The short version
- Cyber covers events, not advice. Cyber policies are triggered by security failures, data breaches, extortion, and fraud. An AI system that is breached or used to steal money fits that pattern.
- A wrong answer is usually not a security event. When an AI tool gives a client bad information and the client loses money, nothing was hacked. That is a professional mistake, which is what professional liability (E&O) covers.
- Some cyber policies now name AI. Coalition's affirmative AI endorsement (2024) adds AI-caused security failures and deepfake funds transfer fraud. It does not add coverage for incorrect AI output.
- Insurers have flagged the gap themselves. Munich Re warns that AI risk sitting silently in traditional policies may leave businesses "without financial protection," and insurers are now building separate products for AI output errors.
AI scenarios and where they usually land
| Scenario | Cyber | E&O | Notes |
|---|---|---|---|
| Attackers break into your AI system and steal customer data | Usually yes | Sometimes | A classic breach; notification and forensics are cyber costs |
| Staff wire money after a deepfake voice call from "the CEO" | Often, if the policy has social engineering or funds transfer fraud coverage | No | Check sublimits and how the instruction must be delivered |
| Your AI chatbot gives a customer wrong refund terms | Unlikely | Possibly, if it is part of your professional services | Moffatt v. Air Canada held the business responsible |
| Your firm's AI-assisted report contains invented facts a client relied on | Unlikely | Usually, if it is a covered professional service and not excluded | The core E&O scenario |
| Client data you pasted into a public AI tool is exposed | Possibly, as a privacy event | Possibly | Depends on whether it counts as a breach under the policy |
| An AI vendor you rely on goes down and you lose revenue | Possibly, under dependent business interruption | No | Many policies limit vendor outages |
What an affirmative AI endorsement adds
Coalition's endorsement, announced March 26, 2024, does two things:
- Expands the definition of a security failure or data breach to include an "AI security event," meaning AI causing a failure of computer system security.
- Expands funds transfer fraud to include fraudulent instructions sent "through the use of deepfakes or any other artificial intelligence technology."
It stays within the cyber model. It does not turn a cyber policy into coverage for an AI tool's mistakes.
Covering AI output errors
| Option | What it covers |
|---|---|
| Technology E&O or professional liability | Claims that your services, including AI-assisted work, caused a client financial loss, unless an AI exclusion applies |
| Armilla AI liability (Lloyd's, 2025) | AI that fails to perform as intended, including "hallucinations or inaccuracies leading to damages" |
| Munich Re aiSure | AI model underperformance, including vendor performance guarantees |
| HSB AI liability (2026) | Lawsuits tied to a small business's AI use, through partner carriers |
For most service businesses, the first step is confirming that E&O covers work delivered with AI tools. See the AI liability guide and the cyber insurance guide.