not legal, insurance or financial advice. Check your own obligations with a qualified adviser.