AI oversight gap sharpens consultant insurance questions

The figures matter because many consulting businesses are both users and advisers of AI-enabled systems. Management, IT, data, cyber, HR and operations consultants may use AI to draft work, analyse client information, test systems or support recommendations. If an AI tool accesses the wrong data, changes code, produces flawed analysis or triggers an unauthorised action, the resulting dispute may not look like a futuristic technology failure. It may present as a familiar allegation of poor advice, inadequate controls, privacy weakness, breach of confidentiality or project failure.

The same report said 73% of Australian businesses surveyed had experienced at least one AI-related security issue or warning sign in the previous 12 months. Reported problems included AI accessing data it should not have, making risky recommendations, connecting to systems without security approval or producing unauthorised actions. Those examples align with recent guidance from the Australian Signals Directorate, which has emphasised least-privilege access, monitoring, audit logging and human oversight for high-impact actions in agentic AI systems.

For consultants, the practical insurance point is not that every AI incident will automatically be covered. Policies vary, exclusions differ, and the facts of a claim can decide whether professional indemnity, cyber, technology liability, management liability or another cover is relevant. Where professional work is insured on a claims-made professional indemnity basis, timing, notification and prior-known circumstances can also be important if an AI-related concern develops into a client complaint.

Several checks are worth considering at a business level:

• Document where AI is used in client work, including tools, data access, human review points and approval authority.
• Review contracts for confidentiality, subcontracting, technology use, audit rights and liability clauses that may be affected by AI workflows.
• Compare cyber controls with insurer questionnaires, especially around identity management, logging, backups and privileged access.
• Keep evidence of human review where AI supports analysis, drafting, code, modelling or recommendations.
• Assess whether current cyber insurance limits remain realistic as AI increases system access and potential aggregation of errors.

The broader message is measured rather than alarmist. AI can improve productivity and risk detection, including in cyber operations. But as autonomous tools gain system permissions, consultant risk management needs to become more evidence-based. Insurers and clients are likely to ask not only whether AI is being used, but how its use is governed, recorded and contained when something goes wrong.