Insurance agencies can reduce AI risk by approving tools, restricting data access, requiring human review, and preparing for outages. Clear rules help employees use AI confidently while protecting clients and the agency.
During Catalyit’s GetLYIT conference, Ryan Smith, president of Ready State Cybersecurity, explained how to put those safeguards into practice.
His central message: Give employees clear boundaries so they know what they can use, what they can share, and when someone must check the work.
Smith outlined three core risks: exposing private information, relying on inaccurate results, and losing access to tools the agency depends on.
These align with the cybersecurity principles of confidentiality, integrity, and availability.
| Risk | What it means | Agency example |
|---|---|---|
| Confidentiality | Protecting private information | Client documents enter an unapproved AI tool |
| Integrity | Maintaining accuracy and trust | An AI summary misstates a policy exclusion |
| Availability | Keeping work moving | An AI outage interrupts client service |
Assess both likelihood and impact. A vendor may manage the technology, but the agency controls which data it shares, what access it grants, and how it uses the results.
NIST’s Generative AI Profile also identifies privacy, information integrity, and information security as areas organizations should address. Read NIST’s guidance.
Shadow AI is the use of AI tools without leadership or IT approval.
It can include personal accounts, browser extensions, and AI features inside existing software. Without visibility, the agency may not know where client information goes or which systems a tool can access.
Ask employees how they already use AI. Identify useful tasks, explain the boundaries, and give them an approved way to experiment.
Make the approved path easy to follow.
An AI policy should define approved tools, permitted tasks, data restrictions, and review requirements.
Employees should be able to answer six questions:
Leadership also needs a process for evaluating, introducing, reviewing, and retiring AI tools.
Train employees on these rules and document their acknowledgment. A policy buried in a shared folder will not guide daily decisions.
Limit what goes into AI and what AI can reach.
Smith recommended starting with a data inventory. Sensitive information may live in email, shared folders, desktops, and downloaded files, as well as the agency management system.
Before connecting an AI tool:
This follows least privilege, which means granting only the access needed to perform an assigned task. See NIST’s definition.
Review each product and account separately. Data retention, deletion, training use, and administrative controls can differ.
Require review wherever an error could affect a client, a business decision, or an agency action.
A polished response can still omit an exclusion, misstate a policy term, or misunderstand a request.
Define checkpoints before introducing AI into a workflow:
Assign a reviewer who has the source material and the expertise to evaluate the result. Checking grammar and tone is not enough.
Review what the tool can access, how it handles information, and what the agency can control.
Include AI features within existing software. A new assistant or connector can change how a familiar product interacts with agency data.
Ask vendors:
Maintain an AI inventory that records each tool’s purpose, owner, data access, connected systems, and approval status.
Update it when features, permissions, or uses change.
Prepare a fallback for every important workflow that depends on AI.
An outage should not leave employees guessing how to process work or respond to clients.
Document:
Test the fallback. Confirm that employees can complete the work without the AI service.
Start with fictional data and a narrow task.
Smith recommended creating a realistic sample client or account before testing a process that may eventually involve sensitive information.
For example, use a fictional business and sample documents to test a summary workflow. Check for missing details, unsupported statements, and unexpected actions.
Limit access during testing. Where available, set usage limits and spending alerts for automated processes.
A successful test demonstrates performance under specific conditions. Review data permissions and controls before introducing real client information.
Build visibility, set rules, and test one use case.
Start with these steps:
Expand when the agency understands the workflow’s performance, risks, and ownership.
Clear boundaries give employees room to work confidently and make better decisions.
Watch Ryan's Session On-Demand
AI guardrails are technical controls and workplace rules that define how AI may be used. They include approved tools, restricted access, data handling rules, human review, and backup procedures.
Only when agency policy permits that information in the specific tool and account. Approval should account for the data, intended use, vendor terms, and applicable obligations.
No. Agencies still need appropriate settings, limited permissions, employee training, and review of consequential outputs.
Record each tool’s purpose, owner, users, connected systems, data access, and approval status. Include AI features in software the agency already uses.