Is your bank ready for the AI revolution? With virtual assistants often resolving customer queries in seconds, AI is transforming the financial industry—but at what cost? From data breaches to job cuts and liability risks, discover how banks can balance innovation with protection in this changing environment.

In 2018, Bank of America launched the first AI-powered virtual assistant for bank customers. Virtual Assistant Erica has since had more than two billion interactions with customers. Erica supports individual and corporate clients and assists with various tasks, from locating transactions to helping with fund transfers or bill payments and monitoring recurring subscriptions. On average, Erica resolves a customer request within just 44 seconds.¹

Erica was one of the first AI-powered chatbots used by a bank, but it will not be the last. According to a recent study by Citi, AI is projected to boost banking sector profits by 9%, or $170 billion, by 2028. It is anticipated that a growing number of banks will use AI for various functions, including personalized assistance, fraud monitoring, credit risk assessments, and even wealth management advice.²

RELIANCE ON BIG TECH AND THE RISK OF SYSTEMIC FAILURE

One of the biggest risks associated with AI use in banking and the financial services industry is the protection of client data. Traditionally, banks have managed their own processes for safeguarding data and complying with client data regulations. However, the use of AI introduces a third party to the data-protection process as AI chatbots are not typically developed by the bank itself. This means the tech company powers the chatbot, collects client data from chatbot conversations, and may even store that data on its servers.

Also at issue is the limited number of tech companies providing AI services to banks and financial services companies. At a June 2024 banking executive conference in Amsterdam, bank leaders expressed concern about overreliance on Big Tech to provide AI services to the industry.³ Some feel it is not feasible for a bank to build this kind of technology independently, so banks rely on Big Tech to provide the software and capabilities. However, reliance on one tech company or a small number of companies is one of the biggest risks of AI integration.³

Even Big Tech companies are vulnerable to hacks and data breaches. In November 2024, Amazon was the victim of a data breach that exposed sensitive information about 2,000 of its employees.⁴ In February 2023, Microsoft suffered a hack that leaked sensitive information about 20,000 Department of Defense (DOD) officials. That breach led to a “very candid discussion” between the Department of Defense and Microsoft about Microsoft’s contract with the DOD.⁵

If Big Tech companies have data vulnerabilities with their own data or DOD data, then it makes sense that they may also have vulnerabilities around data belonging to banks and financial institutions, which brings a bevy of questions to the surface:

• What is the bank’s liability if customers’ financial data is breached via the tech provider’s servers?
• What is the exposure of the bank’s directors and officers in the event of a data breach at the tech vendor?
• Does the contract between the bank and the tech vendor specify who is liable in the event of a breach?
• Can the bank easily exit its contract with the tech vendor if it has data security concerns?
• Do the bank’s Directors and Officers (D&O) or Cyber policies cover losses related to a data breach at a vendor?

AI use cases are evolving so rapidly that many of these questions do not have a precedent. The industry is sailing into uncharted waters. While the productivity and profits that come from AI may be enticing, the risks associated with a data breach are significant.

EMPLOYMENT PRACTICES LIABILITY (EPL) RISK

The allure of AI in the banking industry stems from its ability to perform tasks at a much faster rate than employees. Spanish bank BBVA has seen that result firsthand in its contract with OpenAI, the developer of ChatGPT.

In 2024, the bank became one of OpenAI’s biggest financial services customers, purchasing licenses for employees to use ChatGPT across a broad spectrum of bank functions. Six months later, 80% of employees with licenses reported that AI reduced their workload by an average of two hours per week. That’s nearly 6,000 hours of work per week being replaced by AI, and the bank planned to expand its license purchase in 2025.⁶

The unspoken, underlying message in the banking industry’s attraction to AI is simple - the technology can reduce the need for human employees. While most banks will not say so explicitly, the intent is clear. A bank in Italy has directly announced its plans to replace employees with AI - eliminating 9,000 jobs, 10% of its workforce, by 2027. Those jobs will be replaced by 3,500 “young people,” many of whom will be on hybrid contracts and run AI scripts to execute bank functions. Another Italian bank, also announced it would eliminate 10% of its workforce due to AI-fueled gains in productivity.⁷

However, a strategy that involves replacing employees with AI could generate significant EPL exposures. For example, if older employees are forced out, could the bank be vulnerable to age discrimination lawsuits? What if a bank were to limit overtime, bonuses, or other flexible pay because of work performed by AI? How could mass layoffs due to AI impact a bank’s image and brand?

Again, these are questions without precedent, so they are impossible to answer at this stage. But given the litigious nature of the industry, it is not difficult to imagine lawsuits arising out of a bank’s plan to replace human workers with AI. Before embarking on a strategy that eliminates or reduces human workforce hours, banks and their insurance agents should review their EPL coverage to assess how damages may be covered.

ERRORS & OMISSIONS (E&O) RISK

Another significant risk is the possibility of the financial institution’s AI giving clients incorrect information. There are many examples of AI, even those powered by Big Tech companies, providing incredibly inaccurate information.

In April 2024, New York City Mayor Eric Adams reported that the city’s virtual assistant, MyCity Chatbot, would stay online even after the chatbot provided incorrect information on a wide range of topics, including funeral services, laws about cashless stores, and landlord responsibilities.⁸ Google’s own chatbot has told users that it’s healthy for people to stare at the sun for up to 30 minutes and that the correct way to make a pizza is by gluing the ingredients together.⁹

A study by Nature found that bigger is not always better when it comes to AI. In theory, an LLM-based AI model is supposed to learn from each question and response. As it gives more answers, it should become more accurate. The reality, according to the study, is that these models often just learn how to appear more accurate without becoming more accurate.¹⁰

Of course, a human customer service representative, lending agent, or wealth advisor who provides inaccurate information would also create significant issues for a bank. The question is whether the bank’s E&O policy would protect the bank against inaccurate information from an AI chatbot like it would in the case of a human employee.

That hypothetical is likely to become a real scenario at some point. It is not a case of “if” but “when” a banking AI chatbot provides inaccurate data, information, or advice to banking customers. Such a scenario will test the limits of traditional E&O policies and may not be covered, depending on the policy’s language regarding technology.

WHAT IS THE FUTURE OF AI INSURANCE COVERAGE IN BANKING?

It is impossible to predict how the insurance industry will manage AI risks across the banking industry. However, two things are clear. First, banks will continue to expand their use of AI because the potential gains in productivity and profits are too attractive to ignore. Secondly, there will be liability issues that arise from AI usage. They could come from data breaches, employment practice issues, erroneous information provided by AI, or a combination of all three. How those issues are handled will likely set a precedent within the industry.

One possibility is that insurance carriers will treat AI much like they treat biometrics; they’ll simply exclude them from coverage. Many policies in various lines include biometric exclusions, and carriers have gone to court to enforce those exclusions.

REGULATORY EXPOSURE: NAVIGATING UNCERTAIN TERRAIN

Much like the evolution of cyber liability, the regulatory landscape for AI in banking is in its infancy. Bank regulators have yet to form concrete opinions or implement enforcement actions, but this regulatory oversight is inevitable. As AI technologies become integral to banking operations, regulators will likely develop mandates that institutions must comply with to ensure transparency, fairness, and security. This future scrutiny introduces additional layers of complexity and potential liability for banks, as they may need to swiftly adapt to evolving standards while navigating uncertainties around compliance. Proactively addressing these issues, including assessing policy language and ensuring regulatory preparedness, is critical for banks to mitigate exposure and maintain operational resilience.

BOTTOM LINE

It is difficult to predict exactly how AI-related risks will impact banks and the insurers who cover them. However, it is a certainty that as usage of AI expands, the risks and liabilities will increase. Agents can best serve their banking and financial services clients by staying well-informed about developments in this fast-moving market.

An experienced and knowledgeable wholesale broker can help retail agents and their financial services clients find the protection that best fits their evolving needs. Contact your CRC broker today to learn more about protecting against AI-related risks.

CONTRIBUTORS

• Mark Waldeck has been President of CRC Chicago since 2013 and has more than 35 years of insurance industry experience.

END NOTES

1. BofA’s Erica Surpasses 2 Billion Interactions, Helping 42 Million Clients Since Launch, Bank of America, April 8, 2024. https://newsroom.bankofamerica.com/content/newsroom/press-releases/2024/04/bofa-s-erica-surpasses-2-billion-interactions--helping-42-millio.html
2. Citi Publishes New Report on AI in Finance, Citi, June 20, 2024. https://www.citigroup.com/global/news/press-release/2024/citipublishes-new-report-ai-in-finance
3. Banks say growing reliance on Big Tech for AI carries new risks, Reuters, June 7, 2024. https://www.reuters.com/technology/banks-saygrowing-reliance-big-tech-ai-carries-new-risks-2024-06-07/
4. Amazon Confirms Employee Data Was Exposed Through MOVEit Breach, Forbes, November 11, 2024. https://www.forbes.com/sites/larsdaniel/2024/11/11/amazon-confirms-data-breach-exposed-2800000-lines-of-employee-data/
5. Post-data breach, DoD held ‘very candid discussions’ with Microsoft, Defensescoop, May 14, 2024. https://defensescoop.com/2024/05/14/post-data-breach-dod-microsoft-discussions-john-sherman/
6. Six Months, Thousands of GPTs and Some Big Unknowns: Inside OpenAI’s Deal With BBVA, Wall Street Journal, November 21, 2024. https://www.wsj.com/articles/six-months-thousands-of-gpts-and-some-big-unknowns-inside-openais-deal-with-bbva-5d6f1c03
7. Intesa Sanpaolo to cut 9,000 jobs in AI-fueled push, BankingDive, October 24, 2024. https://www.bankingdive.com/news/intesasanpaolo-ai-9000-jobs-hybrid-contract-early-retirement-union/730946/
8. After giving wrong answers, NYC chatbot to stay online for testing, Statescoop, April 3, 2024. https://statescoop.com/nyc-mayor-ericadams-chatbot-wrong-answers/
9. Why Google is (probably) stuck giving out AI answers that may or may not be right, Business Insider, May 24, 2024. https://www.businessinsider.com/google-ai-search-bad-answers-risk-peter-kafka-2024-5
10. Study: Even as larger AI models improve, answering more questions leads to more wrong answers, Silicon Angle, September 26, 2024. https://siliconangle.com/2024/09/26/study-even-larger-ai-models-improve-answering-questions-leads-wrong-answers/
11. AI ChatBots Create Risks, Frustration for Bank Customers, Report Says, Kiplinger, July 23, 2023. https://www.kiplinger.com/personalfinance/banking/ai-chatbots-create-risks-frustration-for-bank-customers
12. Banks are excited about AI. Their customers aren’t so sure., BankingDive, September 30, 2024. https://www.bankingdive.com/news/aibanking-customer-concerns-transparency/728441/
13. AI in Banking Chatbots 2024, eMarketer, January 16, 2024. https://www.emarketer.com/content/ai-banking-chatbots-2024