Insurers propose caps on cyber payouts tied to AI use

In short: Some insurers are adding new limits to how much they will pay for certain AI-related cyber losses.

What's going on

Insurers are starting to cap payouts for cyber incidents linked to artificial intelligence, according to brokers and documents reviewed by the Financial Times. The goal is to reduce how much insurers might have to pay as businesses use AI more widely.

Australian insurer QBE has introduced “sublimits” in some cyber policies. A sublimit is like a smaller ceiling inside the main coverage limit, for one specific type of problem. QBE is applying these sublimits to “LLMjacking”, which is when criminals break into a company’s large language model setup (the same kind of AI used in chat and writing tools) to use it without paying.

Under QBE wording seen by the FT, a policy that covers up to $5 million in losses would pay only about $250,000 for losses caused by LLMjacking. Cyber specialist insurer Beazley has also proposed contract language that would limit payouts tied to some AI-related regulatory breaches. Brokers said these AI sublimits would often be around 10 percent of the total policy limit.

Insurers say these changes are meant to clarify what is and is not covered. Some brokers and lawyers who advise companies say they worry the wording could later reduce coverage for other AI-related risks.

What to watch

More insurers may either limit AI-related claims or sell AI coverage as a separate add-on, similar to how cyber insurance became its own product over time. Companies buying cyber insurance may need to read policy details closely, since two policies with the same headline limit can pay very different amounts for AI-related events.

Source: Financial Times