Risk Titration AI Checklist for PI/E&O

Use the following checklist to prepare for PI/E&O underwriting meetings and client due diligence.

The goal is not perfect AI governance. The goal is clear, proportionate controls, calibrated (“titrated”) to the stakes and autonomy of your AI use cases.

If you can walk an underwriter through the checklist with real examples and show that your approach is broadly aligned with recognized frameworks such as those from the NIST and the EU AI Act, you are already ahead of many peers and positioning yourself for meaningful insurance negotiations

Give Insurers Your Unique PI/E&O Story

Before your next renewal, ensure you can answer in concrete terms:

• Where is AI used and what decisions can it influence? – Mapped and classified by risk, consistent with NIST/EU AI Act thinking.
  
  
• What could go wrong and how has the firm scaled controls to these perils? – Governance, oversight, data protection and incident handling calibrated to stakes and autonomy.
  
  
• In the event an AI assisted decision goes wrong, can the firm explain what happened, discuss the incident in the context of regulatory duties and stated risk appetite, and identify which insurance coverages would respond?

Map Your AI Use and Perils

(NIST: MAP | EU AI Act: Risk Classification)

• ☐  Do you have an inventory:
    a.  AI tools in use (internal and external)?
    b.  Which teams/matter types use them?
    c.  Whether they are assistive, generative or agentic (able to trigger actions)?

• ☐  For each significant use case, have you identified the main perils?
    a.    Hallucinated or fabricated content in advice/reports.
    b.    Biased or incomplete analysis
    c.    Unauthorized use or leakage of client data
    d.    AI-enabled IP infringement
    e.    Over-automation or misrouting of tasks
    f.    Inconsistent application of firm methodologies/standards

• ☐  Have you distinguished high-states uses (influencing advice, filings, valuations, board decisions) from low-stakes ones (internal summaries, admin support)?

Resources:
Implementing generative AI with speed and safety

Titrate Governance and Decision Rights

(NIST: GOVERN | EU AI Act: Governance / Accountability)

• ☐  Is there a named senior owner or committee for AI risk and governance?
• ☐  Do you have short, written policies and procedures covering:
    •  Permitted and prohibited AI uses?
    •  When and how client data may be used in AI tools?
    •  Minimum expectations for human review?
  
  
• ☐  Are decision rights for automation clear?
    •  Which actions can be fully automated?
    •  Which require one-click human approval?
    •  Which require multi-party sign-off?
  
  
• ☐  Is there a basic lifecycle process/
    •  Approve new tools/use cases
    •  Periodically review performance and incidents
    •  Retire tools/workflows that prove too risky
  
  

Resources:
Strategic governance of AI: A Roadmap for the future
As AI Evolves, So Must Board Oversight
Guest Post: AI Governance Is a Fiduciary Duty

Human Review, Quality Control and Data Protection

(NIST: MANAGE | EU AI Act: Human Oversight, Data & Data Governance)

• ☐  For work that reaches clients, do you have documented minimum review standards?
    •  No material AI-generated content goes to clients without qualified human review
    •  Higher-stakes work gets deeper review and sign-off
  
  
• ☐  Are risk-based controls in place?
    •  Stricter checks for legal/financial/regulatory advice and high-value matters
    •  Lighter controls for low-impact internal uses
  
  
• ☐  Do staff receive practical training
    •  When and how they may use AI
    •  Risks of hallucination, bias, and over-confidence
  
  
• ☐  Are data safeguards defined and followed?
    •  Rules on what client data may be input to external tools
    •  Preference for enterprise/controlled AI platforms where feasible
  
  

Resources:
These are the most urgent AI risks, according to 272 experts
The Insurability Frontier of AI Risk: Mapping Threats to Affirmative Coverage, Silent Exposures, and Exclusions

Vendors, Contracts and Evidence

(NIST: MANAGE / GOVERN | EU AI Act: Provider / Deployer Obligations)

• ☐  For key AI vendors/tools, documented due diligence?
    •  Security, privacy, and confidentiality
    •  IP and Licensing terms
    •  Service Levels/Support
  
  
• ☐  Do contracts reasonably address:
    •  Allocation of liability and indemnity for AI-related failures?
    •  Changes in terms, pricing or functionality?
  
  
• ☐  Can you evidence AI use and oversight on a file?
    •  Notes that AI was used and at what stage
    •  Key prompts/parameters or model versions where relevant
  
  

Resources:
AI-Due-Diligence-Checklist

Incidents, Learning and Recalibration

(NIST: MEASURE / MANAGE | EU AI Act: Monitoring, Incident Handling, Corrective Actions)

• ☐  Do you have a simple incident/near-miss process for AI-related issues?
    •  How staff report problems
    •  How issues are escalated to risk/compliance
    •  Criteria for client and insurer notification
  
  
• ☐  Is there a basic AI incident log or spreadsheet capturing:
    •  Root cause, including AI component
    •  Remediation and client impact
  
  
• ☐  Are lessons learned used to re-titrate controls?
    •  Tightening oversight where incidents or near-misses cluster
    •  Relaxing friction where controls are too heavy for low risk uses
  
  

Resources:
'Failure at scale': The AI risk that can tip business into chaos
Designing Incident Reporting Systems for Harms from General-Purpose AI

Please contact Jesus Gonzalez with any questions.

About Aon

Aon (NYSE: AON) exists to shape decisions for the better — to protect and enrich the lives of people around the world. Through actionable analytic insight, globally integrated Risk Capital and Human Capital expertise, and locally relevant solutions, our colleagues provide clients in over 120 countries with the clarity and confidence to make better risk and people decisions that help protect and grow their businesses.

Follow Aon on LinkedIn, X, Facebook and Instagram. Stay up-to-date by visiting Aon’s newsroom and sign up for news alerts here.

©2026 Aon plc. All rights reserved.

Aon is not a law firm or accounting firm and does not provide legal, financial or tax advice. Any commentary provided is based solely on Aon’s experience as insurance practitioners. We recommend that you consult with your own legal, financial and/or insurance advisors on any commentary provided herein. All descriptions, summaries or highlights of coverage described herein are for general informational purposes only and do not amend, alter or modify the actual terms and conditions of any relevant policy. Coverage is governed only by the terms and conditions of such policy. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details.

The information contained in this document and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity.

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates.