2026-07-13 · Article
The Insurer Became the Auditor
Silent AI cover is gone, affirmative AI cover is underwritten against evidence, and the first shadow-AI disclosure precedent exists. The audit you were putting off now arrives with your renewal notice.
For the Record: AI Governance Tools for SA Boards, Article 2 of 4
Boards tend to model AI governance pressure as a regulator problem, and regulators move slowly: consultation papers, phased enforcement, first-offence leniency. There is a faster actor in the system, and it prices risk for a living.
On 1 January 2026, the insurance industry's era of "silent AI", where losses involving AI were covered simply because policies never mentioned it, effectively ended. Standard generative-AI exclusion endorsements became available for attachment at ordinary commercial general-liability renewals. Cyber carriers began writing AI sublimits at around ten percent of policy limits. And a new market emerged in the opposite direction: affirmative AI cover from specialist underwriters, at Lloyd's and elsewhere, that will insure AI-related loss, but only against documented evidence of governance.
Read that mechanism carefully, because it inverts the usual compliance logic. A regulator asks whether you broke a rule, after the fact. An underwriter asks whether you can prove control, before granting cover. The insurer does not fine you. It excludes you, at renewal, without a hearing.
The precedent that makes it concrete
In May 2026, a US community bank filed a formal securities disclosure after discovering that non-public customer data, names, identity numbers, dates of birth, had been processed through an unauthorised AI tool. No attacker. No breach of any system. An employee and a tool that was never approved. The bank judged the incident material and reportable within days of discovery.
That filing matters here for what it establishes: unauthorised AI use inside your own walls is now treated, in a mature disclosure regime, as a reportable incident even when nobody broke in. The supporting numbers say this is not an edge case. One in five breached organisations in recent breach research was compromised via unsanctioned AI use, adding roughly $670,000 to the average breach cost, and 97 percent of AI-related breach victims had no AI access controls at all. Documented AI incidents rose 55 percent last year.
A South African caveat, stated plainly because this series does not launder foreign facts into local claims: the exclusion endorsements, the sublimits and the disclosure precedent above are US and UK developments. We have not yet seen equivalent published evidence of SA insurers attaching AI exclusions at renewal. The trajectory, however, is not speculative. The SA insurance market reinsures into the same global market that has already repriced this risk, and the FSCA and Prudential Authority's joint AI report has already flagged third-party AI concentration risk to the sector. What is arriving is visible. The renewal at which it arrives is not announced in advance.
Why this lands on the board, not the broker
King V puts technology and information governance, AI risk explicitly included, on the governing body for financial years that began this January. Connect that to the insurance mechanics and the exposure becomes precise: if AI-related loss is excluded at your next renewal and nobody flagged it, or cover was available against governance evidence your organisation could not produce, that is not a procurement miss. It is a risk-transfer failure on a risk the board formally owns.
The practical question an underwriter's proposal form will ask is the same question a TAG assessment asks, because evidence is evidence: what AI runs in your business, who owns each system, what data does it touch, who reviews its decisions, what happens when it fails, and can you show the log. Organisations that can answer from documents get cover priced on facts. Organisations that answer from memory get the exclusion endorsement.
The artefact: the Renewal Readiness Questionnaire
File this. Complete it as a board or exco exercise before your next commercial insurance renewal, before the broker asks. Every "no" or "unknown" is either a remediation item or a disclosure decision, decided deliberately rather than discovered at claim time.
A. Inventory and ownership
| # | Question | Answer | Evidence document |
|---|---|---|---|
| 1 | Do we maintain a current register of every AI system and AI-enabled tool in production use, including embedded AI inside vendor products? | Yes / No / Unknown | |
| 2 | Does each entry name a business owner accountable for that system? | Yes / No / Unknown | |
| 3 | Have we surveyed for unsanctioned AI use (staff using public tools on company data) in the last six months? | Yes / No / Unknown |
B. Data and decisions
| # | Question | Answer | Evidence document |
|---|---|---|---|
| 4 | For each system: what personal information does it touch, and under what POPIA processing basis? | Documented / Partial / Unknown | |
| 5 | Does any system make or materially influence decisions with legal or significant effect on a person, and if so, is there a demonstrably meaningful human review step (POPIA section 71)? | Yes with evidence / Yes unverified / No / Unknown | |
| 6 | Can we produce, for any given AI decision in the last quarter, a log of what the system did and who reviewed it? | Yes / No / Unknown |
C. Failure and response
| # | Question | Answer | Evidence document |
|---|---|---|---|
| 7 | Do we have an AI-incident definition, severity tiers and an internal notification clock, distinct from the general IT incident process? | Yes / No / Unknown | |
| 8 | Has any AI system caused a customer-affecting error in the last 12 months, and was it recorded as an incident? | Yes, recorded / Yes, unrecorded / None known | |
| 9 | Who can switch a misbehaving AI system or agent off, how fast, and has that been tested? | Named and tested / Named untested / Unknown |
D. Cover itself
| # | Question | Answer | Evidence document |
|---|---|---|---|
| 10 | Have we asked our broker, in writing, whether AI exclusion endorsements apply or will apply to our GL, cyber, PI and D&O lines at next renewal? | Yes / No | |
| 11 | Have we assessed whether affirmative AI cover is available and warranted for our highest-exposure system? | Yes / No | |
| 12 | Has the board seen the answers to questions 1 to 11? | Yes, minuted / No |
Question 12 is the whole point. The other eleven produce information; the last one produces accountability.
For the record
The regulator will get to your AI eventually. Your insurer gets there first, at your next renewal, with a form. The organisations that fill it in from a file will keep their cover and price it well. The rest will learn what "silent AI" meant only once it has gone quiet for good.
Sources: ISO generative-AI exclusion endorsements (CG 40 47, CG 40 48, CG 35 08), attachable at commercial GL renewals from 1 January 2026, via EPC Group and IAPP insurance-market analyses; emerging affirmative AI cover (Lloyd's syndicates and specialist MGAs including Armilla, Munich Re/Mosaic, Counterpart, Testudo), IAPP, 2026; US community bank Form 8-K Item 1.05 shadow-AI disclosure, filed 11 May 2026 (materiality determined 7 May), via Cherry Bekaert and Wilson Sonsini analyses; IBM Cost of a Data Breach research on shadow-AI breach costs; Stanford AI Index 2026 (362 documented AI incidents in 2025, up 55 percent from 233); FSCA and Prudential Authority joint report on AI in the South African financial sector, November 2025; King V Code on Corporate Governance, Principle 10 (data, information and technology governance); POPIA sections 71 and 22; Tech Sight, TechSight TAG framework (Telemetry pillar), techsight.co.za.
Book the two-hour diagnostic