Your Insurer Rewrote Your Cyber Policy While You Were Deploying AI

InnovationYour Insurer Rewrote Your Cyber Policy While You Were Deploying AIByKiran Bhujle,Forbes Councils Member.for Forbes Technology CouncilCOUNCIL POSTExpertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based)Jun 10, 2026, 06:45am EDTKiran Bhujle: Global Head of Cybersecurity at SVAM International Inc, teaches at Columbia University ERM program. gettyPicture this: A mid-market company gets hit with ransomware. The CISO files a claim for a seven-figure loss, well within the policy limit. Three weeks later, the carrier comes back with a denial. During forensic review, investigators found that employees had been feeding customer data into a GenAI tool through personal accounts, with no access controls, no inventory and no documentation that the company even knew it was happening.The company had MFA and EDR on every endpoint. It had a written incident response plan and passed every traditional underwriting check. None of that mattered.The carrier denied the claim because the company couldn't demonstrate governance over its own AI use. That's the new fault line in cyber insurance, and most organizations are standing on the wrong side of it.The insurance industry just rewrote the rules—quietly.In January 2026, Verisk, the company whose standardized policy forms are adopted by carriers nationwide, released two new commercial general liability (CGL) endorsements: CG 40 47 and CG 40 48. These forms give carriers ready-made language to exclude AI-generated claims from standard CGL coverage. One covers both bodily injury and advertising injury, while the other narrows it to advertising injury only. Either way, the exit door is now built into the contract.W.R. Berkley introduced what the industry is calling an "absolute" AI exclusion across its D&O, E&O and fiduciary liability products—language broad enough to bar coverage for any claim "arising out of" AI use, de...