AI Questions in Cyber Insurance Renewals: What to Prepare

Some cyber insurers and brokers have started adding AI questions to the cyber insurance renewal process: which AI tools staff use, what company or regulated data goes into them, and what governance or written AI-use policy sits around them. There is no single standardized question set across insurers yet, so the wording varies by carrier and broker. The practical answer is to build an AI tool inventory and evidence pack before the form arrives, then verify the actual application and policy wording with your broker or counsel.

What are insurers asking about AI at renewal?

Where AI questions appear, they usually cover three things: which AI tools are in use, what data is sent to third-party AI providers, and what controls and oversight exist. The exact questions differ between insurers and applications.

Northstar IT Advisory, a UK consultancy, wrote in October 2026 that the most noticeable addition in many 2026 questionnaires is an AI section asking "what AI tools are in use, what data goes into them, and what governance sits around them." Its comparison of old and new proposal forms puts that question in the column of things older forms did not ask at all.

ACA Group, a US compliance firm writing for investment managers in July 2026, describes underwriters evaluating "AI governance, AI tool inventories, documented risk assessments, red-teaming, and human oversight during underwriting and renewal." Both are advisory firms that sell readiness services, so read them as reports of what they see in the market, not as a survey of every carrier.

Is there a standard AI question set for cyber insurance?

No. Insurance Business reported in August 2026 that there is no standard question yet, and a broker on its panel described a market working through exclusions and endorsements rather than a standardized question set.

That has a practical consequence. Selorm Kofi Domeh of Talbot Jones told Insurance Business that brokers are largely expected to volunteer what they judge to be a material fact about AI use, rather than answer a formal question. In other words, the absence of an AI question on your form does not mean AI use is irrelevant to the risk you are presenting. Ask your broker how they want it disclosed.

Why the data question matters most

The underwriting concern is specific. Daniel Winn of Jensten London Markets told Insurance Business the core worry is staff feeding sensitive or regulated information into public large language models that sit outside the client's environment, as opposed to tools that keep data contained internally.

Coverage responses are also uneven. Winn said some insurers offer affirmative AI cover up to the full policy limit while others cap it, with one or two carriers he had seen setting the cap around GBP 250,000. ACA notes that some insurers are tightening policy language and adding AI-related exclusions, and that a loss caused by an organization's own AI acting without a traditional breach may not fit breach-triggered wording. None of that tells you what your policy says. Only the wording in front of you does.

How do you prepare for AI questions before a cyber insurance renewal?

Start a few weeks before the renewal lands with an inventory of AI tools and the data that flows into them, then collect evidence for every answer you expect to give. Treat it as an evidence exercise, not a form-filling exercise.

Northstar's advice for renewals generally is to put last year's form beside this year's, note the new questions, test each answer against reality including the exceptions, and gather evidence before answering. The AI section fits that pattern.

Step 1: inventory AI tools in use

• List sanctioned tools: enterprise chat assistants, copilots built into office suites, code assistants, AI features inside SaaS platforms you already pay for.
• Find unsanctioned use. Check SSO and OAuth app grants, browser extension inventories, expense reports for AI subscriptions, and DNS or proxy logs for AI service domains.
• Record for each tool: owner, account type (company tenant or personal account), number of users, and whether the vendor contract covers data retention and training use.
• Note any AI that can take actions, not just generate text: agents that write to production data, approve workflows or send messages. ACA singles these out as the harder coverage question.

Step 2: map the data going in

• For each tool, record which data classes staff are allowed to enter and which they actually enter: customer personal data, financial records, health or other regulated data, source code, credentials, legal material.
• Identify whether prompts stay in your tenant or go to a public service.
• If you route usage through an LLM gateway or a DLP control, export its policy and a sample of its logs as evidence.

Step 3: document governance

• A written AI acceptable-use policy, with an approval date and owner, stating which tools are approved and which data must never be entered.
• Records of staff acknowledgement or training on that policy.
• A risk assessment for each new AI tool before rollout. ACA lists documented pre-deployment risk assessments among the evidence it expects carriers to ask for.
• Where AI sits in a decision process, a short description of where a human reviews or approves its output.
• For AI systems that can change production data, any adversarial testing or red-team results you have.

Step 4: check the evidence for the rest of the form

The AI section sits beside the familiar controls, and those questions have become more specific too. Northstar gives the example of backups that ran for years with no recorded restore test. Pull MFA enforcement reports, patching timelines, restore test records and training logs at the same time. If backups are part of your answer, the guidance on why your backup server is a tier-0 target is a useful check on what "protected" should mean.

What should you confirm with your broker or counsel?

Ask your broker to walk through the actual application questions and how AI use should be disclosed, then have the policy wording reviewed for AI-related exclusions, sublimits or endorsements. This article is not legal advice and cannot predict a premium, coverage decision or claim outcome.

Specific things to raise:

• Whether the policy contains AI-related exclusions or a capped AI sublimit, and how "AI" is defined in the wording.
• Whether affirmative AI cover is available and what conditions attach to it.
• How a loss caused by your own AI tool acting without a breach would be treated.
• Your disclosure duty in your jurisdiction. Northstar points to the UK Insurance Act 2015 duty of fair presentation as one example: a good-faith answer that turns out to be wrong can still affect a claim.

A one-page pre-renewal checklist

• Last year's and this year's application side by side, new questions highlighted
• AI tool inventory with owners, account types and vendor data terms
• Data map per tool, including regulated data and whether prompts leave your tenant
• Written AI-use policy with date, owner and staff acknowledgement
• Risk assessments for AI tools rolled out this year
• Human-oversight description for AI in decision workflows
• Test results for any AI with write access to production systems
• MFA, patching, backup restore and training evidence current
• Broker and counsel review of answers and policy wording completed

If you want a broader baseline before renewal, the SMB security pack's ten questions cover the controls most applications ask about.

Sources

• Northstar IT Advisory: Your cyber insurance renewal will ask questions your last one did not
• Insurance Business: Your client's staff are pasting data into ChatGPT. Their cyber insurer wants to know about it
• ACA Group: How AI is changing the rules of cyber insurance