AI Insurance Disputes: Why the Policy Wording Matters

Artificial intelligence has created a new insurance classification problem. Risks involving data, privacy, employment, corporate governance and emerging technology may fall under different policies—or fall between them entirely.

A report on a NetDiligence digital risk summit in Philadelphia described significant disagreement among industry experts. Some speakers considered AI a digital risk; others placed it within directors and officers liability insurance, commonly called D&O; others regarded it as an emerging risk without a clear insurance home.

That disagreement is an important reminder: the label AI does not determine coverage. The policy wording does.

Why the policy language is decisive

Danielle Roth, Axa XL’s North American cyber claims leader, advised against treating AI as one indivisible risk. Her suggested approach was to return to basic insurance questions:

• Who is the insured?
• What is the nature of the loss?
• Has an event or claim occurred that triggers the policy?
• Do any exclusions apply?

Roth also noted that it may never be possible to establish whether AI was used in a violation.

Three possible categories—not one settled answer

Tim Nazzaro, Hartford Steam Boiler’s global digital products manager, divided AI risk into three categories.

1. Security and privacy risks

An AI tool that exposes personal information raises security and privacy questions.

The Federal Trade Commission’s cyber insurance guidance recommends checking whether a policy covers attacks involving data held by vendors and other third parties, breaches of the insured’s network, and attacks occurring outside the United States. The scope and trigger language determine whether a particular event falls within those protections.

2. Risks associated with other insurance

Nazzaro used discriminatory AI recruitment as an example that might be associated with employer liability insurance.

The result would still depend on the wording: who was harmed, what loss occurred, what legal obligation was involved and which policy was designed to respond to it.

3. Emerging risks without a clear home

Other AI exposures may not yet fit neatly within an existing category. Nazzaro warned against simply expanding coverage without first assessing the risk. He also noted that non-privacy regulatory fines arising under new AI rules might not be covered by a cyber policy.

Where cyber and D&O insurance may overlap

Gail Arkin, a senior vice president and general counsel at Berkley Cyber Risk Solutions, argued that AI-related problems may extend beyond electronic data. She identified infringement of third-party rights, improper use of data and algorithmic bias as concerns that may not be resolved by digital insurance alone.

Aon explains that D&O policies can help companies and their directors or officers manage risks arising from novel technologies. It recommends regularly auditing D&O policies when implementing or using AI.

Aon’s proposed approach includes examining and, where appropriate, changing:

• The definition of Loss
• The definition of Insured Person
• Exclusionary language relating to AI exposures

These definitions can determine whether a governance-related claim, regulatory consequence or alleged failure of oversight is connected to the protection offered by the policy.

Wording that can change the outcome

Insured parties and loss definitions

This is particularly important where a claim concerns the conduct of a director, officer, employee, vendor or AI provider.

The definition of Loss is equally important. A data breach, business expense, lawsuit, regulatory investigation or alleged governance failure may be treated differently by different policies.

First-party and third-party coverage

The FTC distinguishes between two broad forms of cyber coverage.

First-party coverage generally protects the insured’s data and may include costs associated with determining notification and regulatory obligations, cyber extortion and fraud, and certain fees, fines and penalties connected with the incident.

Third-party coverage generally responds when a third party brings a claim. It may include defence and settlement expenses and losses associated with matters such as defamation or infringement of copyright or trademark rights.

An AI dispute may therefore require more than one coverage analysis. A company can face its own direct costs while also facing a third-party claim arising from the same underlying event.

Duty to defend

The FTC recommends looking for express duty-to-defend wording when considering whether an insurer will defend a lawsuit or regulatory investigation.

Triggers and the scope of the incident

Coverage may depend on how the policy describes the event that starts the protection. JAMS’ description of its NetDiligence summit session on recent court decisions refers to disputes involving system failure, business interruption, biometric privacy claims, exclusions, policy compliance and downstream liability.

NetDiligence’s virtual programme also includes sessions titled How Policy Definitions Shape Cyber Coverage and AI and Cyber Insurance: Emerging Coverage Challenges. Together, they underline the need to examine definitions and claims history rather than assume that every technology-related incident receives the same treatment.

Exclusions

An exclusion can be decisive even when the initial loss appears connected to AI. The relevant wording may determine whether privacy breaches, regulatory penalties, third-party claims, employment discrimination or other non-privacy violations fall within or outside the policy.

Nazzaro’s warning is particularly relevant: expanding a policy’s scope without evaluating the underlying risk may create uncertainty when an incident occurs.

Other insurance and policy conditions

The FTC also recommends checking whether cyber insurance provides coverage in excess of other applicable insurance. That is only one part of the analysis. The insured should also review all policy conditions, endorsements and requirements governing the claim.

Policy compliance was among the issues identified in the JAMS summit description, showing that coverage analysis is not limited to the wording describing the loss. Conditions governing the insured’s conduct may also affect the outcome.

A wording-first review for policyholders

Before assuming that an AI-related loss is covered, take the following steps.

1. Collect the complete policy package. Review the full wording, definitions, endorsements, exclusions and conditions together rather than relying only on the policy’s name or sales description.
2. Describe how the AI system is used. Record what data it handles, who uses it and whether third parties or vendors are involved.
3. Identify the alleged loss. Separate data-security costs, third-party liability, employment claims, regulatory proceedings and corporate-governance allegations.
4. Identify the insured party. Determine whether the potential claim concerns the company, a director or officer, an employee, a vendor or another party.
5. Locate the trigger. Check whether the policy responds to an attack, breach, claim, investigation, system failure or another defined event.
6. Check every exclusion. Consider privacy restrictions, fines or penalties, downstream liability and any language that addresses the relevant industry or activity.
7. Ask a broker or agent to map the facts to the wording. Roth recommends working with a broker to evaluate the risk. The insurer or adviser can explain how specific definitions and exclusions may apply to the circumstances.
8. Avoid assuming that using AI automatically creates coverage. The same reasoning should be used for AI-assisted and non-AI incidents; the policy must still provide the relevant trigger and respond to the loss.

Questions to ask before relying on a policy

Policyholders and business owners should ask:

• Which entity or person is covered?
• What types of losses are covered?
• Are first-party and third-party losses addressed?
• Is there duty-to-defend wording?
• Does the policy cover data held by vendors and other third parties?
• Is the territorial scope appropriate for the incident’s location?
• Does the wording address the relevant regulatory fine or investigation?
• Could an exclusion remove coverage?
• Does the policy operate as excess or other applicable insurance?
• What conditions must be satisfied?

If the incident involved AI but its use cannot be proven, policyholders should be especially careful not to rely on assumptions. The insured party, loss, trigger and exclusions still have to align with the wording.

A note for personal and non-business policyholders

Much of the cited material concerns business cyber insurance, employment liability and D&O cover. Individuals, families, students and pet owners should apply the same reading method to any personal or specialist policy they purchase, but should not transfer conclusions about business coverage to a home, renters, student, pet or other policy. The sources provided do not establish that a particular personal policy responds to an AI-related loss; that must be confirmed from its own wording.

The central point

AI insurance disputes are unlikely to be resolved simply by showing that AI was involved. The decisive questions are more specific:

Who is insured? What was lost? What event triggered the policy? Does an exclusion apply?

For businesses, D&O policies and individuals alike, careful review of definitions, triggers, defence obligations, exclusions and policy conditions remains the most reliable starting point. Any coverage decision should be based on the complete contract and the facts of the specific incident.

Sources

• NetDiligence: Virtual Programming
• JAMS: 2026 NetDiligence Cyber Risk Summit
• Federal Trade Commission: Cyber Insurance
• Aon: The Growing Use of Artificial Intelligence—D&O Risks and Potential Coverage Solutions