Cyber Security and Artificial Intelligence Insurance: Products and Coverage Structure
In a sentence: 'Cyber insurance' is not a single product, but an umbrella term for a group of products. Policies that go by the same name 'cyber insurance' can differ enormously in coverage, sub-limits and exclusions. This page breaks down the four types of product and coverage structure that actually exist in the Hong Kong market, so you know what to ask when underwriting and renewing.
Last updated on this page: 1 October 2026 | Data collected on: 1 October 2026
1. First, Distinguish Four Different Products
The four types of product often conflated in the market actually handle different risks:
| Product | What it covers | Typical policyholder | Relationship with other products |
|---|---|---|---|
| Cyber insurance (cyber liability and first-party loss) | A business's own losses and third-party liability arising from data breaches, ransomware, system interruption and cyber fraud | Enterprises holding customer data and relying on network operations | Complements rather than overlaps with commercial combined insurance and public liability insurance |
| Technology liability insurance (Technology E&O) | Financial loss suffered by clients due to negligence, error or omission in providing technology products or services | IT companies, system integrators, software vendors, technology consultants | A type of professional liability insurance, handling 'service done wrong' rather than 'system attacked' |
| Standalone AI liability insurance | Third-party losses caused by an AI system's output, decisions or behaviour, including AI hallucination, model performance degradation and algorithmic bias | Institutions using or deploying AI (more than developers) | Used to fill the gap left by AI exclusion clauses in general liability and professional liability insurance |
| Embedded microinsurance | Repair costs and deductible compensation for a single technology application scenario (e.g. robots, electric vehicle fleets) | Enterprises procuring the technology through a supplier | Directly embedded into the procurement process, bypassing traditional enterprise insurance application procedures |
Why distinguish these four? Because the most common misconception is 'I bought technology liability insurance, so AI errors will be covered too'. Technology liability insurance handles your negligence as a service provider; if your business merely uses AI (e.g. using AI to reply to customers or generate marketing content), the risk falls on the other side, and what you need is the AI clause in cyber insurance or standalone AI liability insurance.
2. Coverage Structure: First-Party, Third-Party and Response Services
A complete cyber insurance policy usually consists of three parts. Buying only one part is the most common coverage gap for SMEs.
2.1 First-Party Coverage (the Business's Own Losses)
| Coverage item | Content |
|---|---|
| Incident response costs | Digital forensics investigation, legal advice, PR and crisis management, and the cost of notifying affected individuals |
| Business interruption loss | Loss of income during system downtime, and extra expenses incurred to maintain operations |
| Data recovery and system restoration | Costs of restoring data, rebuilding systems and removing malware |
| Ransomware-related expenses | Some policies cover ransom, usually subject to legal review and prior insurer approval, with a separate sub-limit |
| Regulatory investigation costs | Legal defence costs for investigations by the Privacy Commissioner's Office or industry regulators |
2.2 Third-Party Liability Coverage (the Business's Liability to Others)
| Coverage item | Content |
|---|---|
| Claims by customers and business partners | Claims, settlement amounts and legal costs arising from their data leaking from your systems |
| Regulatory fines and investigations | Coverage for regulators' investigations and fines to the extent permitted by law (this item varies enormously and must be checked policy by policy) |
| Data breach notification costs | Statutory and practical costs of notifying affected individuals |
| Reputation and crisis management | Some policies cover reputation repair expenses after an incident |
2.3 Response Services (the Most Often Underestimated Part)
Most cyber policies, beyond paying money, also provide professional support services after an incident — typically a 24-hour hotline connecting to forensic, legal and PR teams that have handled large numbers of incidents.
For businesses without an internal information security team, the value of this service often exceeds the payout itself: the correct decisions made in the first few hours of an incident determine whether it is contained or escalates into a crisis threatening operations.
3. Trigger Point: 'Incident' Rather Than 'Claim'
This is the most important operational distinction between cyber insurance and traditional liability insurance.
| Traditional liability insurance | Cyber insurance | |
|---|---|---|
| Trigger basis | Third party makes a claim | An insured cyber incident occurs |
| When activated | After receiving claim notification | After the incident is confirmed (no need to wait for the other party's claim) |
| Main function | Payout and defence | Payout + immediate response support |
| Typical form | Claims-made | Claims-made, but with an incident notification mechanism added |
The practical difference is: you can activate the policy because of a ransomware attack (the incident has occurred even if no one has claimed against you), and you can obtain forensic and negotiation support from the very first moment. But conversely, if you do not notify the insurer within the time limit required by the policy, even if the incident is within coverage, it may affect the payout.
4. Four Types of Exclusions Most Often Overlooked
War and State Action
Cyber attacks launched by war or state-level actors are typically excluded. This is the most commercially impactful exclusion in cyber policies, having historically triggered major disputes. The exact wording varies enormously.
Known Circumstances Before Inception
Situations that had already occurred, or should have been known to have occurred, before the policy took effect are generally not covered. If an undetected intrusion already existed at the time of application, subsequent losses may be denied.
Failure to Meet Security Level Commitments
Some policies stipulate that specified security controls must be maintained (e.g. full deployment of multi-factor authentication). If you declared at application that it was implemented but it was not, losses arising from that gap may be excluded.
Sub-Limit for Business Email Compromise
Transfer losses caused by impersonated email often have a separate sub-limit in many policies, and may even require separately purchasing crime insurance or an endorsement to be covered.
Other limitations to note include: systems not patched for known vulnerabilities in time, failure to follow security advice, intentional human acts, and some policies' overall exclusion of 'inadequate security measures'.
5. Sub-Limits and Layering: the Limit Is Not the Payout Ceiling
This is the section most prone to error when reading a cyber policy.
Total limit (e.g. 5 million)
├── Incident response and forensic costs ── separate sub-limit (e.g. 1 million)
├── Business interruption loss ────── separate sub-limit (e.g. 1.5 million)
├── Ransomware and ransom ──── separate sub-limit (e.g. 0.5 million)
├── Regulatory fines and investigation ──── separate sub-limit (e.g. 0.5 million)
└── Third-party liability ──────── separate sub-limit (e.g. 2 million)Key Points
- Sub-limits are usually non-fungible. Even if the total limit is 5 million, if the ransom sub-limit is only 0.5 million, the excess will not be topped up by other sub-limits.
- Some policies distinguish between an overall cap and a per-incident cap, and the two have very different actual coverage capabilities.
- Confirm whether legal costs share the same cap as the indemnity amount. If they do, a protracted lawsuit can exhaust the entire limit.
- Confirm the structure of the deductible / excess: calculated 'per incident' or 'per policy year'.
6. Hong Kong Market Product Ecosystem
Hong Kong's cyber insurance and AI-related coverage are provided by four types of market participants:
| Type | Description |
|---|---|
| International insurance groups | Possess global cyber insurance capacity; products are mostly used for layered arrangements of multinational corporations and large projects |
| Specialist cyber insurers | Cyber risk as their core business; clause design closer to technical reality; some specialise in serving SMEs |
| Virtual insurers and insurtechs | Handle application and underwriting through digital processes; standardised products suited to SMEs and startups |
| Lloyd's coverholders and specialist insurers | Underwrite novel risks (e.g. AI liability) with individually designed policies; the market is still at an early stage |
Market participants also mention that Hong Kong has brokerages specialising in cyber insurance business; because cyber insurance clauses differ greatly, arranging cover through an intermediary with technical risk experience is usually more efficient than comparing prices directly.
On the current market situation for AI-related coverage (as of October 2026)
- A virtual insurer in the Hong Kong market has included AI-related cyber risk within its cyber insurance product scope.
- An international insurance group has partnered with an insurtech to underwrite robot application repair costs and deductibles in the form of embedded microinsurance.
- Standalone AI liability insurance products are currently found mainly in the US and Lloyd's markets, not as a ready-made product in the Hong Kong market.
- At the same time, some insurers add AI exclusion clauses to commercial policies. Within the same market, the approach to AI risk is not uniform.
Editorial Note
This page does not list comparisons by name of individual insurers or products, nor does it evaluate, rank or recommend. The reason is that cyber insurance clauses differ enormously, and even versions of the same company at different times may differ; the meaningful approach is to check the clauses policy by policy against your actual situation, rather than looking at a horizontal comparison table.
7. Underwriting: What Insurers Usually Ask
Cyber insurance underwriting questions are themselves a practical risk checklist. Businesses should prepare the following information before applying:
| Area | What insurers usually enquire about |
|---|---|
| Data assets | What types of personal data are held, how many people's records are involved, whether there is sensitive or financial data |
| Systems and architecture | Cloud or self-built, list of critical systems, whether there is a single point of failure |
| Access control | Coverage of multi-factor authentication, privileged account management, handling of departing employees' accounts |
| Backup and recovery | Backup frequency, whether backups are offline or immutable, recovery time objective |
| Security operations | Whether there is a dedicated person, outsourcing situation, logging and monitoring capability, vulnerability patching process |
| Incident response | Whether there is a written response plan, whether there were incidents or claims in the past three years |
| Supply chain | List of key suppliers, whether their security capability is assessed, whether contracts include security clauses |
| AI usage | Whether AI tools are used, for what purpose, whether personal or confidential data is entered, whether there is a usage policy and human review mechanism |
The last item is the new normal in 2026. Insurers enquire about AI usage during underwriting because it affects both cyber risk (AI used as an attack vector) and liability risk (losses caused by AI output).
8. Common Misconceptions
Common Misconception
"Our company is too small; hackers won't target us." Attackers tend to choose targets with weaker defences that still hold valuable data or cash flows. Hong Kong survey data shows SME cyber incident rates are no lower than those of large enterprises, while adoption of full-time security staff and basic controls is markedly lower. Small size is not protection; it just means you rely more on luck.
Common Misconception
"Buying commercial combined insurance already includes cyber risk." The property and liability coverage of traditional commercial insurance is written for the physical world. Losses such as data breaches, system interruption and cyber fraud generally need to be handled in the policy through standalone clauses or additional coverage. In recent years some policies have explicitly added AI exclusion clauses.
Common Misconception
"Buying a higher limit is enough." The limit is the ceiling; the sub-limit is the actually usable amount. A policy with a total limit of 5 million but a ransom sub-limit of only 0.5 million has, in a ransomware incident, far less actual coverage capability than the surface figure suggests.
Common Misconception
"If the supplier has an incident, the liability is the supplier's, not mine." If what leaked is your customers' personal data, the notification obligation and customer claim liability usually still fall on you, after which you pursue the supplier. This is an incident type that has actually occurred in Hong Kong recently, and is why you need to confirm whether the policy covers 'losses caused by third-party suppliers'.
Related Content
- Cyber Security and Artificial Intelligence Insurance (Section Home)
- Insurer Comparison (Enterprise Solutions) — this page does not name companies by name; for product-by-product comparison please visit that page
- Hong Kong News and Developments
- Education Hub: In-Depth Teaching Across Eight Modules
- AI Risk and Insurance
- Insurance Glossary