AI Risk and Cyber Insurance Gaps
In a sentence: AI is at once a tool for attackers, a risk for businesses, and a gap the insurance market has not yet fully priced. This page outlines how AI is redrawing the boundaries of cyber risk, the three ways insurers handle AI, and the governance evidence businesses should build before taking out cover.
Last updated on this page: 28 October 2026 | Data collected on: 28 October 2026
Scope and Position of This Page
- This page only compiles publicly available information and common market practices; it does not constitute the sale, offer or solicitation of any insurance product, nor does it rate, rank or recommend any company or product.
- Individual policies vary greatly in their stance on AI; actual coverage is always governed by the policy document issued by the insurer.
- This page focuses on enterprise (commercial) risk.
1. AI Is Redrawing the Boundaries of Cyber Risk
AI's impact on cyber risk can be divided into two sides: offence and exposure:
| Aspect | Concrete Examples |
|---|---|
| AI as an attack vector | Deepfake voice used in large-value corporate fraud; AI-enhanced phishing messages make identification harder (generative AI pushed phishing to 57% of HKCERT's 2025 incidents); AI-automated ransomware and extortion |
| AI as an exposure surface | Staff entering company or customer data into public AI tools; AI agents (agentic AI) abusing system privileges after gaining access; third-party losses caused by erroneous AI output |
In 2026, the HKMA and the SFC issued circulars to regulated institutions on AI-driven cyber attacks, explicitly listing AI as an attack vector rather than merely an application tool. Regulators' focus has shifted from 'whether AI is used' to 'how AI is governed'.
2. Three Ways Insurers Handle AI Risk
Within the same market, the approach to AI-related losses is not uniform:
- Excluded via exclusion clause: Some international insurers have applied to regulators to add AI exclusion clauses to commercial policies, removing liability arising from a business's deployment, use or integration of AI technology; some clauses even cover 'actual or alleged use of AI'.
- Including AI-induced cyber risk within the cyber policy: Hong Kong virtual insurer OneInfinity upgraded its cyber insurance in January 2026, proactively including 'cyber losses and third-party liability arising from the use of AI technology within the insured's systems, or from its use as an attack method', with a limit selectable up to US$2M.
- Standalone AI liability insurance: Currently found mainly in the US and Lloyd's markets (e.g. HSB's AI liability insurance, Armilla, Testudo, Munich Re aiSure), targeting institutions that 'use AI' rather than 'develop AI'. Not a ready-made product in Hong Kong.
Common Misconception
"I have cyber insurance, so AI incidents will be covered too." In a market environment where most policies have added AI exclusion clauses, this assumption no longer holds. When renewing cover, businesses must review each policy's stance on AI clause by clause, rather than assuming the market treats it uniformly.
3. The AI Risk Businesses Most Often Overlook
According to HKCERT's Hong Kong Cyber Security Outlook 2026:
- 35% of businesses using AI admit to having entered company data into public AI tools;
- SMEs' adoption rates for email security, privileged access management and remote security are all markedly lower than those of large enterprises;
- Nearly 30% of businesses have no dedicated person responsible for cyber security.
Entering company data into public AI tools can trigger two types of problems at once: third-party liability for data leakage, and notification obligations under the Personal Data (Privacy) Ordinance. Such losses are often outside the automatic coverage of a standard policy.
4. Build Three Types of Governance Evidence Before Taking Out Cover
The regulatory focus has shifted to 'how AI is governed'. In practice, before arranging cyber insurance (and addressing AI exclusion clauses), businesses should first have three types of documentation:
| Document | Content |
|---|---|
| AI usage policy | Which AI tools may be used, whether company or personal data may be entered, and whether there is a human review mechanism |
| Privacy impact assessment records | Identifying and recording risks and mitigation measures before using AI to process personal data |
| AI system behaviour records | Privilege controls for agentic AI, human intervention and audit logs |
These three types of documentation are both a regulatory expectation (the Privacy Commissioner's Office's Agentic Artificial Intelligence: Protecting Personal Data Privacy) and a practical way to improve insurability and narrow coverage gaps.
5. Frequently Asked Questions
What is an AI exclusion clause in cyber insurance?
An AI exclusion clause removes liability arising from a business's deployment, use or integration of AI technology from coverage; some clauses even cover 'actual or alleged use of AI'. This can leave businesses that assumed their existing policy covered such risk facing a coverage gap when an AI-related incident occurs.
How does the Hong Kong market handle AI-related cyber risk?
At present, the Hong Kong market's approach to AI risk is not uniform: some carriers have added AI exclusion clauses, while others (such as OneInfinity) proactively include AI-related cyber risk within coverage. Standalone AI liability insurance products are currently found mainly in the US and Lloyd's markets, not as a ready-made product in Hong Kong. Businesses should review each policy's stance on AI.
What AI-tool risk do businesses most often overlook?
According to HKCERT's 2026 research, 35% of Hong Kong businesses using AI admit to having entered company data into public AI tools. Such data leakage is often not within the automatic coverage of a standard policy, and may trigger notification obligations under the Personal Data (Privacy) Ordinance.
Can standalone AI liability insurance be bought in Hong Kong?
At present it is found mainly in the US and Lloyd's markets, and is not a ready-made product that can be bought directly in Hong Kong. Its significance lies in pointing the way: AI risk is moving from 'uninsured' to 'insurable'.
6. Sources
- HKCERT Hong Kong Cyber Security Outlook 2026 (institution publication, collected 2026-01-28)
- OneInfinity cyber insurance upgrade press release (institution publication, 2026-01-12)
- HKMA and SFC AI cyber attack circular (cited in industry analysis, 2026-05)
- Privacy Commissioner's Office Agentic Artificial Intelligence: Protecting Personal Data Privacy (official guidance, 2026)
- Market research: EssFeed, Insura, TrustMyIP (2026)