Artificial Insurance - Series Intro

Probing the Coverage, Controls, and Measurement Gaps of Insurance for AI Risks

[In the interest of content digestion and attention spans, below is the 1st part of a series of 6 articles that decompose the unabridged work: Artificial Insurance: Probing the Coverage, Controls, and Measurement Gaps of Insurance for AI Risks]
{Part 2. Insurance Policy Coverage Gaps}

---

This analysis calls attention to gaps in the insurance market's treatment of AI risks. The cyber insurance market is largely taking a wait-and-see approach, comingled with anti-AI exceptionalism ('move along, nothing to see here') and concealed foreboding ('there but by the grace of God go I') . Certainly, many insurers and brokers are privately fielding questions from policyholders about AI risk coverage. But, relative to the striking transparency and breakneck pace of AI activity (development, discourse, experimentation, deployment) and growth of incidents , to date little has been publicly and collectively advanced regarding insurance policy provisions to extend, restrict, or exclude existing and new coverage specifically for AI risk exposures.

First movers are few and explicit policy coverage (endorsements and exclusions) remains quite niche. Munich Re and Armilla AI offer AI Performance Guarantees; AXA XL and Coalition offer AI endorsements and clarifying inclusions under its cyber coverages, respectively; and Relm , Vouch, and Munich Re offer AI-specific policies directed at startups. Historically, actual exposures rather than perceived risks have driven changes to policies, and new policy wordings have reacted to change in exposures faced by policyholders. Notable examples include pollution and asbestos exclusions in the late 1980s, terrorism exclusions in the wake of 9/11, and virus exclusions following the 2002 SARS outbreak. While the stasis with AI risk coverage is consistent with convention, the potential consequences of being reactive may prove devastating at worst and a missed opportunity at best. This is not to mention that supply-induced demand is not unprecedented in insurance.

This paper investigates the state of the (cyber) insurance industry's readiness to address AI risk by surveying gaps along three fundamental dimensions: insurance policy coverage, risk management, and measurement and modeling. In so doing, it exposes fundamental misalignments between existing insurance structures and the novel challenges presented by AI technologies. Despite the unprecedented fervor surrounding AI innovation and attempted AI regulation since the 2022 coming out of generative AI, there remains significant open questions and challenges to emerging AI governance at a societal level.

Ultimately their resolutions will turn on consensus of definitions (e.g., is a prompt injection a hack or system failure), interpretation of cases at the seams between legacy technology and AI (e.g., where does responsibility lie for rule-based vs. LLM-powered customer service chatbot), translation of compliance requirements into product specifications (e.g., what model error rate threshold is acceptable to meet “reasonable accuracy” requirements), decomposition of harm attribution (e.g., what is the division of liability between AI provider, hospital, supervising physician in a AI medical misdiagnosis), allocation of responsibility and accountability (e.g., when an AI hiring tool unlawfully discriminates against a candidate, is the vendor, corporate HR department, or training data provider responsible), geopolitical influence (e.g., when nation-states disagree on regulating the safe use of AI ), and practical challenges to effective implementation (e.g., technical complexity of third-party AI model auditing without source access). Layer this uncertainty atop the predictably incongruent time horizons between regulatory and legislative processes and tech development; jurisdictional fragmentation; tensions between innovation and rights protections; and ultimately, the resources and will to enforce legal, ethical, and social expectations.

This analysis is intended to challenge conventional thinking and help advance dialog and innovation around AI risk within the insurance industry. It also targets organizations who are trying to navigate the role of insurance as an AI risk transfer and management resource, and have an opportunity to shape this risk transfer. Secondarily, while a deeper foray into the role of insurance as market-based governance of AI risk is the subject of forthcoming work, this work is meant to shine light on the AI risk insurance landscape for policymakers seeking to incentivize responsible and beneficial AI outcomes. In general, it is offered to help normalize how AI risk transfer is designed and implemented so that insurance emerges as a private market governance forcing function onto itself. Ultimately an AI risk protection gap will impact the well-being and economic prosperity of organizations, individuals, and broader society.

Assumptions and Clarifications

These AI risk control and insurance gaps analyses are not offered as a comprehensive reference based on an enumeration and crosswalk of covered risks and losses across insurance policies. This would be impracticable given the absence of standardized cyber and tech E&O coverages, AI risk and harm taxonomies, and the ambiguity that comes with nascent translations between two domains. The approach here was to scan, distill, and synthesize across myriad coverages and industry reports and illuminate general trends. Undoubtedly there will be inaccuracies relative to specific policies. While the mappings are necessarily imperfect and some interpretation subjective, exactitude is unwarranted to illuminate and advance understanding of the directional gaps in current AI risk coverage, control and measurement. This analysis takes a conservative approach, interpreting coverage mappings in-line with both the explicit terms and the underlying intent of insurers' commitments to extend protection in ambiguous situations. It is acknowledged that some of the analyses’ descriptions are redundant, as results were presented from both policy coverage and AI risk perspectives.

The 7 selected insurance coverages are representative of the most common insurance policies. Niche IP insurance was included because of its relevance to AI exposures. Acknowledged category omissions are noted in the Methodology section. The 15 AI risk categories were synthesized from various well-served nonprofit industry initiatives, standards working groups, and academic literature related to AI risk. This paper tries to navigate the tension between broad abstraction and granular specificity in analyzing AI risk insurance and control coverage. Specific policy determinations require contextual details beyond the scope and purpose here. While effort was made to wholesale use an existing taxonomy, a hybrid classification better suited the tasks at hand and struck a balance between overly-abstract and simplified risk categories (introducing too much mapping inference risk), and overly-granular (rendering generalizable mapping unwieldy). While imperfect, this synthesis nonetheless captures the lion’s share of published AI risk concepts and semantics.