AI Raises E&O Questions for Agencies and Cyber Insurers

Artificial intelligence is putting two different errors and omissions questions in focus: how agencies oversee tools used in their work, and how insurers will handle losses tied to autonomous systems. The first centers on accuracy, human review and records. The second turns on responsibility and whether existing cyber policies cover losses involving AI.

James Thom, chief product officer at Vertafore, said agencies have a fiduciary responsibility to customers and should pay attention to the risks as technology changes. He described safeguards that can shape how an AI process is used and later reviewed: testing for accuracy, keeping a person involved, and recording what happened along the way.

Accuracy, review and records

Thom said companies developing AI tools are focused on achieving accuracy that exceeds the human accuracy of the previous process. That goal matters, but it doesn't answer every E&O question. Agencies still need to understand what the tool does, where its output enters a workflow and who checks it before a customer-facing decision is made.

Keeping a human in the process gives someone an opportunity to review the system's work. The practical value of that review depends on whether the person can see enough information to assess the output and has a clear role in the decision. A review step that is poorly defined may leave uncertainty about what the person actually checked.

Thom also emphasized maintaining an audit trail. Records of what was done, why it was done and where it happened can help reconstruct the order of events behind a decision. They can show which steps involved the machine, which involved a person and how the work moved between them. That history may be useful when an agency needs to understand a disputed outcome or explain its process.

For agencies, the takeaway is to ask technology vendors direct questions about their approach to E&O exposure. How is accuracy assessed? Where does human review occur? What information is recorded, and can the agency retrieve it when needed? Thom's comments frame these as vendor selection and implementation questions, rather than issues to leave until a problem arises.

Autonomous AI and policy boundaries

Ross Sinclair, CEO at EIP, sees a separate challenge for insurers in autonomous AI. Systems that can act with less direct human involvement may make it harder to identify, model and price the risk. If an AI-related event harms a business, questions about who may be responsible are only part of the coverage analysis. They don't establish which losses the affected business can claim under its policies.

Sinclair's central concern is that some AI exposure may already sit inside conventional cyber policies, even though those policies weren't designed or priced with autonomous AI in mind. That creates uncertainty for insurers assessing the scope of what they have agreed to cover. It also leaves buyers with a practical question: does the wording address the AI-related loss they are trying to understand?

Insurers are responding in different ways, Sinclair said. Some are adding AI exclusions to cyber policies; others are developing AI-specific policies as a separate risk class outside cyber coverage. Those approaches can change where a buyer looks for protection and which policy terms matter. The source doesn't specify the wording of any exclusion or the scope of any new product, so businesses will need to examine the actual terms available to them.

For an organization using autonomous tools, a useful review starts with how the system is deployed and what business activities depend on it. The organization can then ask its broker or insurer how relevant policies address losses connected to that use, including what is covered, what is excluded and whether separate coverage is available. Clear answers matter because the technology's role and the policy's boundaries both shape how a loss may be handled.

Clarity is part of managing the exposure

Thom's focus is on controls inside agency workflows; Sinclair's is on how insurers define and price a developing risk. Together, their views point to a shared need for traceable decisions and clear coverage language. Good records can help explain how an AI-supported decision was reached, while careful policy review can show which losses the contract addresses.

AI capabilities and insurance terms may change at different speeds. Agencies and businesses should keep track of where AI is used, who reviews its work and what records are retained, then revisit those details alongside policy wording as tools or products change. For insurers, the pricing challenge Sinclair describes will remain difficult if the boundaries of existing cyber coverage are unclear. The immediate task for buyers is to get those boundaries explained before they have to interpret them after a loss.