AI insurance a substantial growth opportunity as law firms face growing coverage gaps

The rapid adoption of artificial intelligence by US law firms is creating increasingly complex exposures that existing insurance policies may not adequately address. But the same risks could provide insurers with an opportunity to develop a substantial new market for affirmative AI coverage, according to Mark Bennett, founder and chief executive of AI Risk Management (ARM).

Bennett, a practising lawyer and entrepreneur with a background in environmental liability, believes insurers have an opportunity to move beyond exclusions and develop products that recognise the very different risks presented by organisations using AI.

However, he warns that the speed of technological change, inconsistent governance and the difficulty of assessing individual firms' exposures are creating significant challenges for both insurers and their clients.

“Adoption is outpacing the systems and policies needed to govern it,” Bennett told Intelligent Insurer ahead of a keynote presentation he will deliver at Underwriting Innovation 2026 called Are We Covered? Measuring, Managing and Insuring Law Firm AI Risk. “The commercial pressure is substantial: clients want a share of the AI dividend, the efficiency and cost savings AI delivers, often through flat fees and discounts.”

Lawyers are gaining access to an expanding range of sophisticated AI tools, often without sufficient time to evaluate their suitability or fully understand the implications of using them. Meanwhile, the policies, training, supervision and oversight needed to manage these technologies take considerably longer to establish.

“Without sustained attention, reliance on AI can create a false sense of security and erode human oversight,” Bennett warned.

For insurers, this raises questions about whether traditional approaches to underwriting law firms remain adequate. Rather than simply establishing whether an organisation uses AI, underwriters increasingly need to understand precisely how the technology is deployed, which systems are involved and whether appropriate controls are operating effectively.

“For insurers, the question is whether a Firm knows where AI enters its work and can show how it controls and documents that use,” Bennett said. “A written policy is a starting point. The underwriting value lies in evidence that the policy is enforced, outputs are checked and problems are identified and corrected.”

Similar firms, different risks

One of Bennett’s central arguments is that AI could fundamentally change how insurers differentiate between law firms. Historically, underwriting assessments have considered factors such as revenue, headcount, areas of legal practice and claims experience. AI introduces additional variables that may not be apparent from these traditional measures.

“Two firms with similar revenue and headcount may use AI in materially different ways and practice in different jurisdictions, where AI enforcement varies,” he explained. “Traditional underwriting already recognizes practice area risk differentials; AI adds further factors as adoption, regulation and professional obligations evolve focused to varying degrees on different practice areas.”

For example, one firm might restrict AI to approved applications, protect confidential client information and require lawyers to verify AI-generated legal research. Another might allow widespread adoption without knowing which tools employees are using or whether their outputs are being checked.

The implications can be particularly significant in litigation, where inaccurate or fabricated legal citations could result in court sanctions, professional disciplinary action and malpractice claims.

Vendor selection is another important consideration, as is the possibility that different practice groups within the same firm may independently purchase and use AI technologies. Bennett warned that this can fragment oversight and create inconsistent approaches to training, data governance and accountability.

The development of bespoke AI systems by law firms adds further complexity, raising questions about intellectual property, testing, technical expertise and responsibility when something goes wrong.

For underwriters, the challenge is translating these differences into reliable information that can inform pricing and coverage decisions.

“These differences must be translated into consistent, verifiable information that carriers can evaluate,” Bennett said. “Over time, claims experience will show which indicators are predictive and how much weight they deserve in pricing and terms.”

A widening protection gap

Bennett believes existing insurance arrangements are already struggling to keep pace with the risks created by AI adoption. “Gaps already exist because current coverage is largely silent on AI,” he said. “Firms and carriers may lack a shared understanding of the exposure.”

Although AI is frequently discussed alongside cyber insurance, Bennett argues that many of its exposures are fundamentally different. Cyber losses typically involve external attacks, sometimes enabled by internal weaknesses. AI-related losses, by contrast, may arise from everyday professional decisions, human error, unverified information, unauthorised technology use or failures to meet client disclosure obligations.

These exposures can potentially affect several insurance classes, including lawyers’ professional liability, cyber, commercial general liability, intellectual property, directors’ and officers’ liability and employment practices liability.

“If exclusions expand while Firms assume their existing insurance will respond, the gap will widen,” Bennett warned.

Even where coverage is technically available, restrictive sublimits may leave firms with significantly less protection than they expect. “Low AI sublimits create challenges and can operate as ‘virtual exclusions,’” he said.

The situation is complicated further by an evolving regulatory environment in the US, where state and local requirements can differ significantly, creating additional uncertainty for firms operating across multiple jurisdictions.

Bennett believes firms, brokers and insurers should work together to examine realistic loss scenarios, establish which exposures are covered and identify where additional protection may be required.

With relatively little AI-specific claims experience available, underwriting models will initially need to draw on verifiable internal and external information, before being refined as loss data develops.

Lessons from environmental liability

Bennett sees striking parallels between the emerging AI insurance market and the development of environmental liability insurance several decades ago. His perspective is informed by his experience in the environmental risk sector, including co-founding Environmental Data Resources (EDR), a business established to provide environmental risk information.

In the late 1980s, he witnessed how concerns about contamination and Superfund liability transformed the way banks assessed property-related risks. Pollution exclusions effectively removed much of the available insurance protection, while lenders increasingly required environmental due diligence before financing transactions.

“Banks responded by making environmental due diligence part of lending, becoming a practical enforcement mechanism for environmental risk management,” Bennett recalled. 

“Insurers could play a comparable role in AI by requiring evidence of verified controls.”

However, he believes the insurance industry’s initial response to environmental liability offers a cautionary lesson. “Early on, insurers largely relied on pollution exclusions rather than developing environmental liability coverage,” he said.

By the time environmental liability products became more widely available in the mid-1990s, the banking and real estate industries had already developed alternative approaches to managing their exposures.

“When carriers introduced environmental liability insurance in the mid-1990s, it was largely too little, too late: policies required costly, onerous underwriting and significant retentions, and they never achieved the adoption that earlier involvement might have produced.”

Bennett believes insurers have an opportunity to avoid repeating that experience with AI. Nevertheless, he acknowledges that AI presents additional complications, particularly because the technology evolves rapidly and multiple insured organisations may depend on the same vendors or models.

That creates the potential for correlated losses across an insurer’s portfolio, rather than exposures confined to individual businesses or locations. “AI risk is significantly more complicated than environmental risk in several respects,” he said. “The opportunity is for insurance industry leadership to turn underwriting questions and emerging policy approaches into useful coverage, supported by better assessment methods, Firm governance, data management and controls.”

Exclusions to a new market

Despite these challenges, Bennett is optimistic about the commercial potential for insurers willing to develop a more sophisticated understanding of AI exposures.

“There is a credible and emerging opportunity for a substantial market, through clearer coverage in existing policies and new products for defined AI exposures,” he said. “These could be standalone AI policies or coverage coordinated with existing insurance, potentially through an umbrella structure.”

The key, he believes, is developing sufficient underwriting confidence to distinguish between organisations that manage AI responsibly and those whose exposures remain poorly understood.

“Insurers need greater confidence in what they are underwriting: the vendors and models involved, any bespoke systems in use, the potential magnitude of losses, the controls in place and the possibility of correlated claims across a portfolio,” he said.

That requires more than simply collecting information about which AI products a firm has purchased. Underwriters need evidence of how those products are being used, whether staff are appropriately trained, how outputs are verified and how potential failures are identified and addressed.

Insurers must also consider how risks could accumulate across portfolios, particularly where multiple insureds depend on the same technology providers.

Bennett believes clearer information could support more appropriate allocation of risk between insurers and policyholders, potentially allowing well-managed firms to secure broader coverage and more favourable terms.

But he emphasises that the development of credible pricing will ultimately require actuarial analysis and actual claims experience. His company, ARM, is developing AI risk intelligence and underwriting tools intended to help law firms, insurers and brokers assess these exposures more consistently.

Bennett argues that better information could create incentives for law firms to strengthen their governance while giving insurers greater confidence to offer affirmative coverage. It could also support a more constructive relationship between insurers and insureds, with underwriting becoming a mechanism for improving risk management rather than simply restricting protection.

A different underwriting conversation

Bennett will explore these issues at Underwriting Innovation 2026, where his keynote, Are We Covered? Measuring, Managing and Insuring Law Firm AI Risk, will include a dramatised law firm case study.

His central message is that insurers need to change the questions they ask. “I want delegates to move from asking, ‘Does this Firm use AI?’ to asking, ‘How does this Firm use AI, and what evidence shows it has identified and manages the risk?’”

That distinction, he believes, could ultimately determine whether AI becomes another source of uncertainty and exclusions or develops into a meaningful new insurance market.

“That shift opens more useful underwriting conversations,” he said. “It helps carriers distinguish firms, gives brokers a clearer basis for discussing coverage and gives firms practical reasons to improve their controls. Better evidence of risk management supports broader coverage, appropriate limits and better premiums.”

Mark Bennett is the founder and chief executive of AI Risk Management (ARM).

He can be reached at mark@armscore.com

Did you get value from this story?  Sign up to our free daily newsletters and get stories like this sent straight to your inbox.