The share of C-suite leaders and board members rating technology risk as high impact nearly doubled in 12 months, according to Clyde & Co's Corporate Risk Radar 2026, while Australia's prudential regulator independently concluded that AI adoption is outpacing the governance frameworks designed to contain it. The findings carry direct implications for insurance professionals, from cyber underwriting and D&O liability to compliance obligations and product design.
The survey of 700 senior decision-makers across eight regions and 10 sectors found 86% now rate technology risk as high impact, a 40-percentage-point jump from 46% in 2025. Three in four organisations admitted that AI, data privacy and cybersecurity requirements are shifting faster than their teams can absorb, and only 68% reported having a mature AI governance framework in place.
APRA finds governance gap independently
On April 30, 2026, the Australian Prudential Regulation Authority (APRA) issued a letter to regulated entities stating current approaches to governance, risk management, assurance and operational resilience are not keeping pace with the scale, speed and complexity of AI adoption. The letter followed a targeted supervisory review across insurance, banking and superannuation.
APRA member Therese McCarthy Hockey said: "What we've observed from our supervisory engagement is that while AI adoption is continuing apace, the systems and processes required to safely govern its use aren't keeping up. Likewise, the speed at which entities can identify and patch vulnerabilities needs to operate much faster, commensurate with the AI-accelerated threat." Common attack pathways include prompt injection, data leakage, insecure integrations and manipulation of autonomous AI agents, APRA noted. ASIC reinforced the urgency, calling for demonstrably effective cyber risk management proportionate to business size and complexity.
For brokers, the cyber market presents a clear distribution opportunity. APRA quarterly data shows the cyber class posted positive insurance service results in each of the three most recent quarters, yet gross written premium remains tiny - $32 million in the March 2026 quarter, less than 0.2% of total industry GWP. Premiums fell roughly 10% through 2025, according to EBM Insurance and Risk, even as the Australian Cyber Security Centre recorded 84,700 cybercrime reports - one every six minutes - with average costs up 14% for small businesses and $202,691 for large organisations.
D&O coverage feels regulatory squeeze
Compliance burden rated high impact for 85% of leaders, up from 54% in 2025, and the effect is already flowing into D&O lines. After premium reductions of 15% to 40% in 2025, a shift from shareholder class actions toward derivative action claims is anticipated in 2026, driven by governance and compliance failures. Insurers are expected to reduce derivative action cover and apply smaller sub-limits for directors and officers of companies that have faced prosecution by ASIC, ACCC, APRA or AUSTRAC.
Rebecca Kelly, managing partner at Clyde & Co Australia, pointed to disclosure obligations as the fault line: "Most serious regulatory breaches arise from failures to disclose. Companies face very short timeframes to disclose and act in the company's best interests. The reputational risk is equally significant, as consequences can be immediate and played out publicly."
Australia's Financial Accountability Regime extended to insurance entities and superannuation trustees from March 2025, and CPS 230 operational risk management requirements took effect the same year, raising the bar for directors and executives.
Geopolitical risk demands a different playbook
Seventy-two percent of organisations reported a direct commercial impact from geopolitical volatility, up from 49% a year ago. APRA's November 2025 System Risk Outlook flagged heightened risks from overseas and a dedicated geopolitical risk work programme launched with the Council of Financial Regulators.
"Process-driven compliance is manageable - you establish the framework and follow it," Kelly said. "The challenge for clients is preparing for geopolitical risk, which arises without warning and affects parts of the business you would not anticipate." Unlike rule-based obligations, geopolitical shocks resist the governance playbooks most organisations rely on.
Cascading risks pressure coverage frameworks
Close to six in 10 leaders said overlapping risks - rather than any single threat - are now the primary barrier to effective risk management. Technology implementation and systems integration was the leading pressure point at 72%. The pattern challenges insurance products built around discrete, bounded perils: a technology failure can cascade into a regulatory breach and then a D&O claim, for example, straining traditional coverage silos.
Why this matters for insurance professionals
The regulatory signals and risk data make AI governance literacy urgent for insurance professionals; resources such as AI for Insurance training address this emerging need. Underwriters and brokers must now assess a client's AI governance maturity as a core factor in placing cyber and D&O coverage. A healthy cyber market with falling premiums masks rapid escalation in underlying threat - a mismatch that demands deeper scrutiny of limits, exclusions and client readiness. AI governance is no longer a future concern; it is a present supervisory expectation with direct consequences for claims frequency, severity and insurability.
Your membership also unlocks:
