Today, generative AI (“Gen AI”) is one of the world’s fastest growing technologies, with businesses around the globe developing, adopting and incorporating machine-learning and AI technologies into their business models. The very nature of this fast-paced and novel technology brings unique risks that can implicate various lines of insurance coverage including, among others, Cyber, Professional Liability, Media Liability, IP Liability and Errors and Omissions. Moreover, an expanding regulatory landscape aimed at protecting shareholders and consumers creates financial and reputational challenges for businesses utilizing AI technology. As is often the case with emerging technological risks, the insurance market is struggling to keep up. In particular, the cyber liability insurance market has been slow to offer products aimed at covering the different Gen AI risks that policyholders face, whether those policyholders are incorporating existing generative AI products or developing their own Gen AI.
Where traditional AI is known for analyzing and automating data that the system receives, Gen AI is broadly defined as any AI system that generates creative content. Gen AI models are now being used across various industries to create content, initiate and execute computer code, summarize complex data, track equipment performance or maintenance and improve supply chain management. When this concept is overlaid to policyholder risks, one of the most nascent risks is the use (or misuse) of Gen AI.
Policyholders adopting Gen AI as a form of cybersecurity face a double-edged sword, in terms of risk. On the one hand, Gen AI can enhance the function of cyber security by analyzing a vast network of data in real time to identify anomalies that might indicate a security breach. On the other, AI vulnerabilities, along with an increase in the use of large language models (LLMs), may open a whole new frontier of cybercrime.
Policyholders developing Gen AI models face different cyber risks. Those risks include: (a) data poisoning, where attackers manipulate input data in order to compromise the output of the AI model; (b) infringement, where the AI model incorporates copyrighted or otherwise protected intellectual property into its content creation; and (c) regulatory violations, including violations of laws intended to regulate the development and deployment of AI systems.
Whether policyholders are adopting Gen AI as part of a comprehensive cybersecurity program or developing their own Gen AI product, it is imperative to adequately insure against these cyber- and AI-related risks.
Like other evolving technology risks before it, the cyber liability insurance market has not kept pace with AI technology. But options are available to tailor coverage to a policyholders’ particular needs. For example, in early 2024, cyber liability insurer Coalition introduced a policy endorsement aimed to cover risks pertaining to security breaches resulting from actors using Gen AI.
For developers of Gen AI, traditional cyber insurance policies have excluded risks associated with the development of Gen AI models because the risks associated therewith are both novel and potentially catastrophic. However, as more businesses invest in the development of Gen AI technology to streamline operations and improve the customer experience, the insurance market is, and will continue to be, forced to adapt.
In late October 2024, global insurance company AXA XL became one of the first to introduce an insurance product designed to protect against the specific risks faced by companies investing in or creating Gen AI models. AXA’s new endorsement expands cyber coverage to address data poisoning, infringement and usage and regulatory violations (particularly the European Union’s AI Act). This new coverage can be purchased as an add-on to their traditional cyber insurance policy and helps to fill the existing gaps in cyber coverage for policyholders investing in and developing Gen AI technology. Other insurance carriers will likely follow suit.
For policyholders that are either currently developing or considering developing a Gen AI model to streamline their business, additional coverage may be needed to adequately protect against the potential risks of developing a model. Accordingly, policyholders should consult with coverage counsel to review existing coverage and ensure that future coverage is designed to protect against and mitigate the specific risks associated with their business.