A surge in AI-related cyber exclusions in the United States suggests some damaging losses have already happened out of public view, and insurers should prepare for an accumulation event far bigger than a recent attack on refrigeration systems in Europe, according to Paul Fletcher, managing director of Aviva Business & Broker Distribution.
Speaking on an insurer executive panel at the Insurance Brokers Association of Ontario’s (IBAO) 2026 convention in Toronto, Fletcher said he had read a tracker showing more than 2,500 AI-related exclusions emerging in the US cyber market.
Read more: Soft market to last through 2027 as Aviva sees contractor losses rise
“That means to me that some nasty events have happened that are probably not public in certain domains,” Fletcher said.
He said the industry has yet to see the worst.
“We’re all going to get a surprise one day, and it will be something more fundamental than refrigeration units in grocery stores,” Fletcher said.
The panel agreed that cyber prices have been coming down after rising sharply in the line’s early years, and the panellists were asked whether AI would drive new products for commercial businesses.
Fletcher pointed to an attack in Europe about six weeks earlier. An attacker penetrated a service provider managing refrigeration systems under multiple contracts, he said, and temperatures rose over a weekend at grocery stores and large storage units belonging to different companies in different locations, leading to large amounts of wasted food.
“The wake-up call for everybody here in our world is we’ve got to understand our accumulation risk here because we always think about the individual attack and individual weakness and we all know those stories,” Fletcher said. “But whether it’s AI directly or whether it’s other elements, we need to be as an insurer very mindful of the accumulation across because one event could impact everybody.”
He said government and many companies had received a notice the day before the panel about a vulnerability in ConnectWise, a connector software system, which was then fixed. Warnings like that are now constant, he said.
Defining the edges of cyber exposure has been the line’s central problem for about a decade, Fletcher said, and reinsurers and large organizations are putting significant effort into solving it.
“Really unravelling where the exposure begins and ends is the biggest challenge,” he said.
Fletcher said most property policies are currently silent on AI, so property damage resulting from it is covered, and brokers can be comfortable telling clients that.
“It’s the advisory side that gets interesting,” he said, pointing to professionals who use AI as a tool when advising clients.
Peter Janzen, executive vice-president and president of Intact Insurance Canada, said Intact partners with Resilience, a large cyber managing general agent (MGA), and sees businesses leaving most of the prevention tools available to them unused.
He said threats are moving so fast that he struggled to keep up even while preparing for the panel, but that brokers can still guide clients on the basics.
Read more: Skip the glossy LinkedIn AI pitch, insurers warn brokers
“There’s no reason, as brokers, you can’t advise your clients to be all the way in on preventative measures, and this is like having dark web security scans, third-party cyber consultants. Prevention is still the best thing that you can do,” Janzen said.
He said phishing emails, such as fake offers of a free cruise, still catch people out and remain a common way in for attackers.
“It’s just basic cyber hygiene, and I would say that’s a good place to start,” Janzen said.
Fletcher said insurers will eventually have to engage with AI exposures directly.
“There has to be product opportunity here, and we owe it to our customers collectively to find the places where we can support, even if it is managing the limits on it as well,” he said.
