Insurers are in the predictability business. Artificial intelligence is an unpredictable technology. For CFOs and CISOs and their cyber insurance partners, that uncomfortable juxtaposition is becoming harder to ignore as enterprises move from generative AI that produces content toward agentic AI systems that can make decisions, communicate with counterparties, manipulate software and eventually initiate financial actions.
Every additional degree of autonomy potentially creates another liability question. It also creates a harder insurance problem. Unlike the familiar risk of one employee, application or company making a mistake, the same foundation model and infrastructure can sit underneath thousands of businesses simultaneously. A defect or vulnerability upstream could therefore generate losses across many supposedly independent policyholders at once.
And the greater the autonomy, the harder an old risk-management question becomes: Who absorbs the loss when the machine gets it wrong?
Read more: Quantum, Crypto and AI Are Repricing the Enterprise Cybersecurity Budget
AI Brings New Risks Insurers Can’t Diversify Away
Insurance fundamentally depends on pooling risks that are sufficiently independent. Thousands of houses can be insured partly because they are unlikely to burn down simultaneously. AI, however, does not fit within a relatively recognizable category.
Thousands of businesses may appear to represent separate risks while relying on the same foundation model, cloud infrastructure, agent framework or software dependency. A RAND study published Wednesday (Sept. 16) flagged that the commercial insurance market is only beginning to work through that problem.
A malfunctioning agent could create a professional-liability claim in one situation, a cyber loss in another and potentially a directors-and-officers issue if management’s deployment or oversight becomes part of litigation.The enterprise problem is therefore not simply whether an organization “has AI insurance.” It is whether the collection of policies protecting its balance sheet still works once software begins exercising authority previously delegated to employees.
A PYMNTS Intelligence report, “How Agentic AI Went From Zero to CFO Test Runs in 90 Days,” found in September 2025 that nearly 7% of enterprise CFOs in the United States had deployed agentic AI in live finance workflows, while an additional 5% were running pilots.
Artificial intelligence doesn’t just create compliance work, it creates an entirely new layer of enterprise operating costs centered on governance. In a recent PYMNTS eBook, executives from Visa, FIS, Synchrony, WEX, Billtrust, i2c, Thales, Velera, Bottomline and other industry leaders describe what they are learning as AI agents move from demonstrations into real operating environments.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
See also: The New Cyber Math for CFOs: One Attack, Hundreds of Disclosures
Insurance Could Become AI’s Private Regulator
The inability for insurers, currently, to backstop many of the risks of enterprise AI may counterintuitively give those same insurers an unexpectedly powerful role in determining what enterprise AI looks like.
Banks do not wait for buildings to burn down before asking whether they are insured. Boards, lenders, procurement departments and counterparties routinely require organizations to demonstrate adequate coverage before assuming particular risks. Companies seeking coverage may increasingly need to demonstrate how models are tested, what systems agents can access, what transactions they can execute, whether humans approve consequential actions, how incidents are monitored and whether an agent’s actions can be reconstructed afterward.
An enterprise may technically be able to let an agent autonomously move $10 million, modify production code or negotiate contracts. Its insurer may simply decline to cover that configuration without additional controls.The practical ceiling on autonomy would then be set not by what artificial intelligence can do, but by what risk markets will finance.
The PYMNTS Intelligence report “Scale Amplification: How Revenue Amplifies Agent-Driven Identity,” showed that large enterprises, with their larger digital footprints, can be more susceptible to the AI-powered spoofing of identity documents due to the industrialization of deepfakes and automated data scraping capabilities.
Technology companies are largely competing on capability: whose agents can reason longer, use more tools and perform more work without human intervention. Corporate buyers eventually have to compete on something else: how much of that autonomy they can responsibly put into production.
The gap between those two curves may prove substantial.
“There are existing bodies of law that, while not passed or promulgated for the reason of AI, are still applicable to AI solutions,” Alaap Shah, member of the firm at Epstein Becker Green, told Competition Policy International, a PYMNTS company, in an interview this month, adding that the question for firms is not simply whether an AI-specific law applies but whether the system creates risks covered by older legal obligations.
For all PYMNTS B2B coverage, subscribe to the daily B2B newsletter.
Add as Preferred Source
