Chicago Business Attorney Blog
For twenty years, “cybersecurity” meant one thing for most business owners: protect the network. Firewalls, endpoint protection, employee training on phishing emails. You knew what you were defending and you generally knew what your insurance covered if you failed.
That model is already out of date.
Attackers have shifted targets. Instead of only breaking into your servers, they are going after the AI tools your business now runs on: the chatbot on your website, the AI agent your vendor plugged into your CRM, the automated workflow that reads your inbox and drafts responses. And the legal and insurance world has not caught up to the speed of that shift, which means a lot of business owners are exposed in ways they do not know about yet.
The Attack Surface Changed and Most Businesses Did Not Notice
Security researchers have been blunt about this. Attackers are not necessarily trying to “hack the model” the way you might picture a movie villain cracking a password. Instead, they are targeting the connective tissue around AI systems, the training data, the third party tools an AI agent is allowed to touch, the permissions it was granted to move data or take action on your behalf. Manipulate those connections and you can get an AI system to leak sensitive information or take actions nobody at your company ever approved.
Here is the part that should get every business owner’s attention. Industry research shows a wide majority of organizations, over 80 percent are already planning to deploy agentic AI capabilities into daily operations. Less than a third say they are actually ready to operate those systems securely. That gap between adoption and readiness is exactly where attackers are working right now, and it is exactly where your liability exposure lives too.
This is not a future problem. It is a this year problem. If your business uses any AI tool that touches customer data, financial information, scheduling, communications, or decision making, you have already inherited a new category of risk, whether you asked for it or not.
Your Insurance Policy May Already Have Quietly Changed
Here is where this stops being purely an IT conversation and becomes a legal one.
In January 2026, the Insurance Services Office, the organization that writes the standard policy language most commercial carriers use, rolled out new endorsements that specifically carve AI related claims out of general liability coverage. These changes have already started showing up in renewal packets most business owners have no idea the exclusion is even in there.
Think about what that means in practice. Your business adopts a helpful new AI tool. That tool gets manipulated by an attacker, or it malfunctions and exposes customer data, or it makes a decision that harms a third party. You file a claim assuming your general liability policy has you covered the way it always has. Instead you find out the AI carve out applies, your claim gets denied, and your business is left holding the full cost of the incident alone.
This is not a hypothetical. It is happening at renewal right now, quietly, buried in endorsement language most owners never read line by line.
Four Ways This Shows Up in Real Business Situations
You do not need to run a tech company for this to apply to you. Here are the situations coming up most often for businesses right now.
- An AI powered chatbot or customer service tool gets manipulated into revealing customer data it was never supposed to share.
- A vendor’s AI tool that your business relies on fails or gets compromised, and your operations or your customers’ data get caught in the fallout, even though the failure originated outside your own systems.
- An employee uses an AI tool without IT’s knowledge or approval, sometimes called shadow AI, and that tool becomes the entry point for a breach.
- A deepfake voice or video is used to impersonate an executive and authorize a fraudulent payment or data transfer, a tactic that is becoming standard rather than rare.
In every one of these scenarios, the question is the same. Whose responsibility is it, what does your contract with the vendor say, and does any policy you are paying for actually respond to the claim.
Why This Is a Contracts and Liability Problem Before It Is an IT Problem
Business owners tend to hand this whole topic to their IT provider and move on. That is a mistake. The technical fix, patching a vulnerability, tightening permissions, is only half the picture. The other half lives in your contracts and your coverage, and that is squarely legal territory.
Every vendor agreement involving an AI tool should answer a few basic questions before you sign it. Who is liable if the AI tool malfunctions or gets manipulated. Does the vendor carry its own coverage for AI related incidents, and does that coverage actually extend to you as the customer, or only to the vendor itself. What does your indemnification language say when the failure originates on the vendor’s side but the damage lands on your business and your customers.
Most standard vendor contracts were written before any of this was a consideration. They were not built for a world where the tool itself can be manipulated into acting against your interests. If your contracts have not been reviewed since the AI tools got added to your operations, they are almost certainly out of date.
What to Do About It Now
A few concrete moves protect you here, and none of them require you to become a cybersecurity expert.
- Pull your current general liability and cyber policies and ask your broker directly whether the January 2026 AI exclusions apply to you.
- Get a straight answer on whether you need a standalone AI liability or updated cyber endorsement, rather than assuming your existing coverage still applies.
- Have every vendor contract involving an AI tool reviewed for liability allocation, indemnification, and data responsibility, not just data privacy boilerplate.
- Put a written policy in place around which AI tools employees are authorized to use, so shadow AI does not become your biggest unmonitored risk.
None of this is complicated once someone walks you through it. It is complicated to figure out alone, buried in policy endorsement language and vendor terms of service you were never trained to parse.
The Bottom Line
The attackers moved fast. The insurance industry is scrambling to catch up. Most business owners have not been told any of this is happening. If your business runs on any AI tool today, the smartest move is finding out exactly where your liability actually sits before an incident forces you to find out the hard way.
About George Bellas
George Bellas is a business attorney at Bellas & Wachowski in Chicago, where he advises business owners on contracts, liability exposure, and the legal risks that come with adopting new technology. As AI tools become standard across daily operations, George helps clients review vendor agreements, close coverage gaps, and put practical safeguards in place before a problem becomes a lawsuit. If your business has adopted AI tools and you are not certain where your liability actually stands, schedule a consultation with George Bellas today at 800.825.9260 or visit bellas-wachowski.com.