Your staff probably use ChatGPT or Copilot already. Before your policy renews, you need a clear answer to “does cyber insurance cover AI” when something goes wrong. This guide covers your policy, the new AI questions and the fixes to make first.
How Cyber Insurance Handles an AI Data Leak
Say an employee pastes client files into ChatGPT and those files get out. You would file that claim under your cyber insurance policy. Most cyber policies don’t mention AI at all. We also couldn’t find a single public case of an insurer refusing to pay because a firm used AI. The bigger risk is a wrong answer on your application.
Some cyber insurers now say in writing that attacks using AI are covered. Coalition added this wording in 2024. Under that wording, a security failure caused by AI counts as a covered event. Beazley added similar wording in 2026. Its cyber chief said clients are protected from attacks “AI-driven or otherwise.”
Your other business policies may be going the other way. The insurer W. R. Berkley wrote an “absolute” AI exclusion. Berkley uses it on its errors and omissions policies and on policies that protect company leaders. Verisk writes standard policy wording that many insurers copy. Since January 2026, insurers can add Verisk’s AI exclusions to general liability policies.
Insurers have not yet agreed how to treat AI tools that your own staff use. Insurance Business calls their answers so far “inconsistent and sometimes contradictory.”
This week, search your cyber policy and your errors and omissions policy for the words “artificial intelligence.”
What Happens When Staff Paste Client Data Into ChatGPT
When staff paste client data into a personal AI account, that data leaves your control, and it can be used to train the AI. OpenAI says it may train on personal-account chats unless the user opts out. On ChatGPT Business and Enterprise, OpenAI does not train on your data by default.
In Microsoft’s Copilot Chat on a work account, prompts are kept out of model training. A green shield at the top of the chat shows that protection is on.
IBM calls unapproved AI shadow AI. Its 2026 Cost of a Data Breach Report studied companies that had a breach. In 2025, 20% of those companies had a security incident involving shadow AI. In 2026, it was 43%.
Tax firms have one more thing to watch. The FTC’s Safeguards Rule counts tax preparers as financial institutions. If someone takes unencrypted data on 500 or more of your clients without permission, the Rule says you must tell the FTC within 30 days. Ask your attorney whether a paste into a chatbot would count.
This week, ask each team lead which AI tools their people use, and on which accounts.
Some Cyber Insurance Applications Now Ask About AI
A few insurers have started to ask about these risks on the application. The clearest example we found is an Australian form from the insurer Arch. Its cyber questionnaire asks if staff are trained on “the use of AI tools and applications, to prevent the leakage of confidential and sensitive information.” The same form asks if any AI the firm uses can reach sensitive data.
One US law firm expects more of this. Hunton is a law firm that works for policyholders. It tells businesses to watch for AI questions on their applications. These would sit next to questions you already answer about MFA, backups and old servers.
This week, ask your broker four questions.
- Does this year’s cyber application ask about AI, and can I see it now?
- Does my cyber policy name AI anywhere, as covered or excluded?
- Does my errors and omissions policy exclude AI?
- If staff paste client data into a chatbot, which policy pays?
How a Wrong Answer Can Void Your Cyber Policy
A wrong answer on the application can cost you the whole policy. It has already happened over a security answer.
In 2022, Travelers asked a federal court to void a cyber policy after a ransomware attack. The policyholder, a company called ICS, had said it used multifactor authentication for administrator access. Travelers said ICS used it only on its firewall. Weeks later, both sides agreed the policy was “null and void, from its inception.” That left ICS with no coverage for the attack.
In 2015, a CNA company paid a hospital’s $4.1 million breach settlement. Then it sued to get the money back. CNA said the hospital had not followed the “minimum required practices” it described on its application. The policy excluded losses from that kind of failure. The court sent the case to mediation first, so no judge ruled on it.
Neither case involved AI. But an insurer could treat a false “yes” on an AI question the same way. Your MFA answer matters just as much. Check it again now that Microsoft is retiring text-message codes for sign-in.
Answer each question with what is set up today, and close the gaps before you sign.
Four AI Controls to Put in Place Before Renewal
Four controls close those gaps. Give staff an approved AI account, put AI controls in the browser, limit who can reach client data, and write a short AI policy. IBM’s 2026 report looked at companies with an AI-related breach. 92% of them did not properly control who could use their AI tools. Multifactor authentication is one such control.
- Give staff an approved AI account. Microsoft includes Copilot Chat with enterprise data protection at no extra cost on work accounts. Our Microsoft 365 team can check your licenses and set it up. If your people prefer ChatGPT, buy ChatGPT Business seats.
- Put AI controls in the browser. DefensX is a browser security tool and one of Network Doctor’s preferred vendors. We offer it to clients. DefensX can block AI tools until someone signs in with a work account. DefensX can also keep staff from switching on the AI option that lets the tool learn from their chats. It can also block a prompt that holds something like a client ID number.
- Limit who can reach client data. Turn on multifactor authentication for every account. Give each person access only to the files their job needs. Our managed cybersecurity service includes multifactor authentication for managed IT clients.
- Write a one-page AI policy and train on it. List the approved tools and what never goes into AI. Say who to tell within an hour if something does. That training is what the Arch form asks about.
Lucas Seelig moderated our July 2026 webinar with DefensX. Our point was simple. Even approved AI tools carry risk when staff share client data by mistake. So we recommend a browser layer even after a firm buys Copilot.
The table shows what backs up a “yes” if an insurer asks.
| If an insurer asks | What backs up a “yes” |
|---|---|
| Do you train staff on AI tools? | A signed AI policy and a dated training record |
| Can any AI reach sensitive data? | A written list of approved AI tools and who uses them |
| Do you use MFA? | MFA on every account, including email and remote access |
| Can you stop data leaving the firm? | Browser controls that block risky prompts |
Pick your approved AI tool this month, and have it live before your renewal date.
Questions Owners Ask About AI and Cyber Insurance
Here are three questions owners ask us about AI and their cyber policy.
Should we just block ChatGPT?
Only after you give staff an approved tool. Our July webinar made the case that banning AI completely is a failing strategy. Roll out the approved tool first. Then block the AI sites you have not approved.
What is shadow AI?
Shadow AI is any AI tool your staff use for work that the firm never approved. It is the AI version of shadow IT.
Does cyber insurance cover mistakes in AI-written client work?
Often it does not. A mistake in client work is a different risk from a breach. A case study on Munich Re’s AI insurance page says AI performance risk is “often not covered by traditional cyber.” Ask your broker how your errors and omissions policy treats AI. Our cyber insurance FAQ covers the basics.
For your IT person (skip this if that is not you). Copilot enterprise data protection applies when staff sign in with a work account, per Microsoft. DefensX lists AI Data Protection in its CORE+ and higher packages. The Safeguards Rule requires MFA under 16 CFR 314.4(c)(5) and FTC notice under 314.4(j).
Where to Start Before Your Renewal
Start with the application. Every answer on it must match what is set up in your office. Bring this year’s form to us. We will help you check each AI and security answer and close the gaps before you sign. If you need coverage itself, start at our cyber liability insurance page. Network Doctor also provides virtual CISO services and 24/7 monitoring and response from a fully staffed Security Operations Center.
Join our free AI Made Simple webinar on November 17, 2026, at 1:00 PM ET, or register for the recording. It is led by Network Doctor partner and co-founder David Birk. He explains how to connect AI to your systems safely, including how MCP works. It ends with a 30/60/90-day plan. Book a call or phone 201-735-7260. We provide managed IT and security to firms across New Jersey, New York and Pennsylvania from our Englewood Cliffs office.
Photo: Jernej Furman, CC BY 2.0, via Wikimedia Commons