Where does AI create exposures
and how can they be prevented?
By Jason Gobbel
Whether you know it or not, artificial intelligence (AI) is already being used in your agency. Your producers are using AI to draft emails. Your account managers are using AI to summarize policies. Your software vendors are embedding AI into the systems you rely on every day. Most of this is happening without clear guidance, oversight, or boundaries.
That is where the risk begins.
Many agency leaders still view AI as just a productivity tool. It’s beyond that now. It is a new operational capability that changes how information is handled, how decisions are made, and how advice is delivered.
If an employee uses AI to explain coverage incorrectly and a client relies on that explanation, who owns the outcome? If client data is entered into an unvetted AI tool, where does that data go, and who is responsible?
These are not theoretical concerns. They are already showing up in real workflows inside real agencies. The question is not whether your agency will adopt AI. Your agency already has. The real question is whether you will lead that adoption or allow it to create risk you did not intend to take on.
Where AI creates risk in an agency
To lead effectively, you need to understand where exposure is introduced. AI does not understand insurance. It does not interpret coverage or reason through exclusions.
AI predicts language. That makes it useful, but it also creates very specific risks in an agency environment. Let’s review a couple of those risks.
- Client data exposure. Staff are already uploading applications, loss runs, policy details, and financial information into AI tools to summarize or rewrite content. In many cases, they do not know where that data is going, how it is stored, or whether it is being used to train future models. From a cybersecurity standpoint, this is a loss of data control. From a client standpoint, it is a breach of trust.
- Coverage misrepresentation. AI can produce clean, confident explanations that sound correct but are not.
An employee uses AI to summarize a policy. The output simplifies a coverage explanation and omits a key exclusion. That summary is shared with a client. A claim occurs, and the client references that communication. At that point, the blame does not fall on the AI for making a mistake. Your agency owns the outcome. AI can assist with communication, but it cannot replace professional judgment.
- Unvetted AI inside core systems. Even if you are not actively using AI tools, your software vendors are.
Your CRM, AMS, email platform, and document systems are introducing AI-powered features. Many agencies assume that if a feature is built into a trusted platform, it has already been vetted.
That assumption creates risk. You still need to understand what data is being accessed, where it is processed, who has control, and whether the AI-generated output is accurate.
- Operational dependency. As AI becomes easier to use, people begin to rely on it without fully understanding the work behind it. That leads to reduced verification, overconfidence in outputs, and gradual erosion of expertise. In an industry where accuracy matters, this creates long-term exposure.
The leadership gap
Most agencies are not making a conscious decision to adopt AI. Instead, they are allowing it to happen. AI usage starts with individual use. It expands through vendor features. Over time, AI becomes embedded in daily operations without any structure around it. No policy. No ownership. No defined boundaries.
In cybersecurity, unmanaged risk is assumed risk. The same applies here. If leadership does not define how AI should be used, the organization will define it on its own. That definition will be inconsistent, unmonitored, and exposed.
Leadership’s role in AI adoption
AI usage does not require executives to manage tools or oversee day-to-day usage. It requires them to take ownership of three things:
- Direction: Define where AI creates value. Most agencies approach AI reactively. They allow teams to experiment and hope value emerges. That approach creates inconsistent results. Leadership should define where AI is expected to create impact:
- Improving service efficiency
- Accelerating internal workflows
- Enhancing communication
Not every use case carries the same level of risk. Some should be encouraged, while others should be avoided entirely. If your agency does not define where AI should be used, it will be used everywhere.
- Guardrails: Establish non-negotiable boundaries. Once direction is set, boundaries need to be clear. This should be formalized through an Acceptable AI Use Policy that defines how AI may and may not be used inside the agency.
At a minimum, leadership should define:
- What data is off-limits
- What requires human validation
- What cannot be automated
- What tools are approved
- What employee responsibilities apply when using AI-generated content
Guardrails allow your organization to move faster without losing control. Without them, the speed of AI will simply amplify mistakes.
- Governance: Assign ownership and oversight. AI ends up sitting between IT, operations, and individual departments with no clear visibility or accountability. That’s a recipe for disaster. Someone must be responsible for:
- What tools are in use
- How they are being used
- What risks they introduce
In most agencies, this does not require a large committee. It requires one accountable leader and a small cross-functional group to support evaluation and oversight.
The goal is simple: AI use in the organization should be visible and intentional.
Integrating AI into your risk framework
AI intersects directly with cybersecurity, vendor risk management, data governance, and E&O exposure. Consequentially, AI should not be treated as a separate initiative.
If it is not integrated into those existing risk frameworks, it creates gaps, and gaps are where problems show up. The same discipline used to evaluate vendors, control access, and protect data should apply to AI.
Where verification matters most
Not every use of AI requires oversight, but some areas do. Leadership should define where human validation is mandatory, particularly in:
- Coverage explanations
- Policy summaries
- Client advisory communication
These are areas where mistakes carry real consequences. AI can assist in preparing information. It should not be the final authority on what is communicated to a client.
Creating awareness across the organization
AI adoption does not fail because of bad tools. It fails because of uninformed usage. Your team needs to understand:
- What could go wrong
- Where risk is introduced
- Why guardrails exist
This is not about teaching people how to use AI more effectively. It is about ensuring they use it responsibly. When people understand the risk, behavior changes.
The real opportunity
AI will make agencies more efficient. It will reduce administrative work, accelerate communication, and create new ways to deliver value. It will also amplify mistakes if it is used without structure.
The agencies that benefit most will not be the ones that move the fastest. They will be the ones that move deliberately, with clear direction, defined guardrails, and accountable governance.
Because in the end, your clients are not trusting your technology. They are trusting your judgment. And that responsibility does not change, no matter how advanced the tools become.
The author
Jason Gobbel is a Partner and Chief Solutions Officer at Kite Technology Group. He helps agency leaders develop strategies for AI and automation, cybersecurity, cloud adoption, and operational efficiency. For more than 30 years, Kite Technology Group has empowered agencies to use technology as a driver of growth, resilience, and competitive advantage. Learn more at www.kitetechgroup.com.
