Beazley has expanded its cyber insurance offering to address losses arising from artificial intelligence system failures and unintentional regulatory breaches as businesses put more automated technology into live operations.
The FTSE 100 specialist insurer has introduced explicit provisions addressing two areas of AI exposure within its cyber policies: the risk that a company’s use of AI leads to allegations of regulatory non-compliance, and the possibility of business interruption or lost earnings when an AI system has to be shut down because of performance problems.
The changes are intended to provide greater clarity around incidents that may sit between traditional technology failure, cyber risk, operational disruption, and regulatory liability.
Alessandro Lezzi, Beazley’s head of cyber risks, said the insurer was responding to “AI changing the threat landscape” as organisations deploy the technology across more business processes.
The move comes as insurers confront a broader question over how AI changes the amount and type of technology risk carried by businesses. Conventional cyber policies have historically focused heavily on malicious attacks, data breaches, ransomware, system compromise, and related business interruption. AI can create losses without an external attacker being the direct cause.
An automated system could generate incorrect decisions, breach internal or regulatory rules, behave unexpectedly when connected to other systems, or require withdrawal from production while its performance is investigated. The resulting cost can extend beyond repairing software to lost revenue, professional advice, regulatory enquiries, and reputational damage.
Beazley’s 2026 risk research illustrates the overlap. Cyber risk was selected as the leading concern by 31% of respondents, while 80% agreed AI would improve their organisation’s bottom line.
At the same time, 72% expected AI to replace jobs within 18 months, and businesses reported increasing investment in technology-led security. Some 35% said they were turning to AI to strengthen resilience, while 33% were increasing cybersecurity spending.
The combination creates a more complicated risk profile than treating AI adoption solely as a productivity initiative or a cybersecurity problem. Automated systems can improve efficiency while increasing the number of decisions, data flows, software dependencies, and external services on which operations rely.
Agentic AI adds another layer because systems can be given permission to use tools, access data, communicate with software platforms, and complete tasks with less direct human intervention. Insurers, security companies, and corporate risk teams are consequently examining whether existing controls and policy wording remain appropriate when software can take actions rather than simply produce information for review.
The insurance market must also distinguish between different kinds of AI loss. A criminal using AI to accelerate an attack is different from an organisation’s own system malfunctioning. A regulatory investigation following unintended AI use is different again, while errors causing physical damage, professional liability, intellectual-property disputes, or harm to customers may fall across several insurance classes.
Beazley has been widening its treatment of technology-related loss beyond conventional data breaches. Earlier this year, it introduced cyber property-damage cover intended to address situations in which malicious cyber incidents lead to physical damage to equipment or infrastructure.
The AI provisions fit within that wider attempt to reduce ambiguity around emerging technology risks. Clarity matters to insurers and customers because uncertainty over policy wording can become most problematic after an incident, when organisations are already dealing with operational disruption and potentially significant costs.
Pricing presents a separate challenge. AI adoption is expanding faster than the historical loss data normally used to assess many insurance risks, requiring underwriters to make decisions while both the technology and its regulatory environment continue to develop.
Not every AI incident will be insurable. Policies remain subject to their terms, exclusions, limits, underwriting requirements, and individual claim circumstances. Companies also retain responsibility for governance, security controls, data management, and compliance rather than transferring those obligations to an insurer.
Beazley’s expansion nevertheless marks a shift towards recognising AI failure explicitly within mainstream corporate risk transfer. As organisations connect automated systems to more business-critical processes, cyber resilience, technology governance, regulatory compliance, and operational continuity are becoming increasingly difficult to manage as separate disciplines.
You must be logged in to post a comment.