Executive Summary
- Bitkom has published the guide “Verantwortungsvoller KI‑Einsatz: Risiken verstehen, steuern und versichern”.
- The guide shows how AI‑related risks can be identified, structurally assessed, managed and classified for insurance purposes.
- It is aimed at companies as well as insurers, InsurTechs, brokers and specialists and managers in underwriting, risk management and IT security.
- The publication covers governance and security quality factors, typical loss scenarios and questions of insurability and is available for free download.
What happened?
Bitkom has published a guide titled “Verantwortungsvoller KI‑Einsatz: Risiken verstehen, steuern und versichern.” According to the publication, the guide explains which existing loss patterns can be changed or amplified by AI and how AI‑related risks can be structurally assessed, managed and classified from an insurance perspective. The target audience is clearly named: companies in general and, in particular, insurers, InsurTechs, brokers and specialists and managers in underwriting, risk management and IT security. The publication addresses governance and compliance aspects, quality factors of AI governance and AI security, and the classification of typical loss cases. The guide is available for free download on the Bitkom website.
Why does it matter?
The publication is relevant because it takes a practical approach: it links technical and organizational aspects (governance, security) with questions of insurability. For decision‑makers this matters because, according to Bitkom, the insurability of AI risks depends not primarily on the technology itself but on the concrete loss pattern and on how well risks can be controlled through governance, clear responsibilities and effective control mechanisms. The publication also identifies specific challenges posed by agentic AI systems — systems that can independently plan or execute tasks — which, according to Bitkom, place particular demands on control and oversight concepts. In practice this means liability and insurance questions cannot be viewed in isolation but must be embedded in an overall picture of risk identification, organizational due diligence and insurance assessment.
What does this mean for mid-sized companies?
For mid-sized companies the guide is a concrete resource to systematically address internal control and insurance questions. Decision‑makers in mid-sized firms should understand that assessing AI risks involves, beyond technical checks, primarily organizational elements: documenting processes, clear responsibilities, effectiveness of control mechanisms and traceability of decisions. Engaging with typical loss scenarios helps set internal priorities — for example, different measures for internal damages, third‑party losses or reputational risks. At the same time, involving insurers, brokers or InsurTech partners makes sense, because the publication explicitly builds a bridge to the insurance industry and shows which risks can already be classified as insurable and where gaps remain. In short: mid‑sized companies should address risk and insurance questions around AI use early and in an interdisciplinary way.
Related: AI Readiness Check
Recommendation from Future AI Solutions
Factual and pragmatic, we recommend the following action plan for decision‑makers in mid‑sized companies:
- Download and read the guide: Use the free Bitkom publication as an entry point to systematic assessment of AI risks.
- Create a risk inventory: Identify which AI components are used in your processes and which concrete loss scenarios could arise from them.
- Strengthen governance: Establish clear responsibilities, documented approval and control processes, and traceability and audit mechanisms; according to Bitkom, insurability depends significantly on these quality factors.
- Review insurance position: Talk to your broker or insurer about the classification of concrete loss scenarios and review existing policies for coverage and exclusions.
- Introduce agentic systems cautiously: Treat systems with extended scope for action as particularly sensitive and verify control and escalation mechanisms before putting them into production.
- Take an interdisciplinary approach: Involve legal, IT security, risk management and the business units in decisions about AI deployment.
These steps are not guarantees, but they reflect the central recommendations and findings of the Bitkom publication and help to systematically address liability and insurance questions related to AI deployment.