The pattern of commercial innovation in business is familiar: adopt new technology, discover its exposures, and then look to the insurance market to respond.

AI has not altered this trend, but what is different is that the insurance may already be in place.

Professional indemnity, cyber, product and directors' and officers' liability policies were written and priced long before generative AI became embedded in day-to-day business operations. As businesses increasingly integrate AI into the way they operate and make decisions, the nature and extent of the risks covered by those policies may be changing.

The emerging question is not whether cover exists in the abstract but whether insureds are adequately disclosing their use of AI at policy inception or renewal.

Silent AI: Defining the gap

This is where silent AI enters the discussion.

Silent AI is our term for the use of artificial intelligence within an insured’s business that is undisclosed and therefore not considered in the underwriting process. The risk is not that AI is used. It is that AI is used quietly and in such a way that the risk profile the insurer has priced and the risk profile that actually exists are not one and the same.

This is not to say that every use of AI is disclosable. AI has become commonplace, expected, and is often embedded in conventional tools without the user necessarily being aware of it.  The question this raises is one of materiality: which uses of AI carry enough risk to the insured's exposure to warrant disclosure, and which do not?

Our law channels this conundrum through an established duty: the duty of disclosure. That duty is often loosely described as one of “utmost good faith” but our courts have been clear that this degree of formulation overstates the position.

In Mutual & Federal v Oudtshoorn Municipality, the Appellate Division rejected the idea that insurance contracts attract a higher threshold of good faith. It held that there are “no degrees of good faith” in our law. Insurance contracts attract ordinary good faith, which is given effect by the well-established rule: the insured must disclose every known fact that is material to the risk.

Whether an undisclosed use of AI meets the threshold is answered by the two-pronged test set out by the Supreme Court of Appeal in King’s Property and more recently applied in Collection at D’Aria:

1. first, materiality is assessed objectively: would a reasonable, prudent person consider that the fact should have been disclosed; and
2. second, and often overlooked by insureds, the insurer must show inducement assessed subjectively: did the non-disclosure actually induce that particular insurer to write the risk on the terms it did?

In Kings Property the insurer’s internal underwriting position on the undisclosed risk was ultimately what proved the inducement. The corollary for silent AI is that where an insurer can demonstrate how it treats AI-related risk internally, that may go a long way to show that the undisclosed use of AI would have influenced the insurer’s assessment of the risk.

Silent AI in practice

Professional indemnity

These are not hypotheticals. Take for example, a doctor, engineer or financial adviser using AI tools to conduct due diligence, render advice or make decisions. This introduces a category of risk that did not exist when traditional professional indemnity policies were written.

If an AI tool misdiagnoses a pattern, miscalculates a load-bearing tolerance or generates a flawed financial projection, the professional may be liable to a client. A reasonable, prudent person in the insured’s position would recognise that an insurer needs to know:

• what AI tools are being used broadly;
• whether outputs are verified by a qualified human; and
• whether the AI is used in client-facing deliverables.

These are the facts that are likely to influence an underwriting decision on pricing, exclusions or whether to accept the risk at all.

Cyber

On the cyber side, take a retailer whose customer service function is handled by an AI chatbot that processes customer personal information and, on occasion, makes automated decisions about refunds.

The retailer's cyber policy was underwritten on the basis of a proposal form completed two renewal cycles ago, before the chatbot was deployed. A cyber breach occurs that is traceable to the chatbot’s broad access to the retailer’s customer database – access that was granted to the chatbot to let it personalise responses but created a vulnerability that allowed a hacker a route into broader customer systems.

Using a tool, the risk has changed – information that the cyber liability insurer would want to know.

Product liability

In the product liability space, consider a manufacturer that introduces AI-driven quality control on its production line by replacing human inspectors with a vision system that approves or rejects units. This introduction of AI has changed the nature of its exposure from human error to algorithmic error. The risk profile has altered from isolated human errors to a potentially systemic defect caused by the AI.

Without this knowledge, a public liability insurer has priced yesterday's risk.

Directors and officers

At board level, a company that increasingly relies on AI-driven financial forecasting to inform strategic decisions has introduced a new source of potential director liability.

Where regulators begin scrutinising algorithmic-informed decision-making in corporate governance, that level of scrutiny is a directors’ and officers’ material fact and not simply management practice.

Closing the gap

Silent AI is not a failure in innovation but a failure to disclose. The gap is not in the law; it is in practice. Insureds are adopting AI faster than they are assessing their disclosure obligations and insurers are potentially underwriting risks that they have not been told exist.

The practical task for insureds is not necessarily to catalogue every AI tool touching their business, but to apply the objective test the courts have set: would a reasonable, prudent person recognise that the particular use of AI (given its actual or potential effect on the risk) be one that should be disclosed?

Until AI adoption is treated as a material fact to be disclosed, the industry is likely to keep discovering silent AI in the same way it discovers non-disclosure: after the loss, when it may be too late to reprice the risk or too late for the insured to keep its cover at all.

Written by Maria Phillippides and Erwyn Durman, from Webber Wentzel