Check your policy before you assume it does. Since January 1, 2026, a number of insurance carriers have started explicitly excluding AI-generated deepfake fraud from standard social engineering coverage, while others added it back in as a named, covered risk. Which camp your carrier falls into now decides whether a fake CEO voice or video convincing your bookkeeper to wire money is a covered loss or a total write-off.
Why Insurers Are Suddenly Splitting on AI Fraud Coverage
Business email compromise and funds transfer fraud already drive roughly 60 percent of cyber insurance claims, and AI-generated voice and video make the con far more convincing than a poorly worded email ever was. Insurers had to decide, fast, whether an employee getting fooled by a cloned executive voice counts as the same risk they've always covered under "social engineering," or something new they need to price and exclude separately. As of January 2026 they landed in two different places, and which one your policy fell into might not be something you've actually checked.
What Changed in Cyber Policies Since January 2026
The insurance standards body ISO introduced new AI exclusion language that took effect in January 2026, and a wave of major carriers filed AI exclusions across general liability and cyber lines.
On the cyber side specifically, some carriers now explicitly exclude AI-generated deepfake fraud from standard social engineering coverage for policies renewed after January 1, meaning a wire transfer approved because of a cloned voice or video call might not be covered at all.
Other carriers went the opposite direction, updating their policies to affirmatively cover AI-driven impersonation, including voice cloning and video deepfakes, sometimes through a separate endorsement at extra cost.
Both approaches exist in the market right now, on similarly priced policies, and the only way to know which one you have is to read the renewal language or ask.
Why I'd Call My Broker Before My Next Renewal, Not After
I don't think most small business owners are going to catch this by reading a policy renewal packet closely, and I don't blame them — that's not a reasonable expectation for anyone running a business alone. But this is exactly the kind of gap that turns into a real loss at the worst possible time, and by the time you find out your policy excludes it, you're filing the claim, not renewing the policy.
If you carry cyber coverage at all, this is worth a five-minute call to your broker now, not a surprise in the fine print later.
Ask Your Insurance Broker This One Question This Week
Call your broker or agent and ask one direct question: does our current policy cover losses from AI-generated voice or video impersonation, or is that excluded under the social engineering section?
If it's excluded, ask what a deepfake endorsement costs to add it back. That one call is cheaper than finding out the hard way during a claim.