Navigating AI Risk Management: Essential Policies for Businesses

The rapid advancement of artificial intelligence (AI) technology has transformed how businesses operate, offering unprecedented efficiencies and capabilities. However, this swift adoption has outpaced the governance structures necessary to manage the associated risks. A recent survey conducted by Gallagher revealed that fewer than 50% of organizations have a formal AI risk management framework in place. This gap in governance is not just an oversight; it’s leading to real consequences, including Directors and Officers (D&O) claims, disputes over coverage, and unforeseen exclusions in insurance policies. As companies prepare for policy renewals, the urgency for a comprehensive AI risk management strategy is clearer than ever.

Tim Davis, the Chief Operating Officer of POWERS Insurance & Risk Management, emphasizes the imperative for organizations to establish a written AI policy. Without such a framework, businesses are left vulnerable, unable to properly assess their exposure to AI-related risks. In this article, we will delve into the reasons behind the necessity for a robust AI risk management policy, the implications for liability, and actionable steps organizations can take to protect themselves.

The Importance of a Written AI Policy

A written AI policy serves as the cornerstone of a company's risk management strategy regarding AI. According to Davis, the absence of such a document makes it nearly impossible to identify potential vulnerabilities. A well-defined policy should include:

• Acceptable AI Tools: Clearly specify which AI platforms and tools can be used within the organization.
• Usage Restrictions: Set detailed parameters for what is permissible within the AI systems employed.
• Feedback Mechanisms: Encourage employees to report any misuse or errors in AI applications, facilitating corrective actions.

These elements work in tandem to create a framework where AI can be utilized effectively while minimizing risks. Davis stresses the need for businesses to adopt enterprise-level AI instances rather than consumer-facing tools, which often lack necessary data protections. “If a business isn’t using an enterprise instance of AI, the information that they’re typing into their favorite platform is visible to the public,” he cautions.

Assessing AI Exposures

Once an AI policy is in place, businesses can begin evaluating their actual exposures related to AI utilization. This assessment is crucial, especially considering the evolving landscape of liability associated with AI errors. Davis recommends that all employees sign the established policy, and that it be integrated into the onboarding process for new hires.

Understanding D&O Liability

The landscape of D&O liability has shifted dramatically as AI becomes more prevalent in corporate practices. Many business leaders are aware that AI systems can produce erroneous outputs but may not fully grasp how these inaccuracies could lead to legal claims against them. “Many business owners don’t realize that allowing AI can increase the risk of a D&O claim,” Davis explains. Legal claims can arise due to negligence, product liability, or failure to disclose the use of AI in decision-making processes.

A key concern is the phenomenon of AI hallucination, where AI generates misleading or incorrect information that is presented without qualification. The legal implications of such inaccuracies are significant. As reported in a recent study by Techné AI, AI-related securities class actions have doubled from 2023 to 2024, indicating a growing trend in litigation connected to AI governance failures.

The Insurance Landscape and AI

As businesses grapple with the implications of AI on their operations, the insurance market is concurrently evolving. Traditional insurance programs often do not cover liabilities that stem from generative AI. Davis points out that most companies mistakenly assume their existing coverage extends to AI-related claims, which is increasingly not the case.

New Endorsements and Exclusions

Effective January 1, the Insurance Services Office (ISO) introduced new endorsement forms that allow carriers to exclude generative AI losses from standard Commercial General Liability (CGL) policies. Major insurers such as W.R. Berkley, Chubb, and Travelers have also begun adopting these exclusions. The tightening of errors and omissions coverage mirrors this trend, further complicating the landscape for businesses utilizing AI.

Given these developments, it's critical for organizations to engage in proactive discussions during policy renewal. Davis emphasizes the need to understand how businesses plan to utilize AI, which can significantly influence their risk profile and insurance coverage options. This proactive approach can help in identifying whether a standalone generative AI policy is necessary to fill any gaps left by traditional coverage.

Implementing Proactive AI Risk Management

The period between the deployment of AI technologies and the establishment of adequate governance structures is fraught with risk. To mitigate potential liabilities, organizations must implement a formal written plan that:

• Clearly defines acceptable AI tools and their usage.
• Ensures that all outputs generated by AI undergo human review for accuracy before being disseminated.
• Incorporates ongoing training for employees about the implications of AI use and associated risks.

By adopting these measures, organizations not only protect themselves against potential claims but also foster a culture of responsibility and oversight regarding AI technologies.

Key Takeaways

• Fewer than 50% of organizations have a formal AI risk management framework.
• A written AI policy is essential for identifying and managing exposure to AI-related risks.
• Directors and Officers (D&O) liability linked to AI errors is on the rise.
• Insurance policies are rapidly evolving, with many excluding generative AI liabilities.
• Proactive governance structures can help mitigate risks associated with AI deployment.

Frequently Asked Questions

What should be included in an AI risk management policy?

An effective AI risk management policy should define acceptable AI tools, outline specific usage restrictions, and establish internal feedback mechanisms for reporting misuse. It should also mandate human review of AI outputs to ensure accuracy before they are utilized in business operations.

How can businesses assess their AI exposure?

Businesses can assess their AI exposure by reviewing the AI tools in use, analyzing the outputs generated by these systems, and determining the potential liability arising from errors. Engaging employees in the process and requiring them to sign off on AI policies can also help identify vulnerabilities and establish accountability.

What are the implications of D&O claims related to AI?

D&O claims can arise when business leaders fail to adequately govern the use of AI, leading to negligence or failure to disclose material information. The increase in AI-related securities class actions indicates that directors and officers may find themselves personally liable for shortcomings in AI governance, making it crucial for organizations to establish robust oversight frameworks.

How is the insurance market adapting to AI risks?

The insurance market is evolving rapidly to address the challenges posed by AI. Many insurers are introducing exclusions for generative AI liabilities in standard policies and tightening coverage for errors and omissions. Businesses must stay informed of these changes and proactively engage with their insurance providers to ensure adequate coverage for AI-related risks.