Brokers placing media and creative risks need to find out how their clients use artificial intelligence rather than whether they use it at all, according to Cameron Griffiths, head of media and intellectual property at CFC Underwriting.
About 18 months ago, the question for clients might have been whether they used AI, Griffiths told Insurance Business.
“These days it’s very much shifted to how do you use AI?” he said.
Read more: This brokerage let AI answer every call. It lasted four days
Understanding what a business does with AI, and how, is where brokers need to start, Griffiths said, because it lets them match a client’s exposures to a product that meets its needs.
“That’s the first port of call to be able to map those exposures to an insurance product,” he said.
CFC recently upgraded its media policy to include AI coverage explicitly. Griffiths said the decision followed a growing volume of questions from brokers and clients about whether AI-related exposures were covered, both on individual risks and across portfolios of business.
“It was very much at the forefront of our brokers’ and clients’ minds,” he said.
Capacity for media risks is available, Griffiths said, but brokers and clients have been looking for certainty about how policies respond to AI.
“I think the capacity is there, but I really think that the clarity piece is what the market is crying out for,” he said.
When reviewing a policy, brokers should check whether the form carries any AI exclusions or sublimits, and whether the cover for AI is affirmative or only implied, Griffiths said. Brokers have their own professional exposure to consider, he said.
From an E&O perspective, brokers “would very much take the affirmative rather than the implied version of that conversation every day of the week,” Griffiths said.
Brokers also need to know whether the full risk picture is covered, including privacy and cyber, or whether AI cover sits in only one part of the form, he said. A broker who tells a client AI is included could be caught out if an unusual scenario arises and the policy doesn’t respond the way either of them expected.
Griffiths said CFC built the same thinking into the cyber side of its upgrade. Its cybercrime modules now refer explicitly to deepfakes, after customers increasingly reported threat actors mimicking executives, sometimes on live calls over WhatsApp, to push staff into releasing funds quickly and quietly.
On the client side, Griffiths said businesses don’t need an exhaustive governance manual to show they are managing AI responsibly.
“I don’t think that it’s necessary or likely for every business to have a massive tome or an ‘AI Bible’ that dictates their governance around their utilization of AI,” he said.
He said brokers should still expect clients to answer some basic questions, including whether a tool is built in-house or provided by a third party, what the business uses it for, and whether people review AI-generated content before it goes out under the company’s name.
Clients using third-party tools also need to think about what their employees put into them, Griffiths said.
Read more: Personal cyber cover is playing catch-up as most Canadians don’t know it exists
“The data that you’re uploading to it obviously could have very serious legal ramifications,” he said.
Brokers should check that the client has a proper legal basis for uploading data to an outside tool and understand how that data is protected, he said. That includes whether the tool runs in a closed environment hosted on the company’s own servers, or whether employees are free to enter information into publicly available AI tools.
Griffiths said CFC doesn’t sort AI use into acceptable and unacceptable categories, but its underwriters do watch for clear warning signs.
“There’s no such thing as good versus bad AI,” he said.
One area CFC examines is the source of the data behind a client’s AI tools, Griffiths said. If a client relies on a third-party tool, the exposure usually sits with the tool’s provider as long as the client holds a valid commercial licence, he said. A business that builds its own tool faces closer scrutiny.
“If you’ve developed a tool in-house, then we would be looking quite closely at what the ownership of the training data that you’ve been utilizing to train that tool is,” Griffiths said.
The question of whether rights holders are owed compensation when their work is used to train AI models is still being tested in several high-profile lawsuits, and the international regulatory framework remains in its infancy, he said.
Underwriters also look at what a client is actually trying to achieve with AI and what checks it has in place, Griffiths said. CFC wouldn’t want to write businesses that churn out low-quality AI content for harmful purposes, he said, even though a valid claim on an account it had written would be covered.
“But it all comes down to the risk selection at the front end,” Griffiths said.
