(Re)in Summary
- Companies should review whether existing policy wording covers AI-related fraud, cyber and privacy breaches, liability, business interruption and physical damage, speakers said at the PARIMA conference.
- Businesses should inventory AI tools and agents, track their access and use, and document approvals, human oversight, incidents and near misses.
- Critical infrastructure operators should set safeguards before allowing AI agents to act autonomously, with visibility into where agents operate and controls at enterprise, application and access-permission levels.
- Tabletop exercises can test who may stop or roll back a system, how an incident could affect operations and how the business would recover.
Companies should review how their insurance policies would respond to losses involving artificial intelligence and keep clear records of the systems and controls in place, speakers at the PARIMA Conference 2026 in Singapore said.
During a session on AI governance and cyber resilience on 15 October, speakers said AI-related incidents could involve fraud, cyber and data privacy breaches, liability, business interruption or physical damage. Organisations should assess whether their policy wording addresses scenarios they may not have previously considered.
“From the insurance point of view, if you’re looking at risk coverage and transfer, what is the potential impact, and how are your current policies set in their particular wording able to handle a situation which we may not have thought of?” said Edward Wong, regional director, cyber & tech solutions, Asia, Howden Asia.
APAC insurers continue to face silent AI risk, with AI-related exposures spread across existing cyber, technology errors and omissions, financial lines, professional indemnity and directors’ and officers’ cover. Standalone AI insurance remains nascent.
In a survey of insurers and reinsurers, S&P Global Ratings found that more than two-thirds of APAC respondents identified governance as a primary obstacle to AI adoption.
As AI systems can act beyond their intended scope, businesses should identify what tools and agents are in use, what they can access and who is responsible for them. Edward recommended keeping an inventory that includes tools employees may be using outside approved channels, as well as records of use-case approvals, human oversight, incidents and near misses.
Those records could help companies explain their controls when they need to clarify insurance coverage, he said. Organisations should also consider the potential operational and financial impact of an AI incident and how recovery would be funded.
Edward cited his experience with an AI note-taking bot that continued recording after a meeting had ended, capturing a private family conversation. The incident raised questions about who had authorised the recording, whether participants had consented and whether there was a way to stop or delete it.
For businesses, similar failures could expose confidential information or disrupt operations, Edward said. Companies should decide in advance who can stop or roll back a system and assess the consequences. “When you press an off switch, there could be a cascading series of events. Who is authorised to do that or shut down? And how would it impact your stakeholders?” he said.
Wong Yoke Chye, director at Singapore Power Private Limited, said organisations operating critical infrastructure need to establish safeguards before allowing AI agents to act autonomously.
He said companies need visibility into where agents are deployed and what they are doing, including whether they are attempting to access personal information. Controls should apply across the enterprise, within individual applications and through access permissions, he said.
Organisations should also consider whether AI is necessary for a task. When a colleague’s use of tokens increased, Yoke Chye said, he found that optical character recognition (OCR) or robotic process automation (RPA) could perform the work with less risk and resource use.
The speakers recommended tabletop exercises to test how an organisation would respond if an AI system malfunctioned or caused harm. Exercises should establish who has authority to stop the system, how the incident would affect business continuity and what steps are needed to restore operations.
“The AI model makers are themselves preparing for a potential day after a major AI event,” Edward said. “So the question is, how are we going to prepare the day before that happens?”
