Insurers abroad are starting to treat AI as its own category of risk. Some are writing it out of general policies, and others are selling dedicated cover priced on how well a business governs its AI tools. No Kenyan insurer has announced such a product yet, but Kenya's data regulator already asks businesses for the same kind of evidence.
What is changing abroad
AIG, Great American and WR Berkley have asked US regulators for permission to exclude AI-related risks from corporate policies, according to The Decoder's report on the Financial Times story. The report does not say whether regulators approved the requests.
On November 10, Cowbell announced a standalone AI liability policy for US small and mid-sized businesses that deploy AI agents. It covers losses such as an accounts agent making a duplicate supplier payment, or a bookkeeping firm's agent filing tax returns with outdated rates and clients suing. It goes on sale on January 1, 2027, through wholesale brokers only, and no limits or pricing have been published.
What the new cover looks at
Cowbell underwrites partly on three factors:
- Observability: How closely a business monitors its AI tools.
- Autonomy: How much authority those tools have to act on their own.
- Governance: The policies and ownership around AI use.
Cowbell has not said which specific controls it requires. Other carriers are asking similar questions. Insurance Business reports that some now ask whether a company keeps an inventory of its AI tools and who is responsible for each one, and that some may price agent-to-agent deployments differently. Lockton's Ashley Bennett Jones expects AI to become a standard part of underwriting discussions within a year, and says insurance should come last, after a business has assessed and reduced its risk.
The Kenyan angle: the regulator already asks for the evidence
The Office of the Data Protection Commissioner issued a Guidance Note on Artificial Intelligence in July 2026. It applies to organisations that deploy AI to make decisions from personal data, or buy AI as a service. It asks for:
- Human involvement: Meaningful human involvement in significant automated decisions.
- Impact assessments: A data protection impact assessment before high-risk processing.
- Vendor agreements: Written agreements with AI vendors.
- Logs and an incident register: Logs of AI decisions and inputs, and a register of AI incidents.
Breaches that are likely to pose a risk must be reported to the ODPC within 72 hours.
Insurers here already sell cyber cover. Business Daily reported in July that APA Insurance, Aon Kenya, Britam and Zamara offer specialised cyber products. The same report says insurers increasingly want evidence of AI governance, human oversight and control over third-party AI vendors. Some are adding endorsements that expressly cover AI incidents, and others are adding exclusions for businesses that use AI without adequate governance.
The regulator's cyber rules point the same way. The IRA's cyber directive requires insurers to report material incidents within 24 hours, and it makes no mention of AI. So ask your insurer how an AI incident would be treated under your cyber wording today.
Four records to build this quarter
- An AI register: Every tool, its use case, the data it touches and a named owner.
- Logs: Inputs, outputs and approvals for anything customer facing or money moving.
- Approval limits: Payments or actions above a set amount need a person to approve them, and unusual usage triggers an alert.
- An incident register: A simple log, and a route to report within 72 hours where personal data is involved.
These are the same records an underwriter is likely to ask for, and the ones the ODPC guidance points to. A business that has them is easier to insure and easier to defend if something goes wrong.
What this means for insurers and brokers
Add AI questions to proposal forms and client reviews: which tools are used, who owns them, what they can do without a person, and what is logged. Brokers who can explain this to clients will be ahead when AI cover arrives in this market. Clients should treat insurance as the last step. Reduce the risk first, then transfer what remains.