What Would a Cyber Insurer Want to Know About Your AI Estate?

Cyber insurance renewal conversations in 2026 are different from 2024. Insurers are adding AI-specific questions to renewal questionnaires, and the answers firms give are beginning to affect coverage terms and premium pricing. This is not a future risk. It is an emerging present one.

AI governance is becoming a material factor in cyber insurance underwriting. Not because insurers are leading the regulation, but because the risk profile of unmanaged AI agents is becoming visible in claims data.

Why Cyber Insurers Are Paying Attention to AI

Cyber insurers price risk based on the probability and potential magnitude of loss events. AI agents in enterprise environments create three specific loss scenarios that underwriters are beginning to model:

Data exposure through over-permissioned agents

AI agents operating with OAuth grants to broad organisational data (SharePoint libraries, email archives, CRM records) create data exposure scenarios qualitatively different from conventional attack scenarios. An AI agent with read access to a firm's entire client email archive, operating without human oversight, is a single-point-of-failure data exposure risk that no conventional cybersecurity control addresses.

Regulatory fines triggered by AI governance failures

GDPR fines for AI data processing failures are the fastest-growing enforcement category in European data protection. EU AI Act enforcement adds a new fine regime: up to 3% of global annual turnover for Article 26 deployer obligation failures. Cyber insurance policies that cover regulatory fines increasingly need to factor in whether the insured has adequate AI governance controls.

Third-party liability from AI-generated outputs

AI systems generating customer-facing outputs (communications, recommendations, decisions) create third-party liability exposure that is difficult to model without visibility into what those systems are doing. An insurer covering a firm's professional indemnity cannot adequately price this exposure without understanding the firm's AI governance programme.

The Questions Underwriters Are Starting to Ask

Do you maintain an inventory of AI systems in use?

The foundational question. Underwriters need to understand the scope of the AI agent estate before assessing specific risk. A firm that cannot produce an inventory (covering both approved and discovered AI agents) presents an unquantifiable risk exposure that underwriters will price conservatively.

Adequate answer: a current, dated AI agent inventory produced through programmatic discovery, covering all platforms. Signed evidence of currency. Risk classification for each agent.

How do you identify AI agents operating without IT approval?

Underwriters are specifically interested in shadow AI. Unsanctioned AI agents represent unmodelled risk. An agent outside IT visibility is also outside the firm's cybersecurity controls.

Adequate answer: programmatic discovery running at regular cadences, querying workspace admin APIs to enumerate OAuth grants including those not formally approved. Evidence of discovery findings and how they were addressed.

What data can your AI agents access?

The data access scope of AI agents is the key underwriting question for data exposure scenarios. Underwriters want to know whether AI agents have access to personal data, financial data, and commercially sensitive information, and whether access is scoped to need or over-provisioned.

Do you have human oversight of AI system outputs?

Human-in-the-loop oversight reduces the risk of AI-generated outputs creating liability. Underwriters assess whether the firm's AI liability exposure is buffered by human judgment or fully automated.

What evidence do you have of AI governance?

Sophisticated underwriters are moving beyond questionnaire answers to asking for evidence: signed evidence packs, monitoring records, inventory documentation. This is the same standard FCA and ICO supervisors are applying.

How AI Governance Evidence Affects Underwriting Outcomes

• Premium pricing: underwriters pricing conservatively for firms with no AI governance evidence will adjust favourably for firms demonstrating active oversight
• Coverage scope: exclusions for AI-related losses are more commonly applied to firms with no AI governance programme
• Renewal friction: firms that cannot answer AI governance questions face longer renewal processes
• Claims handling: firms with documented governance evidence are better positioned to demonstrate reasonable precautions in coverage disputes

The AI Governance Evidence Package for Insurance Purposes

• Current signed AI agent inventory: dated, produced through programmatic discovery, covering all platforms
• Risk classification for each agent: data access scope, external communication capability, human oversight status
• Shadow AI discovery results: evidence the inventory covers unsanctioned as well as approved agents
• Human oversight documentation: responsibility assignments and evidence of active oversight
• Monitoring records: evidence of governance programme operation during the relevant period
• Signed evidence packs: dated, cryptographically signed artefacts demonstrating governance currency

AETHER Pulse generates all six components as standard outputs. The signed evidence packs provide the verification that sophisticated underwriters are beginning to require: evidence that has not been altered since generation, verifiable by a third party.

Frequently Asked Questions

Are cyber insurers currently requiring AI governance evidence?

Not universally, but the trend is clear. AI-specific sections are appearing in renewal questionnaires with increasing frequency and sophistication. Firms that build AI governance evidence now will be better positioned as underwriter requirements formalise.

Can AI governance evidence reduce cyber insurance premiums?

Potentially, yes. Documented AI governance evidence reduces the modelled probability of several AI-related loss scenarios. The practical impact on premiums depends on the insurer and specific risk profile.

Request a Governance Evidence Review →