Does My Cyber Insurance Policy Cover AI?

If your business uses ChatGPT, Microsoft Copilot, Google Gemini, or any AI tool — and most Canadian businesses now do — you need to ask a question your broker probably hasn't raised yet: does your insurance actually cover AI-related losses?

The short answer, for most Canadian SMEs, is probably not.

Here's why — and what to do about it.

The AI Exclusion Wave Has Arrived

Starting in 2024, major insurance carriers began systematically adding AI exclusions to commercial policies. The mechanism is straightforward: carriers adopt ISO endorsement forms CG 40 47 and CG 40 48, which explicitly exclude coverage for losses arising from artificial intelligence systems.

What this means: If an AI tool your business uses produces incorrect advice that causes a client financial loss, or an AI system makes a discriminatory hiring decision, your GL, E&O, or cyber policy may deny the claim entirely.

Carriers adding these exclusions include major names that serve the Canadian market. This isn't a future risk — it's happening in current renewal cycles.

Three Ways Your Policy Fails on AI

1. Explicit AI Exclusions

The clearest gap. Your policy contains language that specifically excludes "artificial intelligence," "machine learning," "algorithmic decision-making," or "automated systems." Any claim even tangentially related to AI gets denied.

Look for: Phrases like "arising from or related to artificial intelligence systems," "algorithmic or automated decision-making," or "generative AI outputs" in your exclusions section.

2. Silent Cyber (No Coverage Language)

Your policy neither affirms nor denies AI coverage. This is actually worse than an explicit exclusion in some ways, because you won't know whether you're covered until you file a claim — and then it's too late.

Canadian courts are split on how to handle silent cyber claims. Some find coverage; others don't. It's a coin flip with your business on the line.

3. Inadequate Sub-Limits

Your policy might mention AI or cyber, but with sub-limits that are a fraction of your total coverage. A $5M GL policy with a $100K cyber sub-limit won't cover a ransomware demand or an AI liability judgment.

What AI Risks Are We Talking About?

For a typical Canadian SME using AI tools, the real exposures include:

• AI Hallucination Liability: ChatGPT produces incorrect financial advice or analysis that a client relies on, causing a loss. Your E&O policy may exclude AI-generated outputs.
• Algorithmic Bias: An AI tool used in hiring, pricing, or customer service produces discriminatory outcomes. Human rights complaints and litigation follow.
• Data Leakage: Sensitive client data entered into an AI tool is used for model training or exposed in a breach. PIPEDA violations and breach notification costs.
• Autonomous Agent Errors: An AI agent makes an unauthorized transaction or decision on your behalf. Standard policies often exclude "autonomous acts."
• IP Infringement: Generative AI produces content that infringes someone else's copyright. Your CGL probably doesn't cover AI-generated IP claims.

How to Check Your Policy Right Now

You don't need to wait for your next renewal to find out if you're covered. Here's what to do:

• Search your policy PDF for: "artificial intelligence," "AI," "algorithm," "machine learning," "automated," "generative"
• Check the exclusions section for any of the above terms
• Look for affirmative cyber language — if your policy doesn't explicitly mention cyber or AI coverage, you likely have a gap
• Or use our free tool — upload your policy and get an instant analysis

The Canadian Regulatory Context

Canada's Bill C-27 (which included the Artificial Intelligence and Data Act) has been stalled indefinitely. This creates a regulatory vacuum — there are no specific Canadian AI liability rules, which means:

• Courts apply existing common law, which wasn't designed for AI
• PIPEDA applies to AI-handled data but doesn't address AI-specific risks
• No mandatory AI insurance requirements exist — yet

The EU AI Act, by contrast, imposes strict liability rules effective August 2026. While Canada lags, Canadian businesses using AI still face real liability under existing tort and privacy law.

What to Do Next

1. Check your current policy — use the gap analyzer above or search for AI exclusion language yourself
2. Talk to your broker — ask specifically about AI exclusions and whether your GL/E&O/cyber covers AI-generated outputs
3. Consider an AI-specific wrap — products like CyberAgency AI Shield sit above your existing policies to cover the AI gaps
4. Implement AI governance — an acceptable use policy, AI tool inventory, and human oversight requirements reduce both risk and premium

The businesses that address AI coverage now — before a claim — will be far better positioned than those that discover the gap after a loss.