Somewhere in your next cyber-insurance renewal packet, there's a new section. It asks whether your organization uses generative AI, which tools are approved, what data employees may put into them, and whether you have a written policy governing all of it. Enterprise customers' security questionnaires have added the same questions. And "we're being careful" — the answer most mid-market companies currently have — is worth exactly nothing on either document.
Why insurers suddenly care
Underwriters price what they can see. AI introduces exposure they currently can't: company data flowing into consumer tools, AI-generated work product entering contracts and communications, new vendors touching sensitive information, and employees with capabilities IT never provisioned. An organization that can produce a policy, an approved-tool list, and evidence of enforcement is a measurably different risk than one that shrugs — and premiums, exclusions, and claim outcomes are starting to reflect that difference. A denied claim over an unmanaged AI exposure is the expensive version of this lesson.
What a real policy contains
Not a values statement — a working document with six load-bearing parts:
Approved tools, by name. Which AI tools are sanctioned, at which license tier, for which roles — and what the request path is for new ones, because a policy without a request path breeds shadow AI.
Data rules by classification. What may go into which class of tool: public information, internal, confidential, customer-owned, regulated. This single section does most of the policy's protective work.
Human review requirements. Where AI output must be reviewed before it ships — anything customer-facing, contractual, financial, or safety-related — and who owns that review.
Disclosure standards. When AI involvement gets disclosed to customers or counterparties, so nobody improvises that judgment under deadline.
Consequences. What happens when the policy is violated, stated plainly. A policy without consequences is a suggestion.
An owner and a review cadence. A named role who keeps the policy current — because the tool landscape changes quarterly, and a 2024 policy is archaeology.
Standing one up in 30 days
Week one: discover actual usage (anonymously — you want truth, not compliance theater). Week two: draft the six sections above against what you found, with your legal counsel owning the legal language. Week three: leadership review and a sanctioned-tool decision. Week four: roll it out with training that explains the why, not just the rules. Then keep it alive: the policy feeds a risk register, and both get reviewed quarterly.
Where this fits
The policy is the visible tip of AI governance — underneath it sit shadow-AI discovery, vendor clause review, and the living risk register, aligned to the NIST AI Risk Management Framework so auditors and insurers recognize the structure. We build this as a standalone project or maintain it continuously inside Managed AI Operations. If your renewal lands in the next two quarters, book a briefing — thirty days is enough time to have a real answer, and the questionnaire is coming either way. If you suspect actual usage is bigger than anyone admits, start with what shadow AI discovery typically surfaces.