What cyber insurers ask about AI use, and how to answer honestly
Cyber insurance AI usage questions usually cover three things: whether you have a written AI policy, whether staff have been trained on it, and what stops client data going into AI tools. Answer each one with what is true today, and keep a record that proves it. Wording differs between insurers and changes year to year. The honest answer, backed by dated evidence, is what matters.
Why the AI question has appeared
Staff use ChatGPT, Copilot and Gemini at work. Often without anyone deciding they should. Insurers want to know if client data is going with them. A pasted client list is a data risk like any other. So the form now asks.
This is not a trick. It is the same logic as questions about backups or passwords. The insurer wants to price the risk. You want a policy that pays out. Both need the answers to be accurate.
The kinds of questions insurers ask about AI
Every form words things differently. We will not quote any insurer's wording. But the questions tend to fall into a few groups.
Policy questions
Do you have a written policy on staff use of AI tools? Has it been approved? Do staff know it exists? Some forms go further and ask which tools are allowed.
Training questions
Have staff been told how to use AI safely? When? Is it repeated? New starters are often the gap here.
Data control questions
Is there anything that stops sensitive data being entered into AI tools? Or is it left to staff judgement? This is the hardest group to answer well. A policy says what should happen. A control is what actually happens.
Tool and account questions
Which AI tools do you use? Business accounts or personal ones? Do you know if staff use tools you have not approved? The plan matters. Our guide to ChatGPT Team, Enterprise and free plans covers what each one does with your data.
Rule of thumb: if you cannot show it, do not tick it. An answer you can prove is worth more than a better-sounding one you cannot.
How to answer honestly
Answer for today. Not for what you plan to do next month. A form is a statement of fact. A wrong answer can give the insurer grounds to question a claim later.
If the honest answer is "partly", say so where the form allows. Many forms have a notes box. Use it. "Written policy in place since March. Training for all staff booked for June." That is clear and true.
If the answer is "no", it is still better than a wrong "yes". You may pay a little more. Or the insurer may ask for a fix by a date. Both are better than a claim in dispute.
A worked example
Take Ashcombe, a 24-person accountancy practice. Jo, the practice manager, gets the renewal form. It asks about AI policy, training and controls.
- Policy: yes. Written, approved by the partners, dated.
- Agreement: 22 of 24 staff have agreed it. Two are on leave. Jo notes this.
- Training: a short session for all staff. Jo has the date and attendance.
- Controls: Jo describes what is in place in plain words, and attaches a summary.
Every answer points to a record. That is the whole aim.
What evidence supports a confident answer
Think about what you would show if the insurer asked. Or if a claim turned on it.
| Question area | Evidence to keep |
|---|---|
| AI policy | The policy itself, version and approval date |
| Staff agreement | Each person's name and the date they agreed |
| Training | Date, content, who attended, who missed it |
| Approved tools | A list of tools and account types, with a review date |
| Data controls | What the control does, and a record of it working |
The last row is where most firms are thin. "We told staff not to" is a policy. A record that card numbers or client names were taken out before they were sent is evidence of a control. If staff redact by hand, our guide to redacting data before pasting into ChatGPT sets out the steps.
Records to keep for next year
Start the file now. Renewal comes round fast. Keep it in one place.
- Each version of your AI policy, with dates.
- A dated record of each person agreeing it, including new starters.
- Training dates and attendance.
- Your approved tools list, reviewed at least once in the year.
- A monthly summary of what your controls stopped or flagged.
- A copy of this year's form and your answers.
Keeping last year's answers matters. Next year you can show what changed. Insurers tend to look well on steady progress.
AI is welcome here. Company and client data stay out of it.
Where Helio Guard fits
This is what we make, so read it with that in mind. Helio Guard records each person's dated agreement to your AI policy. It checks pastes, messages and file uploads on listed AI sites, on the PC, and takes out things like card numbers, National Insurance numbers and client names. The question still goes. It flags unapproved AI tools and staff who need training. Each month it produces a record you can give an insurer.
We never see what your team types. Only a short record of the kind of data, site, person, outcome and time. It runs on Windows PCs, in Chrome and Edge. Not yet on Mac. Details are on the pricing page: £1 a person a month, from 5 people, with a 14-day free trial and no card needed.
Key takeaway: the form asks what you do. The records show it. Build the records through the year, not the week before renewal.
Common questions about AI on insurance forms
Do I need an AI policy if we do not use AI at work?
An AI policy is still worth having even if the business has not chosen any AI tools. Staff often use free tools on their own. A short policy saying which tools are allowed, or that none are, gives you a true answer for the insurance form and a clear rule for staff to follow.
What if staff use personal ChatGPT accounts?
Personal ChatGPT accounts should be declared honestly if the form asks about them. Personal plans give the business no control over the data or settings. The better answer is to move staff to approved business accounts, update the AI policy to say so, and keep a dated note of when the change was made.
Can a wrong answer on a cyber insurance form affect a claim?
A wrong answer on a cyber insurance form can give the insurer grounds to question a claim, depending on the policy terms. That is why answering for what is true today matters. If unsure, ask your broker how a question should be read before you answer, and keep a note of what they said.
Related: A client asked about your AI controls: how to reply the same day, How to find out which AI tools your staff are using, How to evidence AI controls for audit, insurers and clients