AI Cyber Risks: Why Indian Businesses Should Review Their Cyber Insurance

AI is helping organisations improve productivity, automate processes and make faster decisions. However, the same technology is also introducing new vulnerabilities and changing how cyberattacks are carried out.

AI-powered cyberattacks are becoming more sophisticated

Cybercriminals can use AI to create convincing phishing emails, impersonate senior executives and develop deceptive communications designed to trick employees into sharing confidential information or transferring funds.

AI-generated voice messages and deepfake videos can make fraudulent requests appear genuine, increasing the difficulty of distinguishing legitimate communications from scams.

For businesses, these threats can result in financial losses, compromised systems and the exposure of sensitive data.

Employees can unknowingly expose confidential information through AI tools

As generative AI becomes part of everyday business operations, employees may upload contracts, customer information, financial records or proprietary business data to external AI platforms.

Depending on the tool's security settings, data-handling practices and contractual arrangements, this information could be exposed or used in ways the organisation did not intend.

Such incidents can create confidentiality concerns, potential legal liabilities and reputational damage, even without a conventional cyberattack.

AI failures can disrupt business operations

Businesses increasingly rely on AI-enabled applications for customer service, operations, logistics, financial analysis and other critical functions.

Errors, security vulnerabilities or failures in these systems can potentially interrupt operations, affect service delivery or lead to disputes with customers and business partners.

Importantly, not every AI-related failure qualifies as an insured cyber incident. The cause of the failure and the resulting loss must be assessed against the terms of the relevant insurance policy.

A cyber incident can trigger consequences far beyond the cost of repairing compromised systems.

Consider a manufacturer whose operations are interrupted by ransomware. Apart from restoring its systems, the business may face lost revenue, delayed deliveries, strained customer relationships and contractual disputes.

Similarly, a data breach at a healthcare organisation or financial institution could lead to expenses associated with investigating the incident, notifying affected parties, obtaining legal assistance and managing reputational fallout.

These examples demonstrate why cyber risk management cannot remain solely the responsibility of IT departments.

Finance teams, legal departments, risk managers and senior leadership must work together to evaluate the organisation's exposure.

Cyber insurance for businesses can form part of this broader approach by providing financial protection against certain cyber-related losses and liabilities, subject to the policy's scope, conditions and exclusions.

This is an increasingly important question for organisations adopting AI.

The answer is that AI-related losses are not automatically covered under an existing cyber insurance policy.

Whether a claim is covered depends on the nature of the incident, the policy wording, the applicable coverage extensions and exclusions.

For example, an AI-assisted cyberattack that compromises customer data may involve risks addressed under certain cyber insurance policies. However, an incorrect recommendation generated by an AI system that causes financial loss to a customer may raise professional liability issues instead.

As Mr. Najm Bilgrami, National Head – Liability Lines, Tata AIG General Insurance, explains:

"Businesses should not assume that AI-related losses are automatically covered under the policies they already hold. They should map the exposure and ask their insurer or broker exactly where they stand."

This distinction becomes particularly important as AI is integrated into customer-facing services, automated decision-making and business-critical operations.

Business cyber insurance policies are designed to address different types of losses arising from covered cyber incidents.

Depending on the insurance product and the coverage selected, these may include:

• Data breach liabilities: Certain legal defence costs and liabilities arising from the unauthorised exposure of personal or corporate information.

• Cyber incident response expenses: Eligible costs associated with forensic investigations, breach response and specialist assistance.

• Data restoration costs: Expenses associated with recovering or restoring affected electronic data following qualifying incidents.

• Business interruption losses: Certain financial losses arising from covered network interruptions, where applicable coverage has been selected.

• Cyber extortion: Eligible expenses associated with specified cyber extortion incidents, where covered.

• Reputation management: Certain professional expenses incurred in managing the reputational impact of a covered cyber incident.

The availability and extent of these protections vary by policy. Businesses should also examine deductibles, sub-limits, notification requirements, exclusions and any optional extensions before deciding on coverage.

In particular, contractual penalties, regulatory fines and losses arising solely from AI system errors should not be presumed covered.

The growing use of AI is also creating exposures that may fall under other categories of liability insurance.

For example, technology companies developing or deploying AI-based solutions may face claims involving alleged errors, negligence or failure of professional services. Such exposures may need to be considered under Technology Professional Indemnity insurance.

Organisations may also face allegations relating to AI governance, misleading representations about AI capabilities, unsuccessful AI investments or discriminatory outcomes from automated decision-making.

These situations can raise questions about management accountability and potential Directors and Officers (D&O) liability.

According to Tata AIG General Insurance, more than 30% of incidents reported under its D&O insurance portfolio are now linked to regulatory actions, compared with nearly 13% five to seven years earlier.

This is a trend within Tata AIG's D&O portfolio, rather than a measure of cyber claims. Nevertheless, it highlights the increasing significance of regulatory scrutiny in corporate risk management.

The implication for businesses is clear: cyber insurance, professional indemnity insurance and D&O insurance address different exposures. Organisations should assess how these policies interact and identify areas where protection may be insufficient.

India's Digital Personal Data Protection (DPDP) framework is adding another dimension to corporate cyber risk management.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, which are being implemented in phases, are important considerations for businesses handling digital personal data.

Organisations must understand the data protection obligations that apply to them and the timelines for compliance.

This is particularly relevant for sectors such as banking, insurance and healthcare, where businesses handle significant volumes of customer information.

A data breach may require an organisation to investigate what happened, assess its reporting and notification obligations, manage affected stakeholders and address the resulting legal and operational consequences.

While cyber insurance may help with certain eligible expenses and liabilities arising from insured incidents, it is not a substitute for regulatory compliance. Nor should businesses assume that penalties imposed by regulators will be insured.

Strong data governance, cybersecurity controls and appropriate insurance protection should therefore be viewed as complementary parts of a comprehensive risk management strategy.

As cyber threats evolve, organisations should periodically review their insurance arrangements against their actual operations and technology dependencies.

• Does our cyber insurance cover AI-assisted cyberattacks? Understand how the policy responds to incidents involving AI-generated phishing, impersonation, data breaches or network security failures.

• What happens if a cyberattack interrupts our operations? Examine whether business interruption and network interruption coverage are included, and what conditions trigger them.

• Are we protected against liabilities arising from confidential data exposure? Assess the policy's treatment of personal information, corporate information and third-party claims.

• How are third-party technology providers covered? Review exposures involving cloud platforms, outsourced services, vendors and external AI tools.

• Which AI-related risks fall outside our existing policies? Identify potential gaps between cyber insurance, professional indemnity insurance and D&O insurance.

• Are our coverage limits still appropriate? Consider whether increased digital dependence, business growth and changing contractual obligations warrant a reassessment of insured limits.

These questions can help organisations engage in more informed discussions with their insurers or brokers and make coverage decisions based on their specific risks.

Cyber insurance is one component of an effective cyber risk management strategy. It cannot prevent an attack or eliminate an organisation's responsibility to maintain appropriate safeguards.

Businesses should continue strengthening employee awareness, access controls, data protection practices, incident response plans and oversight of third-party technology providers.

Organisations adopting AI should also establish clear policies governing the use of external AI tools, the handling of confidential information and accountability for AI-enabled decisions.

Equally important is ensuring that cyber risk is regularly reviewed at the leadership level.

As AI adoption expands, cyber preparedness requires coordination across technology, operations, legal, compliance and insurance functions.

The growing sophistication of cyber threats and the emergence of AI-related exposures mean that businesses must continually reassess their risk management strategies.

TATA AIG General Insurance offers cyber insurance solutions for businesses, including Cyber Risk Protector, designed to address specified cyber risks such as data breaches, network security failures and associated third-party liabilities.

Businesses can consult Tata AIG's insurance specialists to understand the available coverage, assess their cyber risk exposures and explore appropriate insurance solutions.

The right time to review your cyber insurance is before an incident exposes a gap in your protection.