Loading insights
Loading insight article
Insights / Governance
Carriers now treat AI as material underwriting factor, not a novelty question. Here's the 5-step framework for answering AI questions on your renewal, what an audit log actually needs to contain and common answers that trigger red flags.
A vague answer on an AI questionnaire can cost a law firm more than a bad claims history. Carriers no longer treat generative AI as a novelty, they treat it as a material underwriting factor that can affect pricing, term and even eligibility. That shift is why AI insurance questions are appearing more frequently in renewals and why law firms may encounter more detailed questions about artificial intelligence use as part of the cyber insurance AI questionnaire process.
The point to keep in mind when answering: the goal isn't to hide AI use. It's to show the carrier that your firm understands and manages it. Answers that suggest uncontrolled adoption, weak oversight or poor data handling are the kinds of responses that can trigger additional scrutiny during a cyber insurance AI questionnaire.
Three forces are driving this:
Malpractice and cyber carriers are converging on AI risk, particularly where AI touches client work, confidential data or court filings.
ABA and state bar guidance on technology competence and supervision (including Rule 5.3) has pushed firms to formalize AI oversight and carriers now expect to see that formalization in writing.
Hallucinated citations, inadvertent data leakage into public AI tools and unreviewed AI-drafted work have turned AI from a theoretical risk into an actual loss driver.
When underwriters probe your firm’s AI exposure, they are less interested in brand names than in how AI is used, who oversees it and what data it touches. On a typical cyber insurance AI questionnaire for law firm, carriers use questions cluster around five themes: use cases, oversight, data, client disclosure and governance. These are the core questions every carrier is asking:
Scroll horizontally to view all columns.
| Questions | What it covers |
| How is AI being used? | Research, drafting, document review, client intake, administrative tasks, client-facing advice or decision support |
| Is there human oversight? | Who reviews AI output, which tasks require review, whether that review is documented |
| What data is being input? | Confidential or privileged information, PII, case documents; public vs. enterprise-grade tools; whether vendors retain or train on submitted data |
| Are clients informed? | Whether AI use is disclosed in engagement letters or otherwise communicated to clients |
| Are there internal AI policies? | Written usage policy, approved/prohibited tools, training and who owns AI oversight |
Knowing the questions carriers ask is only half the equation. How you frame your answers can determine whether the carrier needs to ask follow-up questions about your AI practices. Vague reassurances and undocumented processes may invite additional scrutiny or questions about your controls. The principle behind all five steps is simple: carriers aren't just asking whether your firm uses AI responsibly, they want to know whether you can demonstrate how that responsibility works in practice.
1. Inventory first, narrative second
Build your answer from an actual list of tools, users, matter types and data classes touched, not from memory. On usage specifically, separate administrative use (billing, sorting) from substantive use (drafting, research, client advice). Carriers weigh these very differently and conflating them is a common misstep.
2. Map each use case to a risk level
Internal summarization is low risk; drafting is medium; client-facing advice or court-bound work is high risk. Naming this distinction in your answer shows the carrier you already think in these terms.
3. Show governance, not just intent
"We're careful" isn't underwritable. Point to the policy, training and approval steps that make you careful including a written AI Acceptable Use Policy, which functions as your first line of defense in underwriting. Undocumented usage is treated as unmanaged risk, regardless of intent.
4. Prove oversight with artifacts
On the oversight question, describe the workflow, not a habit. A human-in-the-loop process where review is a required step, not an assumption, is what carriers are confirming. Reference logs, version history or sign-offs where relevant, without over-detailing.
5. Tie AI to your existing cyber baseline
On data handling, state plainly whether staff use public platforms (e.g., ChatGPT) or enterprise tools with contractual data protections (e.g., Harvey, CoCounsel); this distinction alone often changes how an answer is scored. Frame AI overall as one more managed layer sitting on top of MFA, EDR, backups and training, not a standalone, unmanaged risk.
Legal malpractice carriers including ALPS are now adding AI‑specific questions at renewal and in some cases, treating AI‑related claims as uncertain, unless firms can show controlled, supervised use. If your firm says AI use is approved, supervised and documented for one carrier, its actual practices should support the same description elsewhere.
The goal isn't to create a separate AI program for each insurer. It's to have controls that accurately reflect how the firm actually uses AI. If you can answer these five points clearly, you’ll reassure both your malpractice and cyber carriers that AI use is governed and auditable. Use this as a compact template for an ALPS questionnaire AI tools answer:
Under ABA Formal Opinion 512, generative AI tools are treated as "nonlawyer assistance" for purposes of Rule 5.3; the same supervisory duty that applies to paralegals and contract staff now extends to AI output. That's not a loose analogy carriers are drawing; it's the ABA's own framing and it's exactly why underwriters ask about oversight the way they do: supervision is the standard and evidence of supervision is what proves it.
An AI audit log turns that duty into something a carrier can actually see. At minimum, it should capture:
None of this requires new software, a shared log or version history with sign-offs is enough, provided it's consistent.
For underwriting purposes, treat the log as evidence, not paperwork. When a carrier's AI insurance questions turn to oversight, a maintained audit trail is the difference between asserting supervision and demonstrating it and it's usually the single strongest artifact a firm can point to on the application.
When your next cyber insurance renewal comes around, you don't want to start gathering AI information from scratch. Prepare a simple evidence pack covering your firm's AI tools, approved uses, data controls, training, and review procedures. Having these materials ready makes it easier to answer AI insurance questions accurately and consistentlywhile giving your broker and carrier a clearer picture of how your firm manages AI-related risk.
Have these items ready:
Each example below addresses a question carriers are really asking by showing the wrong turn first. Avoiding these mistakes can help prevent unnecessary follow-up questions and give underwriters a clearer picture of your firm's AI controls. Even well-run firms lose ground on AI insurance questions by making one of these avoidable missteps:
Scroll horizontally to view all columns.
| Claiming AI use with no policy behind it | Invites a follow-up request before the application even moves forward. |
| Letting confidential data reach public AI tools without vendor terms | Treated as an unmanaged data exposure, not a minor gap. |
| Answering oversight questions with "we double-check everything" | Read as unverifiable, which pushes carriers toward more conservative terms. |
| Assuming silence on AI in the policy means it's covered | A false sense of security that surfaces at claim time, not renewal. |
| Disclosing AI use inconsistently across applications | Flagged as a credibility issue, separate from the underlying risk itself. |
The firms that handle this best aren't the ones using the least AI, they're the ones that can prove their use is controlled. Every carrier question, from usage to governance, really asks the same thing: can you demonstrate oversight? Firms that treat this as an ongoing habit, not a renewal-season scramble, get cleaner underwriting outcomes. One point worth noting: firms running custom or in-house AI tools face closer scrutiny, since there's no vendor's data terms to point to, only the firm's own documentation.
That's really what this shift is about: carriers now expect the same proof of supervision that bar associations already require, not just an intention to supervise. Worth asking before your next renewal: if your carrier asked for an AI audit log today, could you produce one or would you be building it under deadline pressure?
Cyber insurance carriers may ask how a law firm uses AI, what data is entered into AI tools, who reviews AI-generated work, whether clients are informed, and what policies govern AI use.
A law firm should answer AI insurance questions accurately and specifically. Identify the AI tools and use cases, explain human oversight, describe data protections, and point to relevant policies and procedures.
It can. The level of risk depends on factors such as the type of AI being used, what information enters the system, whether confidential data is involved, and how effectively the firm supervises and secures AI use.
Before completing the questionnaire, a firm should have an inventory of its AI tools and use cases, its AI policy, employee training records, data-handling requirements, vendor information, and procedures for reviewing AI-generated work.
Vague answers, unknown AI usage, unrestricted employee access to public AI tools, confidential information being entered without appropriate controls, and claims about policies or oversight that cannot be documented can all prompt additional questions from a carrier.
Tell me about the system or workflow you are working on.
30-minute intro call on Calendly
