Skim time: 8 minutes · Listening time: 6 minutes. Prefer to listen? Flip reads this week’s Brief here.

---

Earnings season is basically over for our corner of the market, and AI came up on almost every call.

Mostly as a way to save money.

Of 28 public insurers and brokers, 21 talked about AI as a tool. Three talked about AI exclusions, and only because an analyst asked. On the financial institution renewals we’re placing, we haven’t seen AI-specific exclusions. Not yet.

That’s the half management loves to tell. The other half is risk: the policies we buy (and, for carriers, write), the vendors we lean on, and now AI agents shopping on our customers’ behalf.

EverQuote’s new white paper calls those agents “barbarians at the carriers’ gates.” Having read how they actually shop, I’d call them the most polite barbarians in history. They fill out your quote form, take the price and move on to the next gate. In EverQuote’s own test, one knocked on 24 carriers’ gates and came back with five real quotes. Not exactly the sack of Rome.

So this week is about both sides of the balance sheet: what AI saves you, what it puts on the books whether you planned for it or not, and who’s guarding the gate!

• The Earnings Roundup. What 28 insurers and brokers told analysts about AI, and what they left out.
• The record. New York spelled out what it expects your cyber risk assessment to show.
• The gate. AI agents are already filling out carriers’ quote forms. Somebody has to decide who gets in.

---

Earnings Roundup: 21 calls talked AI tools, three talked exclusions

On this quarter’s earnings calls, AI was mostly something insurers use, not something they insure.

Between October 15 and 29, 23 U.S. insurers and five brokers held third-quarter calls. 21 described AI as a tool, seven of them also as a risk they insure or place. One spoke of it only as a risk, and six never mentioned it. Three discussed AI exclusions, two carriers and a large broker, each answering an analyst.

The tool side came with numbers. The Hartford said 78% of its small business submissions are now “bindable straight through.” Kinsale uses more than 100 AI agents and skills to process submissions. Employers Holdings expects a claims tool to free up more than 50,000 hours over three years.

The risk side was thinner, and it split. Chubb’s Evan Greenberg called AI liability “a growing and emerging exposure that is not contemplated in casualty underwriting really to date.” He expects clearer wording, eventually exclusions, and pricing that tells one risk from another. W. R. Berkley already applies AI exclusion language where it sees fit. A large broker warned that broad exclusions would leave gaps. And AXIS, citing “a risk landscape that has been escalated by AI,” is pulling back from much of the cyber it writes through MGAs (managing general agents, which underwrite on a carrier’s paper).

Twenty-one companies talked about what AI does for their costs. Three got to what it does to policy wording.

(sources: Q3 2026 earnings call transcripts, October 15 to 29, 2026, via The Motley Fool and earningscalls.dev: Chubb (Oct. 21), W. R. Berkley (Oct. 19), AXIS Capital (Oct. 29), The Hartford (Oct. 27), Kinsale Capital (Oct. 23), Employers Holdings (Oct. 29); LION review of 28 transcripts)

So what?

Most boards are hearing one side of the AI story.

Start with your renewal, where the news is better. As of late October 2026, the financial institution renewals we’re placing haven’t carried AI-specific exclusions on D&O (directors and officers), E&O (errors and omissions), ICPL (insurance company professional liability) or cyber. That’s our book, not the whole market, and older exclusions can still reach an AI claim. Two weeks ago we tracked new ones moving through form filings. The calls suggest the quiet won’t last.

So use it. Ask that work done with AI tools, quotes and binds included, counts as professional services under your E&O and ICPL, and that your D&O’s professional services exclusion doesn’t push the claim out of both. Check every excess layer. And watch what executives say about AI in public. Overstated, it can become a claim against the board.

If you’re a carrier, picture a regional mutual whose AI claims tool turns a denial into a bad-faith suit. It would look to its ICPL and any ECO/XPL cover (bad-faith damages, over-limit judgments), subject to the wording and state limits on insuring punitive damages. Is one flaw across thousands of files one claim or many? One claim means one retention, but one shared limit. And if your treaties add AI exclusions your own forms lack, the gap lands in your net retention.

If you’re an MGA, reread the AXIS line. When a carrier exits, you keep the run-off, the final audit and any fight over whether past binds stayed within authority. Binding without an AI exclusion your carrier has required can be outside your authority, so ask whether your E&O covers claims by your own carriers. And ask your capacity provider now whether your program is inside that pullback.

Ask your board: Does management’s AI reporting cover the new liabilities as well as the savings, including what our own policies now say about AI?

In New York, even the tool side now needs a paper trail.

---

New York just told you what it expects your cyber risk assessment to show

New York’s financial regulator has spelled out what a cyber risk assessment should show: what it decided, not just what it found.

On September 10, the New York Department of Financial Services (DFS) wrote to every firm it regulates. The subject: the risk assessment its cyber rule, Part 500, requires. It “does not create new obligations,” but expect examiners to read against it. DFS expects each firm to show how the assessment “informed” its controls and its “risk acceptance decisions.” DFS oversees more than 3,100 financial firms, and the model law 28 other jurisdictions use was built on its rule.

Each risk ties to a control, or to a written decision to accept it, in a risk register. Vendors and AI are in scope, down to critical functions sharing one provider. And risks should be documented before they are “mitigated, transferred, or accepted.” Insurance is the transfer.

In August, DFS fined Order Express, a small money transmitter, $250,000. Ransomware had encrypted just over half its servers. Its assessment missed its own risks and never tested its controls, and being small didn’t excuse it. Orders against Metromile and Infinity last year cited the same rule. Part 500 also wants a tested recovery plan, protected backups and notice within 24 hours of any ransom paid.

Order Express also agreed it would not seek reimbursement of the fine from any insurance policy.

(sources: DFS industry letter, “Cybersecurity Risk Assessments”, September 10, 2026, and press release; In the Matter of Order Express, Inc., DFS consent order, August 2026; 23 NYCRR Part 500, §§ 500.9, 500.16, 500.17, 500.19; DFS 2025 Annual Report; DFS press release on eight auto insurers, October 14, 2025, and the Metromile and Infinity consent orders)

The LION Lens

Most of what DFS wants has a match in your insurance program. Line them up before renewal:

What DFS expects	Where it meets your insurance	Ask before renewal
Results reach management and, where appropriate, the board	D&O: failure-to-oversee claims	Who on our board saw the last assessment?
Each risk tied to a control or a written acceptance	Cyber application	Do our answers on MFA (multi-factor authentication), endpoint detection, privileged access and backups match the register?
Vendor and concentration risk	Cyber: dependent business interruption	Does cover pay when a key provider simply goes down, or only when it’s hacked, and after what waiting period and sublimit?
Updates after major changes, including new AI	Cyber application and warranties	Does the register list each AI tool and the data it touches?
An April 15 filing by the CEO and CISO (chief information security officer)	D&O: regulatory investigations	Is our CISO an insured person, and does D&O respond to an informal inquiry, for the company too?

So what?

The assessment is now the document an examiner, an underwriter and, after a loss, a plaintiff will all read.

Small licensees aren’t spared. A 15-person MGA with a New York license still owes the assessment. Expect its carriers to ask for it in their audits. And a DFS finding can reach its license, so check that its E&O defends licensing cases.

The April 15 filing certifies material compliance or admits gaps. Certifying material compliance you don’t have can itself be cited as a violation. On fines, some cyber forms pay where the law allows. D&O usually doesn’t, and a consent order can rule out recovery.

Your underwriter asks the same questions. If register and application disagree, both will notice. After a loss, the register is evidence for a plaintiff and for an insurer weighing a prior-knowledge exclusion. Ask your general counsel how to keep it privileged, since a document a regulation requires usually isn’t.

The LION POV

Here’s how we’re advising clients to use the assessment at renewal:

• Match the application to the register. Good is one review where the application, the register, the DFS filing and any 10-K cyber disclosure agree, with severability protecting the other signers. The tell: last year’s answers, copied.
• Write down the vendor risks you keep. Good is an owner for each critical provider, marked controlled, insured or accepted. The tell: three critical functions on one platform, and no owner.
• Know what your policies can’t pay. Good is a board that knows fines may not be covered. The tell: “the cyber policy covers that,” and nobody has read it.

Ask your board: Can management show us, risk by risk, which control covers it, which policy transfers it, or who accepted it and why?

Your customers are about to add a new channel to that register.

(sources: 23 NYCRR 500.1, 500.16, 500.17, 500.19; NAIC, Model #668 adoption map and model law brief; DFS Circular Letter No. 2 (2021), Cyber Insurance Risk Framework; Order Express consent order; Goodwin, October 2026)

---

Who guards the gate when AI agents come shopping?

The next shopper at your quote form may not be a person.

EverQuote, which runs an online insurance marketplace, published a white paper this month calling personal AI agents “barbarians at the carriers’ gates.” These are tools like Meta’s Muse, which launched in September and hit No. 1 on both U.S. app stores within two weeks, and OpenAI’s dots. A customer gives one a task, and it gathers quotes, compares coverage and, in some cases, switches the policy.

They already work, in part. In a test Reuters reported, Muse nearly saved a BMO analyst about $800 on car insurance, until bundling conditions and system errors stopped the purchase. In EverQuote’s own California trial, Muse found 24 carriers and came back with verified quotes from five. The rest hit website barriers, needed a human agent or didn’t write there, and the quotes it did get didn’t line up on limits or deductibles. It’s also expensive for now: EverQuote’s run burned about 63 million tokens, $65 to $650 worth of computing.

The worry is what happens when it gets cheap. EverQuote argues that an agent that re-shops every renewal can make price the whole comparison, shorten how long policies stay on the books and steer business toward whoever underpriced the risk. EverQuote’s illustrative model has a carrier that blocks agents losing about 6.5% of its premium a year once agents handle 30% of shopping. Amazon has already blocked Muse from its site. On the calls in our first story, The Hartford called agent shopping “very early days,” and Travelers said the activity it can see is “pretty minor.”

Every carrier will have to decide, gate by gate, whether to block the agents, connect to them directly or let an intermediary stand in between, and EverQuote is pitching that last role for itself.

(sources: EverQuote, “Agentic Barbarians at the Carriers’ Gates - Personal AI Agents and the Future of P&C Insurance Distribution”, October 2026, including EverQuote’s own trials and illustrative model; TechCrunch, September 25, 2026; OpenAI, “Introducing dots”, September 29, 2026; Reuters, September 23, 2026, on the BMO test; Adweek on Amazon; Q3 2026 earnings call transcripts of The Hartford, October 27, and Travelers, October 16)

So what?

Whoever answers for the gate answers for what comes through it.

The paper’s own list of legal questions reads like a coverage checklist. An AI tool that misstates your limits or deductibles can draw regulators’ attention under unfair trade practices laws. One that pulls a credit report without a permissible purpose or the notices state law requires raises consumer reporting questions. One that effectively sells your policy may need a producer license. And pricing for AI-sourced business can draw unfair discrimination questions.

Picture a personal lines insurtech that lets AI agents quote through its app next spring. The agent gets the price right but drops a coverage detail, and a customer finds out at claim time. Three questions follow:

1. Whose error is it? Your E&O or ICPL may be asked to answer if the data your quote flow gave the agent left that detail out. Check your contract with the platform or intermediary for who pays and, if you’re an MGA, whether your program agreement allows that channel at all.
2. Does cyber cover the data side? Some cyber and E&O forms exclude or sublimit claims under consumer reporting and privacy statutes. Know which ones yours carry.
3. Is the decision on record? If agent-driven switching dents the book, expect the board to be asked what it knew and what it decided. Write it down.

Then measure it, as the paper itself recommends: track AI agent traffic in your quote flows, count what each AI-driven quote costs you in third-party data, flag agents re-running one applicant with changed answers, and set an access policy for every gate. The same question is coming to bank logins and MGA portals. In New York, a new channel like this is the kind of change DFS expects your risk assessment to catch.

Ask your board: Which of our quote access points are open to AI agents today, and who decided?

---

The Bottom Line

AI showed up on both sides of the balance sheet this month: a cost story on the calls, a paperwork problem in New York, and a new kind of shopper at every carrier’s gate.

The fix starts with paperwork. Write down where AI touches your operations and exposures, what you decided, and revisit it yearly and after any big change. Rehearse what paper can’t do: the restore, the call to the regulator, the claim. Then tell your underwriters, through your broker. Chubb’s CEO expects pricing that tells one AI risk from another. Be the one with the answer on paper.

Three for your board on Monday

1. Both sides. What does AI save us, what does it add to our risks, and does what we’ve said about it in public hold up?
2. The record. Can we show, risk by risk, what we decided, and does it match what we told our underwriter?
3. The gate. Which of our quote access points are open to AI agents, and who decided?

Put three deadlines on the calendar: your next renewal; April 15, 2027, when your CEO and CISO sign the Part 500 filing; and, within 12 months, a board-approved access policy for AI agents (EverQuote’s suggested window; it sells that access).

---

ICYMI: Last week we asked two questions about outsourced security: who let them in, and who pays? Read it here.

---

Thank you for reading today’s edition.

Want to share it? Copy the link below:

https://lionspecialty.kit.com/posts/21-insurers-and-brokers-talked-ai-tools-on-their-calls-three-talked-exclusions-new-york-set-its-bar-and-ai-agents-are-filling-out-your-quote-forms

And if this was forwarded to you, subscribe here.

Stay Covered Everybody,

-FLIP

P.S. Want us to read your policy forms, your cyber application and your E&O against this month’s AI news before your next renewal? Reach out for a confidential conversation: book a time or reply to this email.

P.P.S. Nothing in this briefing constitutes legal advice. These are the opinions of the founder, and coverage is always subject to the terms of each policy. It’s market intelligence designed to help you ask better questions of your advisors and make sharper decisions at your next insurance renewal.

---

You're receiving this because you subscribed to the LION Specialty Boardroom Brief.
Unsubscribe  ·  Update your preferences
Forwarded this, or unsubscribed by mistake? Subscribe here.