Adoption of AI across the investment management industry has never been higher, with firms deploying the technology to summarise research, monitor threats, automate workflows and bolster cyber defences.
Yet this rapid uptake is generating fresh risks, from autonomous systems drifting beyond their intended boundaries to AI-generated errors, hallucinations and generative AI-powered attacks, alongside lingering questions over accountability when things go wrong, said ACA Group.
ACA Group recently discussed how AI is changing the rules of cyber insurance and what it means for the industry.
That uncertainty is now filtering through to the cyber insurance market. Some insurers are tightening policy wording and introducing AI-related exclusions where they judge the risk too difficult to quantify, while others are rewarding firms that deploy AI for detection and defence with discounts.
For investment managers and financial services firms renewing cyber cover in 2026, asking whether AI is covered is no longer sufficient. The sharper question is which AI, in which policy, and under what conditions.
The clearest retrenchment so far has emerged in traditional corporate lines, including general liability, directors and officers, and professional liability cover, where insurers are narrowing AI-related language because losses are hard to predict, trace or price.
A Delinea survey found that 42% of companies now have AI-related exclusions in their cyber policies. Even so, most cyber insurers are not excluding AI-powered attacks outright. If a threat actor uses generative AI to craft phishing emails or scale social engineering, the incident may still qualify as a cyber event provided it meets existing policy triggers such as unauthorised access, data compromise, business interruption or funds transfer fraud.
The real uncertainty begins when AI is part of a firm’s own operations rather than the attacker’s toolkit. Most cyber policies hinge on a traditional breach, but agentic AI, systems capable of executing tasks and modifying systems with little or no human intervention, can create losses without one.
An AI agent that deletes records, alters a database entry or authorises an errant payment involves no external attacker and no unauthorised access, meaning a standard breach-triggered policy may simply not respond. Researchers at NYU Tandon describe a sliding scale from AI that merely drafts text up to AI that independently executes changes, with policy response becoming less likely the further up the scale a deployment sits.
Some carriers are plugging the gap with narrower products. Chubb now covers certain AI-related incidents but excludes losses hitting many policyholders simultaneously, guarding against a single flawed model triggering systemic claims. Other insurers have launched AI security riders in 2026, demanding proof of red-teaming and documented risk assessments before extending cover.
A second gap concerns losses caused by a firm’s own AI output. Air Canada was forced to honour a refund policy invented by its chatbot, while Wolf River Electric sued Google after its AI Overviews feature falsely claimed the firm faced legal trouble. Because underwriters cannot reconstruct how an AI reached its answer, some are declining to write AI-output cover altogether.
The market is not treating all AI as a liability, however. Some 86% of organisations report premium discounts or credits for using AI-based security tools, and firms pairing AI-powered threat detection with phishing-resistant multi-factor authentication and endpoint detection and response are seeing premium reductions of 20% to 50%.
The dividing line at renewal is governance. Underwriters increasingly expect a current inventory of AI tools and models, documented risk assessments completed before deployment, evidence of adversarial testing for any system that can act on production data, and a clear map of where human oversight sits. Carriers want this evidence before a claim occurs, and the gap between firms that have it and those that do not is already visible in premiums, and in some cases in whether cover is offered at all.
Copyright © 2026 FinTech Global
