The AI governance risks insurance employee use introduces fall into nine categories, including unsanctioned tools, personal accounts, sensitive data in prompts, weak decision evidence, vendor AI, and tool-connected agents. For carriers, policyholder, claims, and underwriting data enters AI tools without the account context or conversation evidence needed to enforce policy. Aurascape governs each AI interaction at that point, classifying the data, the account, and the intent, so compliance teams work from evidence instead of assumptions.

Last updated: September 2026.

Why Employee AI Use Changes Insurance Governance

Insurance data moves through prompts, uploads, coding assistants, Embedded AI, and tool-connected agents. AI governance at the interaction layer means governing each AI exchange by its content, context, and intent: which account was used, what data went in, what the model returned, and what action followed. Enterprise AI adoption runs in three phases: employees using AI tools directly (human-to-AI), employees delegating work to agents (human-to-agent), and agents invoking other agents and tools (agent-to-agent). Employee AI use sits in the human-to-AI phase, where many governance programs still lack interaction-level records.

Written policy states the rule. Existing web and data controls act on destinations, identities, and data patterns. Neither produces conversation-level evidence of the content, account context, response, intention, and policy outcome. Model risk programs govern the AI systems a carrier builds and deploys, not what an employee pastes into a public AI tool.

State insurance bulletins extend written AI governance expectations across the AI systems insurers use. Scope depends on the adopted bulletin and the carrier’s operations.

Governance has not kept pace with usage. Reporting on an AM Best survey of insurers found 63% with a formal AI policy in place and 47% with established AI governance processes, and operational risk ranked a leading AI implementation risk for 41% of respondents, followed by data privacy (22%) and regulatory risk (15%) (Risk & Insurance, 2025).

The concern has also shifted. Data leaks are now the top generative AI security concern at 34%, ahead of advancement of adversarial capabilities at 29%, reversing the 2025 ranking (World Economic Forum, 2026). For a carrier, that leak has a specific shape: policyholder identifiers, claims narratives, medical detail, and underwriting rationale moving into an account no one can audit.

What Are the 9 AI Governance Risks Insurers Face?

The nine risks below are ordered by how early they surface in an insurance AI program. Each starts with missing interaction evidence and grows when the carrier cannot enforce policy or reconstruct AI-assisted work.

1. Regulatory expectations that reach employee AI use. The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers directs carriers to maintain a written AI program covering governance, risk management, and internal controls for the AI systems they use (NAIC, 2023). That program should cover employee use of public AI whenever claims or policyholder data enters the interaction. Aurascape supplies the interaction record, showing which account, application, and data category were involved, so governance extends past the models a carrier owns.
2. Unsanctioned AI tools no one has inventoried. Employees adopt AI faster than security can catalog it. A tool missing from the inventory cannot be governed, and it cannot be produced as evidence when a regulator or auditor asks. IBM found 20% of breached organizations were hit through shadow AI, and 97% of organizations with an AI-related breach lacked proper AI access controls (IBM, 2025). Aurascape discovers AI applications and agents across the network, endpoint, and API planes, and classifies each application by risk and capability. The endpoint agent adds local AI agent discovery on laptops and servers (Aurascape, 2026).
3. Personal accounts doing company work. The same AI tool carries different risk in a personal account: consumer terms, no tenant administration, no retention settings, no visibility for the carrier. The National Cybersecurity Alliance found 43% of workers admit sharing sensitive workplace information with AI tools without their employer’s knowledge, including client data (44%) and financial data (42%) (National Cybersecurity Alliance, 2025). Aurascape distinguishes enterprise tenants from personal accounts inside the interaction and can require the enterprise tenant on an approved application, which turns a vague shadow AI concern into a specific rule a claims or underwriting leader can approve.
4. Policyholder data inside prompts and uploads. Personally identifiable information (PII), protected health information (PHI), and payment card industry (PCI) data enter AI tools as pasted text, attachments, and code, not as clean database exports. A billing analyst pasting a premium payment exception, complete with a partial card number, into a chat tool to draft a policyholder explanation is a PCI handling event that never touched the payment system’s own controls. OWASP ranks Sensitive Information Disclosure (LLM02) among the top risks for AI applications (OWASP, 2025). Aurascape applies 600+ real-time data classifiers to prompts, files, code, and responses, and supports customer-defined data patterns for carrier-specific artifacts such as claim and policy identifiers. Detection runs inline, so redaction can stop sensitive content before it reaches the AI service (Aurascape, 2026).
5. AI-assisted decisions made without review, explainability, or fairness evidence. An adjuster drafting a denial rationale in a chat tool, or an underwriter asking a model to weigh factors on a submission, is decision-adjacent work sitting outside the model inventory. Three gaps open at once: no named reviewer accountable for the outcome, no explanation of how the AI-influenced result was reached, and no way to check whether the output leaned on proxies for protected characteristics, where unfair discrimination exposure starts. A defensible record for one AI-assisted decision holds the input and the output, the data used, the named reviewer, that reviewer’s approval or change, the policy decision that applied, and the final outcome communicated to the policyholder. EY survey work reports that 79% of insurers are seeking both monitoring and auditing capabilities for AI data as part of their policy approach (EY, 2025). Aurascape makes AI use visible by user, group, department, application, and intention. It creates interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy, so compliance and legal can review the content, account context, response, and policy decision behind a specific exchange.
6. Acceptable use policy that cannot be enforced. Policy writing has moved fast: Littler found 44% of organizations had a generative AI policy, up from 10% the prior year (Littler, 2024). A usable insurance AI policy names the approved applications, the required account type, and the permitted Intentions for each. It also names the restricted data categories, the work that requires human review, the enforcement action per rule, who owns exceptions, and how often the evidence gets reviewed. An acceptable-use policy needs an enforcement point and a record of each decision. Aurascape provides both, mapping written policy to inline actions at the moment of use: allow, coach, notify, redact, redirect, or block, based on the application, account type, data category, and intention.
7. Embedded AI inside the insurance software stack. AI features arrive inside policy administration, CRM, document, and productivity tools the carrier already licensed, with no procurement event to trigger a review. Injection carried in ordinary content is a real exposure: EchoLeak (CVE-2025-32711) was a zero-click indirect prompt injection in Microsoft 365 Copilot (NVD, 2025). Aurascape covers Embedded AI and AI Copilots alongside Commercial AI, and inspects responses as well as prompts, so an AI feature inside a licensed insurance application is governed on the same terms as a public chat tool.
8. Vendor and third-party AI across the distribution chain. Third-party administrators, managing general agents, brokers, and adjusting vendors run their own AI tools against data the carrier supplied, and a data-sharing agreement rarely names which AI tools a vendor’s staff may use with it. The World Economic Forum identifies third-party and supply-chain vulnerabilities as a leading resilience challenge for large organizations (World Economic Forum, 2026), which argues for three additions to diligence: a contract clause on permitted AI use with carrier data, a due-diligence question on account type and retention, and a periodic attestation naming the tools in use. Aurascape governs the carrier’s own side of that exchange, showing which AI applications employees use with vendor-supplied data, which accounts they use, and what leaves in each interaction.
9. Agents that connect AI to core systems. Once an assistant can retrieve records, write updates, and take action, the exposure moves from what an employee types to what an agent does on its behalf. The Cloud Security Alliance reports 82% of organizations have unknown AI agents in their environments (Cloud Security Alliance, 2026). Aurascape discovers and secures local AI agents and their interactions, and adds a Zero-Bypass MCP Gateway that marks every tool call it approves and blocks unmarked calls, governing the agent-to-tool execution path inline rather than observing it (Aurascape, 2026). Model Context Protocol (MCP) is one common tool-execution pattern, not the whole agent access-control problem.

Where Aurascape Fits Across Claims, Underwriting, Legal, and Engineering

Take the nine risks in sequence rather than all at once. Discover the AI already in use, classify the data moving through it, require enterprise tenants on sanctioned applications, assign accountable review for decision-adjacent work, then extend the same controls to agents as they take on tool access.

Each workflow handles different data and requires a carrier-defined reviewer. Set policy by application, account, data category, and Intention. Weak controls also stall approval: risk teams cannot verify how AI is used or how policy is enforced. Gartner predicts over 40% of agentic AI projects will be canceled by the end of 2027 because of escalating costs, unclear business value, or inadequate risk controls (Gartner, 2025). The table below maps each insurance workflow to its sensitive artifact and the control Aurascape applies.

Investigation and reporting both start with finding the interaction. With interaction records, a security team locates the exchange, sees which data categories moved and which account was used, reads the policy decision that applied, and routes escalation to the workflow owner in claims, underwriting, legal, or engineering. That record supports a reporting decision under privacy and insurance obligations, and it shortens review: the question shifts from reconstructing what an employee might have shared to reading what the interaction contained. RBAC governs access to those records, so each reviewer sees what the role permits.

The side-by-side comparison below sets the architectural scope of existing web and data controls against interaction-level control.

Aurascape is additive to an existing secure service edge, cloud access security broker, secure web gateway, or data loss prevention stack, with no rip and replace, and it steers AI traffic to an inline proxy for inspection and enforcement. Carriers building the surrounding program can start with the four pillars of AI governance, review how regulated peers structure control mapping in AI compliance frameworks for banks and investment firms and the broader enterprise AI governance frameworks, and account for the paste-and-upload path described in AI browser security risks.

Frequently Asked Questions

What does the NAIC Model Bulletin require for employee AI use in insurance?

The NAIC Model Bulletin directs carriers to maintain a written AI program covering governance, risk management, and internal controls for the AI systems they use. That program should cover employee use of public AI where claims or policyholder data enters the interaction, which means the carrier needs records of that usage. The precise obligations depend on the bulletin a given state adopted.

How should insurers document human review of AI-assisted claims and underwriting decisions?

Keep the AI contribution and the human decision as two separate, visible steps, so a reviewer’s approval or change is never mistaken for the model’s output. Aurascape’s interaction records capture the AI side of the exchange, including data category and policy action, and the named reviewer’s sign-off sits alongside it.

How do insurers separate personal AI accounts from enterprise ones?

Account type has to be read inside the AI interaction, because the destination looks the same either way. Aurascape decodes the exchange, identifies the account in use, and can require the enterprise tenant before an approved application will proceed.

What evidence should a carrier keep for an AI-assisted decision?

Keep evidence at the level of the exchange: who used AI, which account, what data was included, what the AI returned, and what policy action applied, alongside the human reviewer’s final decision. Destination logs show where traffic went, not what left or who approved it.

Do insurers have to block public AI tools?

No. Insurers can apply allow, coach, notify, redact, redirect, or block based on risk, reserving block for prohibited interactions and using coach, notify, or redact when the work can continue safely. Graduated actions let an adjuster who pastes a claim narrative get coached or redacted rather than stopped, so productivity holds while the risk posture becomes documented.

How do AI agents change the risk picture for carriers?

Agents turn a conversation into an action against real systems, which raises the stakes on tool-level control and on the authentication posture of the servers they reach. Censys found more than 12,520 internet-accessible MCP services, mostly unauthenticated, since the protocol does not require authentication by default (Censys, 2026). Aurascape governs the agent-to-tool execution path inline, with tool-level sanctioning and a record of each interaction and approved tool call.

Where should an insurance CISO start?

Start with discovery, because the AI inventory sets the scope for every decision that follows. Data classification, tenant enforcement, accountable review, and agent tool governance then build on that inventory in order.

Aurascape gives insurance security, risk, and compliance teams the interaction-level evidence their AI programs are missing. It discovers AI apps, accounts, and agents, classifies policyholder and claims data inline, enforces enterprise tenants, and governs agent tool execution inline, with graduated policy actions in place of blanket blocks. Claims, underwriting, legal, and engineering keep doing approved AI work while Aurascape records the interaction and the policy decision. A short demo walks through those four workflows on real AI traffic patterns.

See how Aurascape governs employee AI use across claims, underwriting, legal, and engineering →

GARTNER® is a registered trademark and service mark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact.