Through 2025 a quiet shift happened in the Lloyd's cyber and Tech E&O markets. Submissions began asking questions about AI agents specifically. By Q1 2026 most major specialist syndicates included AI risk in their underwriting workflow as a distinct line. Firms that cannot answer those questions defensibly are seeing premium loadings of 5–15% — or full exclusions on AI-related incidents.
What the new submission questions look like.
A composite of submissions seen across Beazley, CFC, Hiscox, Tokio Marine Kiln, MS Amlin and AXA XL through 2025–2026 includes the following questions on AI:
- What AI / agent systems do you operate in production? Provide an inventory.
- For each, what is the intended business purpose and the human-review threshold?
- What logging captures the activity of each system? Provide a sample record.
- What is your retention period for that logging, and what is the verification process?
- Have you experienced any AI-related incident in the last 24 months? If yes, describe response and resolution.
- What is your governance framework — written policy, named owners, review cadence?
- Are you in scope of the EU AI Act? If yes, what is your readiness position for the August 2026 deadline?
What underwriters actually do with the answers.
Cyber and Tech E&O underwriting at Lloyd's combines actuarial loss data with risk-engineering review. AI logging questions feed both:
- The actuarial side uses the AI inventory and incident history to score exposure. Higher exposure → higher loading.
- The risk-engineering side assesses controls. A defensible logging methodology + evidence of operational review reduces loading.
- The claims side assesses defensibility. If a claim arises, can the insured reconstruct the relevant agent actions for the carrier's investigators? If yes, the claim is more straightforwardly payable. If no, the carrier may dispute.
What "good" looks like to an underwriter.
From conversations with risk engineers at specialty cyber brokers (Lockton, Marsh, Howden, BMS, McGill & Partners), the qualitative signals that move loading downward are:
- Per-action logging (not just per-session or per-service)
- Cryptographic integrity that the insurer can independently verify
- Defined retention period — meaningfully longer than the policy term
- Documented incident response procedure, tested within the last year
- Named compliance owner in the AI governance framework
- EU AI Act Article 12 readiness if in scope
What it looks like when a claim happens.
In an AI-related claim under a cyber or E&O policy, the carrier's claims handler will typically request the following within 14 days of notification:
- Time-bounded log of all relevant agent activity, with integrity proof
- Evidence of the policy, decision threshold, or process the agent was applying at the time of the incident
- The model versions, tool inventory, and configuration in force
- The identity of the data subject(s) affected and the data classes touched
- Internal incident response actions taken
The first four of these are what Agent Audit's insurance claim pack assembles from your receipts in one click. The fifth is on you — but having the receipts on hand to feed your incident response process meaningfully shortens the response cycle.
What to do before your next renewal.
- Talk to your broker now — most accept submission revisions if the new evidence is materially better than what was previously filed.
- Inventory your AI systems honestly, including the ones that have crept into production without governance review.
- Assess your current logging against the seven submission questions above. Be honest about the gaps.
- Where you can answer "we have automatic agent logging with cryptographic integrity and a defined retention period" — attach the evidence pack. Don't just say it.