Cyber Insurers Start Asking AI Questions — and Pricing the Answers

The renewal questionnaire is where AI governance stops being a slide and starts being a price. Insurers spent 2025 absorbing claims involving AI-assisted fraud and agent-driven errors, and the 2026 wordings reflect it.

What is showing up in the paperwork

• An inventory question: which AI systems are in production, what do they touch, who owns them.
• Autonomy limits: can any system move money, change access, or contact customers without human confirmation.
• Exclusions or sub-limits for losses caused by autonomous action taken without human review.
• Social engineering wordings updated for synthetic voice and video, often with a callback-verification condition precedent.
• Evidence requirements: logs sufficient to reconstruct what a model was asked and what it did.

Where organisations fail the questionnaire

Not on strategy — on inventory and evidence. Most cannot produce a current list of production AI systems, and most cannot reconstruct an agent's actions after the fact because prompts and tool calls were never logged with the incident in mind.

Preparing for the renewal

1. Build the inventory first

Name, owner, data touched, autonomy level, vendor, model version. This one artefact answers half the questionnaire and drives every other control.

2. Write down the autonomy boundary

Which actions require human confirmation, enforced in the tool layer rather than the prompt. Insurers increasingly ask how it is enforced, not whether it is policy.

3. Make the logging claim-ready

Prompts, tool calls, decisions, approvals, retained for the policy period. Without it, quantifying a loss — and therefore recovering it — becomes an argument.

4. Meet the callback condition literally

Where the policy makes out-of-band verification a condition, the procedure must exist, be trained, and be evidenced. Failing a condition precedent is how a covered loss becomes an uncovered one.

5. Bring the evidence to the broker early

Underwriters price uncertainty. A clear inventory and a documented autonomy boundary move you out of the worst bracket.

The cheapest AI governance programme is the one your insurer already asked you to write.