Prepare an Insurability Evidence Pack for an AI Support Agent

Describe the insured activity you want discussed

Consider a business running an assistant that reads customer records and drafts support replies. Identify the business entity, its services, the assistant’s permissions, and whether a human approves an external action. A model name alone does not describe that operational activity.

The NAIC’s cybersecurity insurance information is general background. It does not determine coverage for an AI workflow. The preparation pack below is our suggested way to organize facts for an insurer or appropriately qualified intermediary.

Build an evidence index

Topic	Evidence to prepare	Keep explicit
Business	Entity, services, and operating locations	Which entities and activities the enquiry concerns
Authority	Tool permissions and approval boundaries	Whether the agent can act without human approval
Data	Categories, access paths, and handling arrangements	Any material facts still being investigated
Controls	Demonstrations and relevant test results	The version and limits of each control
Incidents	A factual history and follow-up actions	Known events rather than an unsupported “no risk” claim

Do not send credentials, full customer records, or unnecessary sensitive logs as part of a general enquiry. Ask what information is required and how it should be supplied.

Distinguish a plan from a demonstrated control

If the business intends to add approval before external sending, identify that as a planned change. It is different from evidence that approval is already enforced. Likewise, “we monitor outputs” needs an explanation of what is observed and what happens when a problem is found.

Use regulatory context appropriately

A Carver assessment can help organize potential regulatory issues and missing facts about the workflow. It is not an underwriting decision or an assurance that a policy covers the activity. Present unresolved results as questions for review rather than favorable findings.

Keep the evidence pack dated and versioned. If the workflow later gains new tools, data, or autonomy, discuss those changes with the appropriate professional instead of assuming the earlier enquiry covered the new activity.