Does Your Insurance Cover Your Next AI Incident?
- Holly Hartman
- Jun 7
- 13 min read
By Holly Hartman, Fractional CAIO | FWS Enterprise LLC | futureworkforcesystems.com
Published: June 2026 | Last Updated: June 2026
Series: AI Governance Gap | FWS Ethical AI Series
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Does Your Insurance Cover Your Next AI Incident? What AI Insurance Coverage Requirements Mean for Your Organization
THE ASSUMPTION THAT WILL COST YOU
You renewed your cyber liability policy last fall. You answered the underwriter's questions. You paid the premium. And somewhere in the back of your mind, you assumed that if something went wrong with AI at your organization, you were covered.
You probably are not.
Not because you did anything wrong. Because the policy you renewed was written before your organization started using AI the way it does today. And insurance carriers have been quietly rewriting the rules, adjusting AI insurance coverage requirements.
This is not a warning about some future risk. The exclusions are already in the policy language. The documentation requirements are already in the underwriting questionnaires. The premium surcharges are already hitting renewal invoices. And claim denials are already reaching courts.
What most small and mid-size organizations do not know is that insurers now treat AI governance documentation the same way they treat security controls. You either have it and it is retrievable, or your coverage is at risk.
Here is exactly what insurers may be requiring, what the gap costs, and what your organization needs to close it before your next renewal.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WHAT INSURERS MAY ACTUALLY BE REQUIRING NOW
Does AI governance documentation affect insurance coverage? Yes. Directly and immediately.
Underwriters have moved AI from a theoretical risk category into an active underwriting variable. When you apply for or renew cyber liability, errors and omissions, directors and officers, or general liability coverage today, your carrier is evaluating whether your organization has documented AI governance in place. If you cannot show it, your coverage terms reflect that gap.
Drawing from insurer guidance, NAIC model bulletin requirements, and industry best practices, the following documents represent the baseline your organization should be able to produce before renewal.
An AI Acceptable Use Policy. A company-wide policy governing which AI tools employees may use, what data may be entered into those tools, which systems are approved, and what training is required before use. This is not a one-paragraph statement buried in your employee handbook. It is a named, dated, retrievable policy document.
An AI Governance Framework. A documented structure that covers how AI systems are reviewed and approved before deployment, who owns oversight, how risks are assessed, and what accountability exists across the organization. A governance framework is not a policy. It is the operating system that makes the policy enforceable.
An AI Systems Inventory. A current, maintained list of every AI system your organization uses, including the purpose of each system, what data it processes, which business unit owns it, which vendor provides it, and when it was last reviewed. This includes AI features embedded inside platforms your team already uses, such as HR software, CRM tools, scheduling platforms, and communication systems. If it makes decisions or shapes outputs, it belongs in the inventory.
An AI Risk Register. A documented register of known AI risks across your systems, with risk classifications, named owners, and mitigation strategies for each. Risks that are not documented are treated by insurers as risks that are not managed.
AI Bias Testing and Validation Documentation. Evidence that AI systems involved in hiring, lending, pricing, or customer-facing decisions have been tested for discriminatory outcomes, including disparate impact analysis and periodic revalidation records. This is especially important given the FTC's active enforcement posture on AI-related discrimination claims.
AI Vendor Due Diligence Files. Documentation of how your organization reviewed and continues to oversee third-party AI tools, including data handling practices, security posture, liability allocation, audit rights, and ongoing oversight protocols. Using a vendor's AI without documented diligence is a coverage gap.
AI-Specific Contract Provisions. Updated terms, data processing agreements, and vendor contracts that address AI use, risk allocation, and compliance obligations. Standard vendor contracts written before 2023 almost certainly do not include these provisions.
An AI Incident Response Plan. A defined, documented process for identifying, escalating, and responding to harmful, inaccurate, or discriminatory AI outputs. This plan should be integrated with your existing incident response protocols, not written as a standalone document that nobody knows how to activate.
An AI Regulatory Compliance Audit. A documented mapping of your AI use against current and applicable laws, including state automated decision-making requirements, sector-specific regulations, and any federal guidance relevant to your industry.
Board-Level AI Oversight Documentation. Records demonstrating that your board or senior leadership team understands and actively oversees AI risk. This includes governance committee meeting minutes, decision logs, and records showing that AI risk is reviewed at the leadership level on a defined schedule.
Employee Training Records. Records showing which employees use AI tools, that they have been trained on your acceptable use policy, and that they understand their responsibilities under your governance framework.
Adverse Outcome Tracking. A log of any AI-related adverse outcomes your organization has experienced or identified, along with documentation of corrective actions taken in response.
This list is an FWS-synthesized framework drawn from insurer guidance, NAIC model bulletin requirements, and industry best practices. It represents the documentation baseline your organization should be able to produce before renewal. The insurance industry is actively building AI documentation requirements into underwriting. Organizations that are prepared before their renewal will be in a stronger position than those that are not.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WHAT HAPPENS WITHOUT IT — THE FINANCIAL REALITY
What does an AI governance gap actually cost a small or mid-size organization?
The answer depends on whether you are calculating the cost of the gap before or after an incident. Before an incident, the gap costs you in premium surcharges, coverage restrictions, and sublimits. After an incident, it can cost you everything you thought you were covered for.
Here is what the data shows.
According to IBM's Cost of a Data Breach Report 2025, breaches involving shadow AI were associated with a $670,000 increase over the average breach cost baseline. Shadow AI refers to AI tools your employees are using that have not been reviewed, approved, or documented by your organization. If you do not have a systematic process for identifying and governing those tools, you almost certainly have shadow AI in your environment right now.
For organizations with fewer than 500 employees, the average cost of a data breach is $3.31 million, up 13.4 percent year over year. This is not an enterprise number. This is the number that applies to the organizations reading this post.
Industry reporting indicates small businesses saw cyber insurance premiums increase by 200 percent or more in 2024. Not 20 percent. 200 percent. And that was before many carriers began applying AI-specific underwriting criteria at scale.
Industry reporting indicates a significant share of small businesses were unable to secure coverage at any price due to inadequate security controls. AI governance documentation is now part of what insurers evaluate under that umbrella.
Organizations with less than $25 million in annual revenue made 64 percent of all cyber insurance claims in 2024, with average per-claim losses exceeding $84,000.
Some insurers are now introducing absolute AI exclusions that completely eliminate coverage for any claim arising from AI use, including inadequate AI governance, policies, training, or controls. These are not narrow exclusions. They are broad enough to affect coverage for incidents that would otherwise have been covered under your existing policy.
The math is not complicated. The cost of documented AI governance infrastructure is a fraction of the cost of a single incident, a single claim denial, or a single renewal conversation where you cannot answer the underwriter's questions.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
THE REGULATORY PRESSURE THAT MAKES THIS WORSE
Some organizations are waiting for regulatory clarity before they act on AI governance. That clarity has already arrived. It just did not come from where they expected.
There is no comprehensive federal AI law in the United States as of June 2026. The Trump administration's posture is deregulatory at the federal level. And you may have heard that a provision in the House budget bill would have paused state AI laws for ten years.
That provision failed. The Senate voted 99 to 1 to strip it from the bill. It is not law. It is not coming back in the near term.
More importantly, even if it had passed, it would not have touched your insurance carrier's requirements. Not even close. Here is why.
Insurance carriers are regulated at the state level under the McCarran-Ferguson Act of 1945, which reserves insurance regulation to the states. The National Association of Insurance Commissioners formally opposed the federal moratorium specifically because it would have undermined state oversight of AI in insurance markets. Private insurer documentation requirements are contractual obligations between you and your carrier. No federal technology bill reaches them.
Even if Congress passed a law tomorrow pausing every state AI regulation in the country, your insurance carrier would still require documented AI governance at your next renewal. Those are two completely separate systems with two completely separate authorities.
Now here is what the regulatory picture actually looks like for a US mid-market organization right now.
45 states introduced 1,561 AI-related bills as of March 2026. That is more AI legislation than was introduced in all of 2024.
Colorado's AI Act takes effect January 1, 2027. If your organization operates in Colorado or serves Colorado customers, you are already in the compliance window for a law that requires risk management policies, impact assessments, and algorithmic discrimination prevention.
California has three AI laws already in force as of January 1, 2025, covering AI-processed personal information, AI in healthcare utilization review, and AI-generated patient communications.
Connecticut's AI Regulation Framework for Employers passed on May 1, 2026, creating new obligations for organizations using AI in employment decisions.
Texas's TRAIGA took effect January 1, 2026.
The enforcement pressure is not coming from Washington. It is coming from your state, your industry regulator, your insurance carrier, and the 42 state attorneys general who sent a letter to AI companies in December 2025 signaling active oversight intent.
Waiting for federal clarity is not a governance strategy. It is a gap with a growing price tag.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
HOW A NAMED GOVERNANCE FUNCTION CHANGES YOUR INSURABILITY
Does having a named AI governance function improve insurance coverage? Yes. Demonstrably.
Underwriters are not just looking for documents. They are looking for evidence that your organization has a defined, accountable structure for managing AI risk. When that structure exists and can be shown, it signals something specific to an underwriter: this organization has a clear owner for AI risk, defined oversight processes, and evidence that governance decisions are being made and documented at the appropriate level. They are adjusting AI insurance coverage requirements.
The presence of a named governance function shifts your insurability in three concrete ways.
First, it demonstrates accountability. A governance committee with named members, documented decision rights, and a regular meeting cadence shows an underwriter that AI risk is not floating between departments with nobody owning it. Fragmented ownership is one of the primary risk signals underwriters look for. A named governance structure eliminates that signal.
Second, it produces the documentation underwriters require. Every item on the list in Section 1 of this post is a deliverable of a functioning AI governance program. The AI Systems Inventory, the Risk Register, the Acceptable Use Policy, the Incident Response Plan, the Board Reporting documentation. These are not separate projects. They are the output of a governance structure operating as designed.
Third, it creates the audit trail that protects you if a claim is filed. If an AI-related incident occurs and you need to demonstrate that you had reasonable governance in place, the documentation trail produced by a functioning governance committee is your evidence. Without it, the insurer's question becomes unanswerable.
The NAIC's 2026 model law guidance reinforces this directly. Existing state insurance laws apply regardless of whether decisions are made by humans, algorithms, or third-party vendors. The carrier's obligation to evaluate your AI governance does not wait for a new law. It is already embedded in how your policy is underwritten.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WHAT YOUR ORGANIZATION NEEDS BEFORE YOUR NEXT RENEWAL
The question is not whether you need AI governance documentation. The question is whether you have it in a form your carrier can evaluate.
Here are three things your organization can do before your next renewal conversation.
One: Pull your current cyber liability policy and read the AI language. If your policy was issued before 2024, it almost certainly does not address AI governance requirements specifically. That is not a safe position. It means the exclusion language may be broader than you realize, and you will not know until you need to file a claim. Ask your broker directly: does this policy cover AI-related incidents, and what documentation does our carrier require?
Two: Conduct a basic AI systems inventory. List every AI tool your organization uses, including tools embedded in platforms you already pay for. HR software with AI screening features. CRM platforms with AI activity capture. Communication tools with AI meeting summaries. Scheduling tools with AI recommendations. If it makes automated decisions or shapes outputs that affect your business, it belongs on the list. This is the starting point for every other governance document your carrier will ask for.
Three: Establish a named owner for AI governance before your renewal. This does not require a full-time hire. It requires a named individual or function with documented responsibility for AI governance decisions, oversight, and documentation. Without a named owner, every other document you produce is floating without accountability, which is exactly what insurers are evaluating when they ask who owns your AI risk.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
For the CEO or COO:
When your insurer asks for AI governance documentation at your next renewal, what will you hand them? If the answer is unclear, the coverage conversation is already happening without you.
For the CFO or General Counsel:
Does your current policy language include an AI exclusion? Do you know what your carrier requires to avoid a sublimit or premium surcharge? These are questions your broker should be able to answer in writing.
For the Operations or HR Leader:
Do you have a current inventory of every AI tool your team uses, including the AI features embedded in your approved platforms? If your employees are using tools that are not on that list, you have shadow AI. And shadow AI carries a documented premium cost of $670,000 per incident above your baseline breach exposure.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
WHERE YOUR ORGANIZATION ACTUALLY STANDS
Most mid-size organizations are somewhere in the middle right now. They are using AI. They have some policies. They assume they are probably covered. They have not had a conversation with their broker about AI governance documentation specifically. And they have not built the governance infrastructure that makes that conversation go well.
The organizations that close this gap proactively are not doing it because they love compliance. They are doing it because the math is simple. The cost of building documented AI governance is a fraction of the cost of a claim denial, a premium surcharge, or an incident that your policy does not cover because the documentation was not there.
Get the Free AI Governance Insurance Readiness Guide
This blog covers what the 12 documents are and why they matter. The free FWS AI Insurance Readiness Guide goes one level deeper. For each document, you get a plain-language explanation of what it is, what it must contain, why insurers pay attention to it, and a self-assessment question so you can mark your status honestly.
Work through it. Fill it out. If you cannot answer most of the self-assessment questions, that is not a broker conversation. That is a governance gap. And that is exactly what FWS is built to close.
Download the free guide at futureworkforcesystems.com/ai-governance
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FAQ BLOCK
Q: Does cyber insurance cover AI incidents?
A: Not automatically. Most cyber policies issued before 2024 do not specifically address AI governance requirements. Insurers are now applying AI-specific underwriting criteria and some are adding absolute AI exclusions that eliminate coverage for claims arising from inadequate AI governance, policies, training, or controls. Whether your policy covers an AI-related incident depends on whether you have documented AI governance in place and whether your policy language addresses AI exposure specifically.
Q: What AI governance documentation do insurers require?
A: Underwriters now expect a minimum documentation set that includes an AI Acceptable Use Policy, an AI Systems Inventory, a Governance Framework, a Risk Register, bias testing and validation records, vendor due diligence files, AI-specific contract provisions, an Incident Response Plan, a regulatory compliance audit, board-level oversight documentation, employee training records, and adverse outcome tracking. Organizations that can produce this documentation receive coverage on workable terms. Those that cannot face exclusions, sublimits, or premium increases.
Q: What happens if I do not have AI governance documentation?
A: Without documented AI governance, your organization faces AI-specific exclusions that eliminate coverage for AI-related claims, sublimits that cap your coverage below your actual exposure, premium surcharges of up to 200 percent or more at renewal, potential claim denial for incidents where governance documentation is cited as a requirement, and in some cases the inability to secure coverage at any price. Industry reporting indicates a significant share of small businesses were unable to secure cyber insurance coverage in 2024 due to inadequate controls.
Q: Does the federal deregulation of AI affect insurance requirements?
A: No. Insurance carriers are regulated at the state level under the McCarran-Ferguson Act of 1945, which reserves insurance regulation to the states. The proposed federal moratorium on state AI laws failed in the Senate 99 to 1. But even if it had passed, it would not have applied to private insurance carrier requirements. Insurer documentation requirements are contractual obligations between your organization and your carrier, not state regulations subject to federal preemption. Your insurance carrier's AI governance documentation requirements exist independently of any state or federal AI law.
Q: What is shadow AI and does it affect my insurance coverage?
A: Shadow AI refers to AI tools your employees use that have not been reviewed, approved, inventoried, or governed by your organization. This includes AI features embedded in existing platforms such as HR software, CRM tools, and communication platforms that your employees may be using without realizing AI is involved. Breaches involving shadow AI tools cost an average of $670,000 more than standard breach costs, according to IBM's 2025 Cost of a Data Breach Report. Shadow AI is one of the primary risk signals insurance underwriters are evaluating when assessing AI governance maturity.
Q: How do I prove AI governance to my insurance carrier?
A: You prove AI governance through a documented, retrievable set of records that demonstrate your organization has a defined structure for managing AI risk. This includes the documentation items listed above, plus evidence of a named governance owner or committee, regular governance meeting records, a current AI systems inventory, and documented processes for reviewing and approving AI use before deployment. The key word is retrievable. Documents that exist but cannot be produced quickly and in organized form do not satisfy underwriter requirements.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOURCES
IBM Cost of a Data Breach Report 2025 https://www.ibm.com/reports/data-breach
IAPP AI Governance Profession Report 2025 https://iapp.org/resources/article/ai-governance-profession-report
NAIC AI Issue Brief 2026 https://content.naic.org/sites/default/files/ai-issue-brief.pdf
McCarran-Ferguson Act of 1945 Search congress.gov cite as 15 U.S.C. sections 1011 to 1015.
Spacelift https://spacelift.io/blog/small-business-cybersecurity-statistics
Water Street Company https://www.waterstreetcompany.com/what-comes-next-for-insurance-ai/
Debevoise https://www.debevoise.com/insights/publications/2025/07/the-federal-ai-moratorium-is-doa-whats-next
White and Case https://www.whitecase.com/insight-alert/california-kentucky-tracking-rise-state-ai-laws-2025
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
AUTHOR BIO
Holly Hartman is the founder of FWS Enterprise LLC and serves as a Fractional Chief AI Officer for mid-market organizations building AI governance infrastructure. 2026 Louisville Business First Enterprising Women honoree, NAWBO KY Business Owner of the Year 2025, Bingham Fellows Class of 2026, and an international bestselling author. Her governance frameworks are cross-validated against NIST AI RMF 1.0, ISO/IEC 42001, the EU AI Act, and the NAIC AI Model Bulletin.
DISCLOSURE
This post was created with AI assistance. Content has been reviewed and verified by Future Workforce Systems. Statistics are cited to original sources. If you find a statistic or link that has changed since publication, contact us at contact@futureworkforcesystems.com.
This post is for informational and civic education purposes only. It does not constitute legal advice.
Comments