Artificial Intelligence And The New D&O Risk Frontier

For decades, directors and officers (D&O) liability was governed by a relatively stable set of rules. Boards focused on financial reporting accuracy, regulatory compliance, employment practices, and fiduciary responsibilities. While litigation certainly existed, most organizations understood where their primary exposures originated and how to build controls around them.

That environment has changed dramatically.

Today, directors and officers operate in a business world defined by accelerated technological change, expanding regulatory scrutiny, aggressive plaintiff litigation, and growing stakeholder expectations. At the center of that transformation is artificial intelligence.

Artificial intelligence has quickly become one of the most powerful business tools ever created. AI is no longer a future technology. It is already embedded in recruiting platforms, lending decisions, fraud detection systems, claims handling, customer service operations, marketing programs, financial modeling, and strategic planning initiatives. Every one of those applications carries potential D&O implications.

Interestingly, AI simultaneously creates competitive advantages and governance risks. Organizations that deploy AI effectively can improve efficiency, increase profitability, and enhance business intelligence. However, when AI systems generate biased outcomes, inaccurate disclosures, cybersecurity vulnerabilities, or poorly governed autonomous decisions, directors and officers increasingly find themselves in the legal spotlight.

The result is a D&O risk environment unlike anything boards have faced.

Traditional D&O safe harbor is gone

Historically, directors could demonstrate reasonable oversight by following established governance processes. Financial controls, audit procedures, compliance reviews, and documented board deliberations could provide strong defenses against allegations of mismanagement.

Governance professionals described this philosophy as “nose in, hands out.” Directors remained informed, asked appropriate questions, and monitored management without becoming involved in day-to-day operations.

That model is becoming less effective.

Courts, regulators, and plaintiffs’ attorneys increasingly focus not only on whether directors followed a process, but whether that process produced an acceptable outcome. In many cases, organizations that can demonstrate procedural compliance still face litigation when stakeholders suffer financial, operational, or reputational harm.

This shift is particularly significant for AI-related exposures, because many regulatory standards remain unsettled. Unlike financial reporting, where GAAP, IFRS, SEC guidance, and established audit frameworks provide clear expectations, AI governance lacks universally accepted standards. Consequently, directors are operating in an environment where expectations continue to evolve while liability exposure expands.

The numbers tell the story

The growth in D&O litigation and associated costs reflects the increasing complexity facing boards. Among the most notable trends:

• A three-time increase in D&O lawsuits in the last four years.
• Litigation awards and settlement values have doubled.
• Average case resolution periods have expanded from roughly three years to as much as seven years in some matters.
• Internal defense and investigation costs are up more than 300%.
• Premium increases of 50% have become common across high-risk sectors.
• Some one in three firms now face some form of D&O claim annually.

These trends demonstrate that the D&O market is experiencing more than a temporary pricing cycle. The underlying risk profile itself has fundamentally changed.

Cascading risk vectors reshaping directors liability

While AI is often discussed as a discrete exposure, its impact reaches across virtually every major category of D&O risk.

Mergers and acquisitions. Boards increasingly rely on AI tools to assist with due diligence, valuation analysis, and transaction review.

While the tools can improve efficiency, they bring with them additional oversight obligations. When transactions fail to achieve anticipated results, courts may examine not only the diligence process itself but also how AI-generated analyses influenced board decisions.

Directors must understand both the capabilities and limitations of AI-assisted due diligence.

Financial disclosure. Generative AI is already being used to draft regulatory filings, investor communications, earnings summaries, and financial narratives. Still, AI-generated content remains subject to the same legal standards as content written by humans. If disclosures contain inaccuracies, omissions, or misleading information, directors cannot claim immunity simply because an AI system generated the language. SEC disclosure obligations continue to apply regardless of the tool used to create the content.

Employment practices. Perhaps no area presents greater near-term litigation potential than algorithmic decision-making in employment. Organizations increasingly use AI to screen résumés, rank candidates, evaluate performance, and support compensation decisions. When those systems produce disparate impacts affecting protected classes, employers may face discrimination claims, class-action litigation, and regulatory scrutiny.

Boards that cannot demonstrate meaningful bias testing and oversight may become targets themselves.

Cybersecurity. AI has strengthened both sides of the cybersecurity equation. Organizations use AI to detect threats and respond to incidents, while malicious actors use AI to create more sophisticated phishing campaigns, social engineering attacks, malware variants, and vulnerability discovery techniques. At the same time, regulatory expectations surrounding cyber governance continue to rise. Directors are increasingly expected to demonstrate substantive cybersecurity oversight rather than simply receiving occasional IT updates.

Boards that continue relying on yesterday’s assumptions may find themselves exposed to

tomorrow’s litigation. The organizations most likely to succeed will be those that recognize AI as both a strategic asset and a governance obligation.

ESG and stakeholder reporting. Many organizations now use AI tools to collect, analyze, and report environmental, social, and governance metrics. While automation improves efficiency, it also introduces accuracy concerns. Misstated ESG metrics, unsupported sustainability claims, or faulty AI-generated reporting can create both regulatory and shareholder exposure. In addition, AI itself creates new ESG questions involving energy consumption, privacy rights, transparency, and responsible technology deployment.

AI-specific D&O exposures boards should understand

Although AI influences many traditional risk categories, several exposures are uniquely tied to the technology itself.

Algorithmic bias. AI systems trained on flawed or incomplete data can produce discriminatory outcomes in hiring, lending, pricing, healthcare, and customer-service functions. When organizations fail to conduct bias testing, courts may view that failure as evidence of inadequate oversight.

Generative AI errors. Large language models can generate inaccurate information, misleading statements, fabricated citations, and unsupported conclusions. When employees use these tools in regulated communications, legal filings, or investor materials, organizations assume responsibility for the outputs.

AI-enabled cyber risk. Emerging threats such as model poisoning, adversarial attacks, prompt manipulation, and AI-assisted intrusion techniques require governance structures that extend beyond traditional cybersecurity programs. Boards must understand how AI changes the organization’s cyber risk profile.

Autonomous decision making. The greater the autonomy granted to AI systems, the greater the governance responsibility placed on directors. Whether the system influences credit approvals, medical recommendations, pricing strategies, or operational controls, directors must ensure that meaningful human oversight remains in place.

Third-party AI risk. Many companies purchase AI capabilities from external vendors rather than developing them internally. Unfortunately, outsourcing technology does not outsource liability. Directors should understand vendor governance practices, contractual indemnification provisions, performance controls, and compliance standards before deploying third-party AI tools.

3. Develop incident response playbooks. When an AI issue emerges, response speed matters. Organizations should build predefined procedures that address: regulatory inquiries, media response, internal investigations, customer communications, disclosure obligations, and technical remediation. Preparation before an incident occurs is significantly less expensive than creating processes during a crisis.

4. Create ongoing governance mechanisms. Leading organizations are establishing dedicated AI governance committees, commissioning independent audits, documenting oversight activities, and maintaining continuous monitoring programs. These measures help demonstrate that directors fulfilled their duty of care and exercised reasonable oversight.

In the emerging AI era, effective governance is no longer simply a best practice. It is rapidly becoming the first line of defense—one that engaged agents and brokers can help bolster.

What agents should do now

For insurance agents and brokers, AI presents an opportunity to elevate client conversations beyond premiums and limits. Consider the following suggestions as you do this.

Ask better questions and ID coverage gaps. Instead of focusing solely on revenue, industry, or claims history, ask clients:

• Where is AI being used today?
• Who oversees AI deployment?
• Has bias testing been conducted?
• Are employees using generative AI tools?
• How are AI vendors vetted?
• What documentation exists for board oversight?

Review how D&O, cyber, EPL, and professional liability policies interact. Many organizations assume AI-related claims are covered somewhere within their insurance portfolio. That assumption should be tested rather than accepted.

Position governance as risk management and encourage board education. Agents can become trusted advisors by helping clients connect governance practices with insurability, underwriting outcomes, and long-term loss prevention.

Many directors understand cybersecurity but have limited familiarity with AI governance obligations. Educational initiatives can significantly improve organizational preparedness.

New era, new mindset

Artificial intelligence is not merely another technology trend. It represents a structural shift in how organizations operate, make decisions, interact with customers, and manage risk. For directors and officers, the implications are profound. The traditional governance playbook was built for a world where rules were relatively stable, risks were easier to identify, and compliance often provided protection. Today’s environment is far more dynamic.

Boards that continue relying on yesterday’s assumptions may find themselves exposed to tomorrow’s litigation. The organizations most likely to succeed will be those that recognize AI as both a strategic asset and a governance obligation. By strengthening oversight, revisiting insurance programs, enhancing documentation, and embracing proactive loss prevention, companies can position themselves to capture AI’s benefits while reducing the growing liability risks accompanying its adoption.

In the emerging AI era, effective governance is no longer simply a best practice. It is rapidly becoming the first line of defense—one that engaged agents and brokers can help bolster.

The author

James W. Satterfield is President of CrisisRiskTM, a subsidiary of Rhulen Specialty. CrisisRisk and Rhulen Specialty are comprised of insurance, reinsurance, legal, engineering and business professionals who, over the last 20-plus years, have handled hundreds of crises, including some of this nation’s most catastrophic events. The firm helps with program development/expansion, underwriting guideline adaptation, post-underwriting education/risk management, marketing and sales support, claims management, crisis response and other tasks to improve programs. For more information, visit crisisrisk.com.