Cyber policy wordings have potential to provide unintended AI cover – IUA

Common clauses cited within cyber insurance policies have the scope to provide unintentional or “silent” cover for artificial intelligence (AI) related risks, giving both the insurance community and risk management professionals pause for thought, according to Tom Hughes, director of underwriting at the International Underwriting Association (IUA).

Speaking on the topic of protection gaps at this year’s Airmic Conference, held in Birmingham between 15 and 17 June 2026, Hughes explained that insurance for AI risks – such as hallucination and intellectual property infringement – was on track to follow its cyber insurance predecessor, with accidental or unintentional cover becoming evident in other standalone policies.

Silent insurance is when a policy’s wordings do not clearly state whether a risk is covered or excluded, instead implicitly providing cover for a risk that the insurer did not expect – or price for when setting the premium.

Coverage for cyber attacks within broader commercial insurance policies was the first prime example of silent insurance, as this risk grew at a pace that the cyber security and insurance sectors struggled to initially keep up with.

Although the cyber insurance market is now on a more even keel, Hughes is seeing policy clauses today which indicate that AI risks are on the same silent cover trajectory.

He noted that common definitions of computer systems within cyber policy wordings are “certain [to] encompass generative AI in the way that we’re using it today”, meaning that “policies already have a method by which to manage AI risk” – whether intended or not.

“We’re certainly talking about the risk of silent AI,” Hughes confirmed.

This sentiment is supported by a July 2026 white paper published by cyber risk business Kynd.

It’s The Wild West of AI Risk report stated: “The exposure that unsettles underwriters most has a familiar shape. The market lived through silent cyber, where risk built up inside policies that were never written with it in mind, and the bill arrived later in claims nobody had priced. Carriers were burned by it once and the wariness shows.

“Silent AI is forming the same way, one undeclared tool at a time. Adoption is running ahead of disclosure. Businesses are wiring AI into hiring, customer service, claims handling and a hundred other workflows faster than their insurers can ask about it – and often faster than they are tracking it themselves. The exposure accumulates across a book without anyone deciding to take it on.

“What makes it harder than shadow IT is concentration. The same handful of underlying models sit behind much of this activity, so a single flaw or failure can surface across many insureds at once. Risk that would once have been spread across dozens of separate systems now runs through a few shared ones.

“Caught early, it is manageable. Discovered after the fact, it starts to look like an accumulation event.”

Insured understanding

Hughes observed that there are “three leading markets that are preparing or have brought to market AI products” that are “looking at the specific exposures that come with AI risk” – he further predicted that “more” underwriters would “soon” follow this first wave of early market movers.

This activity is in conjunction with AI related policy exclusions “not appearing in any meaningful way” and corporates “looking to existing siloed insurance products to try and meet needs [around AI risk]” – these specific factors certainly open the door for silent coverage.

For Hughes, the primary challenge for the insurance market in developing AI-centric products is the technology’s breadth of scope. He likened this to the cyber market, for example: “Not everyone in the insurance market is a cyber insurance expert, but cyber risk appears in almost every class of business.”

Although fundamentally believing that AI “is an insurable exposure”, Hughes noted that securing such coverage is more likely to be front of mind for technology development businesses and the like – which are using the technology for “decision-making work and engaging with clients” – rather than companies that are just adopting AI into back office functions on a tool by tool basis.

“When I speak to directors’ and officers’ (D&O) insurers, they have an interesting view about the impact that AI will have on their markets,” Hughes said.

“They’re thinking about the insured that’s in front of them. How well are they thinking about and understanding AI?

“If they’re thinking about it and understanding it, the risk profile is so much different to if they sit in front of someone who doesn’t know the difference between a generative AI tool and agentic AI. That will be a red flag. They’ll be thinking ‘hang on, how is this business going to put the right controls and the right checks and balances in place?’”

Proactive opportunity

The question around the insurability of AI risks is not all doom and gloom, however.

Hughes can see numerous routes forward that the insurance market can take in support of corporate clients, building on the fact that “many policies are very well set up to insure the business for the decisions that [it] is making” – especially in terms of “third party covers”.

As a first step, Hughes said it is imperative that companies understand their legal obligations and that regardless of “whether you’re training a senior member of personnel or whether you’re training a generative AI tool, if that person [or AI] is going to be carrying out actions on behalf of your company – and if that tool is going to be engaging with your customers – you as a company are responsible for that interaction”.

He continued: “It’s going to be down to companies to put the right parameters in place, the right controls.”

A further way to create insurability around AI risk is to explore “a captive approach to incubate a risk that we don’t have much data around”, Hughes added.

He explained: “You can work around smaller limits, gain a good understanding and then, off the back of that, work towards a fuller insurance model.”

A captive is an insurance company subsidiary owned by an organisation that insures the parent company’s risks, rather than needing to purchase commercial covers from an insurer.

Hughes would also love to see insurers “get involved in a trialling or a testing process as early as possible”, to move underwriters from being very “reactive” and “outcomes-based” to instead “being a proactive partner for the client much earlier on in the process”.

He feels this kind of step change would be hugely advantageous and gave Insurance Times an example around autonomous vehicles.

Hughes said: “I’ve met someone who is preparing new and innovative insurance solutions for the next generation of aircraft – the flying taxis that we will all have to think quite carefully about before we get in.

“They are being trialled right now around the world and I know insurance representatives that are there on the ground, talking to people that are building the aircraft, understanding how the systems work, understanding how the battery technology works, where the real vulnerabilities are.”

Although acknowledging the protection gap caused by possible silent AI cover, Hughes is not downtrodden about this risk – instead, he believes that recognising this threat is an important opportunity for the insurance market to pivot onto the front foot.

He told Insurance Times: “Where risks exist, that’s an opportunity for the insurance market. [It is] in the business of risk, so risk brings opportunity [and] allows [insurers] to think carefully about the types of new products that they might want to be putting on the table.”