By Content Team

How Insurers Are Evaluating AI Risk in Liability and Cyber Underwriting

Insurers evaluating AI risk are not looking for a model score. They are looking for a plain account of where software can cause harm and whether the insured can show control. In liability underwriting, that means who is accountable when a system influences a decision that affects a customer, employee, or third party. In cyber underwriting, it means whether AI tools add ways data and systems can be misused, and whether access, logging, and vendor oversight actually exist.

This briefing from Hexagon IT Solutions is for IT, risk, and operations leaders preparing those conversations. It is not legal advice, and it does not rate insurers or products. Treat every application question as a prompt to document how the system really runs.

What are underwriters trying to understand?

Answer: They want to know what the system recommends or automates, what data it uses, who can change it, and what happens when it is wrong. A statement that the company “uses AI” does not answer that. A short inventory does: business purpose, users, data sources, vendor, and whether a person can stop or override the output.

Liability: where a model touches a decision

Liability questions get sharper when software moves from drafting text to influencing a claim, a denial, a safety step, a customer outcome, or an employment-related action. Underwriters and brokers tend to separate tools that assist a person from tools that complete the action. The difference is not a slogan. It is whether a named role has time, authority, and a record of review.

Be ready to describe intended use and out-of-scope use. If staff are told not to rely on a tool for a certain decision, say how that limit is enforced. Contract language matters too: customer agreements and vendor terms should say who owns an error, who must notify whom, and what the vendor will provide when the model or prompt changes. IT should not invent that language, but IT is often the only team that can tell legal what the system actually does.

Cyber: how AI changes the attack surface

Cyber questions follow the new places company information can sit. Prompts, transcripts, uploaded files, and fine-tune sets are data stores. Model APIs, plugins, and connectors are endpoints. Service accounts and vendor admin roles are identities. Employees pasting internal material into a tool the company did not approve is a control failure, not a training anecdote.

Useful answers name the log sources someone can retrieve, who is allowed to turn a connector on, and how a suspicious use would be noticed. They also name what is not monitored. An honest gap is easier to underwrite than a blanket claim that “security covers AI.” Pair this narrative with the same access discipline you would apply to any other production integration. Hexagon’s software security work is aimed at that discipline: identity, exposure, and evidence, not a product ranking.

Evidence worth assembling before a submission or renewal

Build a packet the broker can read without a workshop:

• An inventory of AI tools in production and in pilot, including who sponsors each one.
• A data note for each tool: what can leave the company tenant, and what is blocked.
• The access model: human users, service accounts, and vendor roles.
• How changes to prompts, connectors, or models are approved.
• The incident path: who is called, what is logged, and what the vendor is obligated to provide.
• A short due-diligence note on each vendor, written from the contract and the configuration, not from a marketing page.

If a pilot is already used on live customer work, call it production. Mislabeling is one of the fastest ways to lose credibility in an underwriting call.

What weakens the story

“Human in the loop” with no record of review. No named owner. Security questionnaires completed by a team that does not administer the tool. A vendor SOC report treated as proof that your configuration is safe. None of these need a statistic to be a problem. They are gaps a reviewer can see in a single meeting.

How IT should work with risk and legal

IT owns the evidence of how the system is built and run. Risk owns whether that use fits the firm’s appetite. Legal owns the wording in policies and contracts. The broker questionnaire should not become the architecture. Write the operating description first, then answer the form from it. When integration work is required so logs and identity line up, treat that as scoped delivery through integration and digital transformation planning, not as a last-minute attachment.

How Hexagon applies this

Hexagon IT Solutions helps organizations make the inventory, access, and integration story true before someone has to defend it. Start with a systems audit or schedule a call to map which AI tools are in the environment and which controls are only stated.

Key takeaways

• Liability review focuses on decision influence, override authority, and a record of review.
• Cyber review focuses on new data stores, connectors, identities, and what is actually logged.
• Prepare an inventory and an evidence packet; do not rely on a claim that the company “uses AI responsibly.”