Cyber insurance questionnaire: the AI questions, answered

The renewal pack from your broker, or a security questionnaire from a client, now carries a line about artificial intelligence. Whatever you write goes into a document someone senior signs, and the form gives no hint of a good answer. I’d give that AI line the same care as the claims history.

In September 2026 we opened seven insurance application and renewal forms and read every question. Two asked about AI, and both asked for a written description. That description grows out of an AI acceptable use policy, so most of this page is about turning one into the other.

The question bank below is the part to take away: ten questions quoted from forms and published question sets, each with a model answer and the evidence behind it.

Copy it, change every answer so that it describes what your organisation actually does, and keep it with the form. Most of the evidence it asks for comes from one document, and the policy template is where that document starts.

If you are here because somebody already sent a file to a chat window, that is a different question with a different clock.

AI QUESTIONS ON INSURANCE AND CLIENT QUESTIONNAIRES
A bank of real questions, a model answer and the evidence to attach.
Every question below is quoted from a form or a published question set.
Edit each answer so that it matches what your organisation actually does.

 1. "Allow the use of Artificial Intelligence software to draft documents.
    If checked, please attach description."
    AmTrust, Lawyers Professional Liability Application, LPLPRO-APP-01 0523, Section III.
    Say: yes, if anyone drafts with an AI tool, including the one inside your
    office suite. Attach: the written AI policy and the list of approved tools.

 2. "Does the firm allow for the use of Artificial Intelligence software to
    draft documents? If Yes, please describe."
    AmTrust, Lawyers Professional Liability Renewal Application, LPLPRO-APP-02 0523, 11.b.
    Say: what is allowed, what is forbidden, on which accounts, and since when.
    Attach: the policy, dated, and the signed acknowledgements.

 3. "Do you have an AI Governance Framework with Board/Management oversight,
    which includes specific use cases, restrictions and authorization policies?"
    Aon, AI Fact Sheet 2026, sample of application questions carriers are developing.
    Say: name the document, its date, who approved it, where staff can read it.
    Attach: the policy and the register of approved use cases.

 4. "Is the Insured developing and providing Generative AI solutions to
    customers, or is the use for internal purposes only?"
    Aon, AI Fact Sheet 2026.
    Say: internal only, if you do not sell or embed an AI feature. If a client
    facing tool drafts or scores anything, say so. Attach: the use case register.

 5. "Does a human need to verify accuracy before AI takes action?"
    Aon, AI Fact Sheet 2026.
    Say: yes, and name the step. No AI output leaves the firm unreviewed.
    Attach: the clause of the policy that says it, by number.

 6. "Are AI actions logged so potential errors can be reviewed and remediated?"
    Aon, AI Fact Sheet 2026.
    Say: what is logged and where. If your only record is the account history
    of the tool, say that. Attach: nothing you cannot produce on request.

 7. "Are you confirming whether any key vendors are utilizing AI, and if so,
    what safeguards are in place to prevent errors or bias?"
    Aon, AI Fact Sheet 2026.
    Say: which suppliers you asked, when, and what they answered. Attach: the
    replies. If you have not asked yet, say so and give a date.

 8. "Who owns and has what rights to use the prompts (inputs) and outputs?
    Are the prompts and outputs subject to confidentiality obligations?"
    Aon, AI Fact Sheet 2026, contracting questions.
    Say: quote your supplier terms, do not summarise them. Attach: the clause.

 9. "Are the policies and procedures on the acceptable use of AI technologies
    within the organization established, documented, and communicated to all
    personnel?"
    Cloud Security Alliance, AI-CAIQ v1.0.2, 15 October 2025.
    Say: yes only if all three are true. Attach: policy, date, acknowledgements.

10. "Are data inventories created and maintained at least for any sensitive,
    regulated, and personal data?"
    Cloud Security Alliance, AI-CAIQ v1.0.2, 15 October 2025.
    Say: what categories you hold and where. A short list beats a claim.
    Attach: the annex of your policy that names the data that never goes in.

BEFORE YOU SIGN
Read the declaration on the form itself. One asks you to confirm a fair
presentation of the risk. Another states that the application is attached to
and made part of the policy. A third states that underwriters rely on every
statement made. The answers above are worth writing carefully for that reason.

What a cyber insurance questionnaire actually asks about AI

On the forms themselves, very little. Five of the seven are cyber forms: Beazley’s, three regional Chubb versions and a US agency’s questionnaire. On 10 November 2026 we searched all seven again for “artificial intelligence”, “machine learning” and “generative”. The five cyber forms still contain none of them.

What they ask instead is predictable: multifactor authentication, backups, awareness training, prior claims. Beazley’s short form for applicants with revenue below £20M even says good answers to its optional control questions “may discount the base premium offered by up to 20%”. AI sits outside that list, for now.

I don’t read that silence as permission. Beazley also asks whether you know of any incident that may give rise to a claim, and a client file pasted into a chatbot could be just the kind of circumstance that line asks about, even though nobody typed the letters AI.

Does your firm use AI to draft documents? How the lawyers’ forms put it

AmTrust’s new-business application, form LPLPRO-APP-01 0523, puts AI last in a tick list under Section III, Internal procedures, below engagement letters, docket controls and conflict checks. The renewal form, LPLPRO-APP-02 0523, makes it question 11.b, straight after 11.a on changes to docket and conflict procedures in the past twelve months.

Both versions want prose. The declaration then says the application and all other materials submitted to the insurer “are incorporated in and constitute a part of the policy, if issued”. On that wording, the page you attach is one of those materials, not a covering note.

That makes me strict about tone. Fewer adjectives, more dates: which tools, which accounts, who checks the output, since when. If the page lists data that never goes into a prompt, build that list from the personal details worth keeping out of AI rather than from memory.

AI on a cyber application form that never mentions it

A form without an AI question still reaches AI use, because a chatbot account is a cloud service handling your data. Chubb’s Singapore proposal form asks whether you outsource the processing of personal data to processors, whether written contracts exist with them, and whether you audit technology suppliers against your own security requirements.

Read that way, a firm pasting client details into free consumer chatbots has an awkward answer to give on a form that never says AI. The same firm on business accounts with a signed data processing agreement has an easy one. I find that a more useful test than any box labelled artificial intelligence.

Chubb’s Canadian renewal form adds a quieter hook: you may be asked for a copy of your in-house corporate privacy policy. If yours says nothing about what chatbot providers do with what staff type, that copy will show the gap before any AI question does.

The AI security questionnaire a client sends: CSA’s AI-CAIQ

For many small firms the first AI questionnaire comes from a client, not an insurer. The common template is the Cloud Security Alliance’s AI-CAIQ, which downloads without an account. The AI Controls Matrix behind it reached version 1.1 on 14 July 2026, with 247 control objectives in 18 domains and 320 questions.

Most of those 320 were written for whoever builds or hosts a model; there is a whole domain on model security. A firm that only uses AI tools answers a fraction in substance and marks the rest not applicable. I’m wary of a returned sheet with no N/A anywhere; it reads as unread.

Questions 9 and 10 in the bank come from this questionnaire, and they are the two that apply to almost everyone. When the client sells into Europe, whether the EU AI Act reaches a firm outside the EU can explain why the sheet arrived this year.

Different insurer, different wording: one map for any country

Insurers write their own forms, and the wording shifts by country and line of business. The topics shift much less. NIST’s Cybersecurity Framework 2.0, published on 26 February 2024 for organisations of all sizes and sectors, gives neutral labels that any form’s questions can be sorted under.

Govern covers policy, oversight and supply chain risk. Protect covers training and data security. Identify covers assets, including data. Sort the ten bank questions that way and three documents answer nearly all of them: the policy, the acknowledgements and the supplier file. For a firm of five to fifty, I’d stop there.

The UK’s NCSC makes a related point: buying cover “might require providing information about your security controls”, and an insurer’s minimum shouldn’t become your ceiling. The same logic applies when you assess a supplier like us, which is why Nonimo’s security page exists as a separate document.

Data loss prevention and upload blocking: what to write if you have neither

Chubb’s Singapore form asks whether you have implemented “Enterprise or Integrated Data Loss Prevention (DLP) tools” and, if so, whether they run in blocking mode or alert mode only. A rule in a policy document is neither. I’d rather sign a plain no than a yes that turns out to mean a PDF.

If you have no DLP, say no, then list what you do have: business accounts, a dated rule, acknowledgements, a review step. Taking identifiers out before text reaches a model is a separate control again. It is minimisation rather than blocking, and how you label the cleaned text matters to whoever scores the answer.

Nonimo’s browser extension, which IT pushes to every Chrome and Edge browser by policy, redacts identifiers in the AI tools before anything is sent. That supports a minimisation answer. It is not DLP, and nobody should describe it as DLP on a form.

Fair presentation and the duty to disclose: what you sign at the end

Every form we opened ends in a declaration, and that wording is why a dull, accurate answer beats a polished one. Beazley asks you to confirm a fair presentation of the risk under the Insurance Act 2015, the UK statute whose section 3 makes that a duty before any contract is entered into.

Chubb’s Singapore form opens with a statement under section 25(5) of Singapore’s Insurance Act: disclose “fully and faithfully”, it says, “otherwise the policy issued hereunder may be void”. Chubb’s Canadian form says underwriters rely on all statements. The laws differ; I wouldn’t expect a careless AI answer to fare well under any of them.

The signer rarely knows which tools the team opened this week. I’d hand them the completed bank and attachments a few days early, with the adapted AI policy on top. None of this is advice on your own policy wording; read that with your broker or a lawyer.

Five working days before the form goes back

The forms will change; the paperwork behind a good answer won’t. Write the description once, date it, and reuse it for every questionnaire after. To my mind it is also the easiest part to leave until the night before, and our other guides on AI and client data fill in the rest.

For the minimisation questions, Nonimo takes names and account numbers out of the text before an AI tool reads it, which gives the answer something concrete to point at. Governance, supplier checks and sign-off stay on paper, and they are still the firm’s to write.

Sources

• AmTrust, Lawyers Professional Liability Application (PDF), LPLPRO-APP-01 0523. Section III AI checkbox; declaration incorporating all materials into the policy.
• AmTrust, Lawyers Professional Liability Renewal Application (PDF), LPLPRO-APP-02 0523. Questions 11.a and 11.b.
• Beazley, Cyber Insurance Questionnaire, revenues lower than £20M (PDF). Controls asked, the 20% premium discount, the fair presentation declaration.
• Chubb, Cyber Enterprise Risk Management Proposal Form, Singapore (PDF). Duty of disclosure, DLP modes, data processors, vendor assessment.
• Chubb, Privacy Protection Renewal Application Form, Canada (Word). Reliance on statements, privacy policy request, required signatories.
• Cloud Security Alliance, AI-CAIQ. Download without an account.
• Cloud Security Alliance, AI Controls Matrix v1.1, 14 July 2026. 247 control objectives, 18 domains, 320 questions.
• NIST, The NIST Cybersecurity Framework (CSF) 2.0 (PDF), 26 February 2024. Functions, categories and identifiers.
• NCSC, Cyber insurance guidance. Insurers may ask about your security controls.
• UK Insurance Act 2015, s. 3. The insured must present the risk fairly before the contract is entered into.

Accessed 10 November 2026.