External exposures: AI-enabled cyber threats

The benefits of AI are not limited to legitimate businesses. The growing sophistication of AI-enhanced cyber threats means threat actors can now use AI to scale phishing campaigns, mimic writing style, generate convincing fraudulent communications and support more effective social engineering attempts.

Law firms are attractive targets, and as a result, so are their vendors. Firms hold sensitive client information and operate under time pressure. Putting sensitive information into AI tools, even approved ones, creates opportunities for attackers. AI makes it easier for attackers to produce more credible phishing emails, impersonation attempts, and fraudulent requests.

This creates a dual exposure: Firstly, there are the direct costs of a cyber event; business interruption, forensic investigation, breach response, regulatory scrutiny and breaches and reputational damage. There may be client exposure, with confidential information compromised, deadlines missed, or transactions disrupted all of which would result in breaches of civil liability and/or negligence.

Managing the exposure

Maintaining an inventory of AI tools in use and classifying them by risk is key to beginning to mitigate the firms exposure to the negative impacts of AI. Not every use case carries the same exposure. Administrative or internal support tools may be relatively low risk. Tools used in legal research, drafting, client advice, disclosure, HR or decision-making are high risk and require stronger controls and procedures for use.

A clear AI policy is required to identify approved tools, prohibit or minimise uses, escalation routes, review requirements, and data-handling rules. It should set out what information must never be posted onto public platforms and the level of human review required before AI-assisted output is used externally especially in advising clients.

To improve awareness and set a minimum level of skill, a training programme should be implemented. Staff need practical guidance on what the tool is, what it can access, its reliability, and when its output must be checked or rejected. Comprehensive training supports more defensible behaviour across the firm and reduces the likelihood of misuse through misunderstanding or convenience.

Controls should extend to procurement and incident response. Supplier contracts should address confidentiality, security, data use, audit rights, business continuity, intellectual property, indemnities and liability caps. Incident response plans should also reflect AI-specific scenarios, such as data leakage through prompts, compromised knowledge repositories or AI-assisted fraud attempts.

From an insurance perspective, firms should also review how AI-related exposures interact with their existing programme. Depending on the firm’s use of AI, this may engage professional indemnity, cyber, directors’ and officers’ liability, employment practices liability or technology-related covers. A firm needs to be aware of where a claim might arise and which policy or policies will respond to it to avoid any gaps in coverage. Underwriters are beginning to ask questions about AI exposure and expect firms to be proactively managing the risk.

An example of such questions are as follows;

How has the AI tool been selected and to what extent has the terms and conditions been reviewed for exposures?

What is the purpose of the AI being used and has the practice set out a clear set of circumstances where they consider AI to be used and where it is not?

What AI training has the practice provided to its staff on the grounding and framing of AI and what procedures are in place to assess the outputs for accuracy and acceptability?

A managed approach

AI offers a real opportunity, but the firms most likely to benefit will be those that approach it in the same way they approach any other evolving exposure: with clear accountability, robust oversight, and proportionate controls aligned with their usage. Speed of adoption will give firms a competitive advantage. Ensuring its risk is properly governed will help it last.