Cyber policies have spent the past two years quietly absorbing AI risk without ever naming it. Beazley's new AI Clarifying Endorsement states outright that AI-driven cyber attacks fall within its existing full spectrum cyber cover. The endorsement addresses one specific gap: attacker-side AI use, meaning AI as the tool behind a cyberattack. It says nothing about whether a client's own use of AI, in a chatbot, an internal model, or a vendor's tool, is covered elsewhere in the same policy, a question the market has been answering in inconsistent and sometimes contradictory ways over the past year.
Most cyber policies written before this year covered AI-related losses by omission rather than by design. AI wasn't excluded, and it wasn't explicitly included either, so whether a claim involving an AI-driven attack would be paid came down to how a specific incident was argued at the point of loss.
That ambiguity has a name in the market: silent AI, a direct echo of the silent cyber problem insurers spent the previous decade trying to eliminate by forcing cyber exposure out of property and general liability policies and into standalone products with explicit wording.
AI is now going through the same transition, only faster. The Insurance Services Office (ISO) introduced three generative-AI exclusion endorsements for commercial general liability policies effective January 1, and cyber carriers have been responding with their own AI-specific language ever since, in both directions. Some are excluding. Some are capping. Some, like Beazley here, are moving to affirm.
The context that makes this announcement worth a second read is that Beazley was named in Financial Times reporting as one of the carriers drafting policy language to cap, not expand, AI-related payouts, specifically for losses tied to regulatory breaches, with sub-limits reportedly discussed at roughly 10% of overall policy value.
A Beazley spokesperson told the FT at the time that the carrier had "not reduced coverage for AI cyber risk and are not planning to." Whether the Clarifying Endorsement supersedes, coexists with, or is unrelated to those earlier discussions isn't addressed in the announcement.
Set against that backdrop, the endorsement's stated purpose is narrower than "AI coverage" as a whole. It addresses AI-driven cyber attacks, meaning incidents where AI is the tool an attacker uses to compromise systems already covered by the policy, such as autonomous phishing or accelerated intrusion attempts.
That's a meaningfully different question from whether a client's own use of AI, in a chatbot, an internal model, or an AI vendor, creates liability exposure if that AI causes harm or a data incident. The two are often conflated in AI insurance conversations, and a client asking "are we covered for AI" is usually asking about the second question, while this endorsement answers the first.
None of this makes the endorsement meaningless. Clarity on attacker-side AI risk is a genuine gap that's existed since large language models became capable enough to run reconnaissance and phishing at scale, and naming that exposure explicitly removes one point of dispute at claims time.
What it doesn't do, however, is settle the broader question the market is currently split on, whether the insured's own AI use is affirmed, excluded, or sub-limited elsewhere in the same policy. That's a separate conversation. Carriers have been drafting AI wording differently enough over the past year that identical-sounding endorsement names can carry different scope from one policy to the next.
