What you need to do today: Add a specific cyber‑risk question and AI usage check to every commercial lines questionnaire, and require documentation of the client’s data‑breach response plan before you submit the application.
The latest Travelers Risk Index from Insurance Journal (Insurance Journal, Sep 23, 2026) reports that cyber threats have become the top business concern for insurers, with 68% of respondents citing AI‑enabled risk as a growing factor. A separate story (Insurance Journal, Sep 24, 2026) details how an OpenAI‑powered agent hacked an Australian government health website, illustrating how AI tools can be weaponized to breach sensitive data.
These developments signal that cyber exposure is no longer a peripheral line of business; it is now a core component of every commercial risk profile. For agents, the practical impact is clear: the traditional focus on general liability, property, and workers’ comp is insufficient. You must now treat cyber as a mandatory part of the risk assessment, especially for clients that operate digital platforms, use cloud services, or employ AI‑driven tools.
Concrete steps for agents:
- Include a mandatory “Cyber Risk Assessment” section in your standard commercial submission form. Ask the client to describe the types of data they collect, how it is stored, whether they use any third‑party AI or cloud analytics, and what incident‑response procedures are in place.
- Request a copy of the client’s data‑breach notification policy or a written statement confirming that they have a documented response plan. This documentation can be used to verify that the client meets the requirements for a data‑breach endorsement.
- When the client uses AI tools (e.g., chat‑bots, predictive analytics, automated underwriting), flag the exposure in your system and confirm that the policy includes a cyber endorsement that covers both first‑party data breach losses and third‑party liability for privacy violations.
- Communicate clearly with the underwriter that the client’s AI usage may affect the cyber risk exposure, and ask whether the carrier’s cyber policy includes sub‑limits for AI‑related incidents. If the carrier’s standard cyber wording excludes AI‑driven breaches, you will need to arrange a supplemental endorsement or a separate cyber policy.
By embedding these actions into your routine, you will produce more complete submissions, reduce the likelihood of coverage gaps, and position yourself as a trusted advisor who anticipates emerging risk trends rather than reacting after a loss occurs.
What this means for your placements: In the next 30 days, review each commercial account in your book and add the cyber‑risk question to the intake checklist. For any client that reports AI or cloud‑based data processing, initiate a conversation with the underwriter about cyber coverage and request the client’s breach response documentation. This proactive approach will help you avoid the “coverage surprise” that many agents are reporting as cyber claims rise, and it will make your renewal conversations more compelling to carriers that are increasingly scrutinizing AI‑related exposures.
Sources
- Insurance Journal (2026-09-23)
- Insurance Journal (2026-09-24)
Tags: cyber risk, AI, commercial lines, risk management