Silent AI Is the New Silent Cyber — And Your Policy Doesn't Know It Yet

More than 90% of insurers' AI exposure sits in conventional policies that were never written to cover autonomous software. The gap is live. The clock is ticking. And most firms won't notice until the first claim lands.

I've watched this movie before. When I was on the security side, companies kept hitting the same wall: the policy they'd renewed for a decade suddenly wouldn't cover the thing that actually went wrong. The language was written for a world that no longer existed, and everyone assumed someone else had updated it.

Now we're running that exact cycle again — just faster.

The Data Breach Pattern: A Fifteen-Year Gap

In 2007, TJ Maxx lost 45 million card numbers to hackers. The breach was massive. The insurance fight was worse.

General liability policies covered "publication" of private information — meaning if TJX had accidentally printed customer data in a newspaper ad, they'd have been covered. But a hacker exfiltrating a database? That wasn't "publication." Courts sided with the insurers. Companies discovered they'd been paying premiums on policies that were never designed to cover the risk that actually materialized.

Target found the same gap in 2013 when 40 million cards leaked. So did dozens of others. The market scrambled. Standalone cyber policies existed but were scarce, expensive, and full of holes. It took until roughly 2020 — thirteen years after TJX — for standardized cyber language to mature into something boards could actually rely on.

That's the pattern. The technology moves. The risk crystallizes. The policy catches up a decade later.

AI Is Running That Clock Faster

On July 14, the Financial Times reported findings from the Artificial Intelligence Underwriting Company — a firm built with researchers from Anthropic and OpenAI. The number that matters: more than 90% of insurers' AI exposure sits in "silent" policies. Unpriced. Unmodeled. Largely unnoticed.

"Silent" means the coverage was never explicitly included or excluded. Your E&O policy, your general liability, your D&O — they were all written before software could act on its own, make decisions, generate content, or interact with customers without a human in the loop. So when your AI agent makes a recommendation that costs a client money, or generates content that triggers a defamation claim, or fails to disclose something material — does the old policy respond?

Nobody knows. And that uncertainty is a bet you don't want your firm making.

The Gap Is Already Closing

Here's what's different this time: the market is moving in years, not decades.

The first AI-specific exclusions went live January 1 of this year. Standard generative-AI carve-outs are already appearing in commercial policies. Insurers watched what happened with cyber and aren't waiting around to find out if a judge thinks "advice" includes an AI's output.

Meanwhile, dedicated AI insurers already exist. Five years ago, the idea of insuring an AI agent's decisions was a punchline at industry conferences. This year, companies like AIUC are raising real money and writing real policies. Not experimental pilots — actual coverage with actual underwriting models behind it.

So if you map this to the cyber timeline, we're not at 2007. We're closer to 2015. A mature, standardized AI policy market isn't seventeen years out. Bet on the early 2030s — which means you've got maybe five years of gap to navigate.

What Silent AI Exposure Actually Looks Like

Let me make this concrete. You're a CPA firm. You deploy an AI tool that helps draft audit reports, flag anomalies, or generate tax memos. It's fast. It's accurate enough. It saves junior staff dozens of hours.

Then it hallucinates a citation. Or misreads a regulation. Or generates a memo that a client relies on — and that advice costs them seven figures in penalties.

Your E&O policy was written in 2019. The word "AI" doesn't appear anywhere in it. Does it cover the claim?

Your broker says "probably." Your carrier's lawyer says "we need to investigate." Your client's lawyer is already drafting the complaint. And everyone's about to spend eighteen months finding out whether "professional services" was meant to include the output of software you didn't write and can't fully explain.

That's the exposure. It doesn't require malice or a breach. It just requires normal operational use of a tool that didn't exist when your policy was drafted.

The Questions Your Renewal Meeting Needs to Ask

So here's what to put in front of your CFO, your general counsel, or whoever signs off on your firm's insurance stack:

1. Does our current policy explicitly cover AI-generated work product? Not "software errors" — autonomous decisions, content, recommendations.

2. Do we have explicit AI exclusions we don't know about? Check the endorsements. Insurers are quietly adding carve-outs at renewal.

3. If we're using AI in client-facing work, have we disclosed that to our carrier? Cyber policies often have "material change" clauses. Deploying new technology without notice can void coverage.

4. Do we need standalone AI coverage, or can we get an endorsement? Standalone is expensive. An endorsement might be enough — if your carrier will write one.

5. What's our plan for the next three years as this market matures? Because the price and availability will shift fast, and you don't want to be shopping for coverage the day after an incident.

If nobody in the room can answer those questions, you already have your answer.

The Policy Language Is Always the Last to Know

I've lived through enough cycles to know how this ends. The technology gets deployed. The risk gets discovered. The lawsuits get filed. The policy language gets updated. It's never the other way around.

But what do I know — I've only watched this movie four times.

Here's the move: treat AI exposure the way you should have treated cyber exposure in 2010. Assume the gap exists. Assume your current coverage won't respond the way you think it will. Assume you're either going to buy something new or accept the risk consciously — but don't assume the policy you've been renewing for a decade will magically cover the thing it was never written to address.

The railroads didn't kill the towns. The towns just slowly realized the trains weren't stopping anymore.

Your insurance stack is the same. It's not broken. It's just designed for a world where software couldn't act on its own — and that world ended while you were busy renewing last year's policy.

Next Step: Before your next renewal meeting, ask your broker a single question: "If our AI tool generates bad advice that costs a client money, which policy responds — and can you show me the language?" If they can't answer in writing, it's time to start shopping.