[{"data":1,"prerenderedAt":1698},["ShallowReactive",2],{"site-nav-content":3,"hiring-banner-content":177,"blog:\u002Fblog\u002Fmerger-diligence-when-the-target-runs-on-assistants":189,"blog-index-copy":704,"blog:\u002Fblog\u002Fmerger-diligence-when-the-target-runs-on-assistants:surround":725,"site-cta-content":1679},{"header":4,"productNav":9,"nav":42,"footer":61,"askAI":132,"id":161,"title":162,"archived":163,"authors":164,"badge":164,"body":165,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":173,"relatedHeading":164,"seo":174,"series":164,"sitemap":163,"status":164,"stem":175,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":176},{"productLabel":5,"loginLabel":6,"contactLabel":7,"contactSalesLabel":8},"Product","Log in","Contact","Get started for free",[10,14,18,22,26,30,34,38],{"label":11,"to":12,"description":13},"Overview","\u002Foverview","Seven layers. One closed loop.",{"label":15,"to":16,"description":17},"Conflux","\u002Fproduct\u002Fconflux","Where your team, workstreams, and agents meet.",{"label":19,"to":20,"description":21},"Agent Teams","\u002Fproduct\u002Fagent-teams","Specialist teams - governed from day one.",{"label":23,"to":24,"description":25},"Lifecycle Graph","\u002Fproduct\u002Flifecycle-graph","Intelligence that compounds across every interaction.",{"label":27,"to":28,"description":29},"Company Wiki","\u002Fproduct\u002Fwiki","Playbooks and policies where expertise stays.",{"label":31,"to":32,"description":33},"Workstreams","\u002Fproduct\u002Fworkstreams","From brief to signed-off deliverable on one canvas.",{"label":35,"to":36,"description":37},"Perception Console","\u002Fproduct\u002Fperception","Ask your whole business in plain English.",{"label":39,"to":40,"description":41},"Governance","\u002Fproduct\u002Fgovernance","Frontier AI you can actually sign off on.",[43,46,49,52,55,58],{"label":44,"to":45},"Models","\u002Fmodels",{"label":47,"to":48},"Pricing","\u002Fpricing",{"label":50,"to":51},"Integrations","\u002Fintegrations",{"label":53,"to":54},"Security","\u002Fsecurity",{"label":56,"to":57},"Partners","\u002Fpartners",{"label":59,"to":60},"Insights","\u002Fblog",{"productHeading":5,"companyHeading":62,"resourcesHeading":63,"legalHeading":64,"docsLabel":65,"docsUrl":66,"statementLines":67,"copyright":70,"companyLinks":71,"resourcesLinks":86,"legalLinks":102,"socialLinks":109,"bottomLinks":119},"Company","Resources","Legal","Docs","https:\u002F\u002Fdocs.gonimbus.ai",[68,69],"Stop training someone else's model.","Control your AI.","© 2026 Nimbus Intelligence, Inc. All rights reserved.",[72,73,74,75,76,78,81,84],{"label":47,"to":48},{"label":50,"to":51},{"label":53,"to":54},{"label":59,"to":60},{"label":77,"to":57},"Partner Program",{"label":79,"to":80},"Careers","\u002Fcareers",{"label":82,"to":83},"System status","\u002Fstatus",{"label":7,"to":85},"\u002Fcontact",[87,90,93,96,99],{"label":88,"to":89},"Glossary","\u002Fglossary",{"label":91,"to":92},"Compare","\u002Fcompare",{"label":94,"to":95},"Evaluate","\u002Fevaluate",{"label":97,"to":98},"Problems","\u002Fproblems",{"label":100,"to":101},"Use cases","\u002Fuse-cases",[103,106],{"label":104,"to":105},"Terms of Service","\u002Fterms",{"label":107,"to":108},"Privacy Policy","\u002Fprivacy",[110,113,116],{"label":111,"href":112},"LinkedIn","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fgonimbusai\u002F",{"label":114,"href":115},"X","https:\u002F\u002Fx.com\u002Fgonimbusai",{"label":117,"href":118},"Instagram","https:\u002F\u002Fwww.instagram.com\u002Fgonimbus_ai\u002F",[120,122,124,127,128],{"label":121,"to":105},"Terms",{"label":123,"to":108},"Privacy",{"label":125,"to":126},"Compliance","\u002Fcompliance",{"label":82,"to":83},{"label":129,"to":130,"external":131},"LLMs.txt","\u002Fllms.txt",true,{"text":133,"prompt":134,"platforms":135},"Ask AI about Nimbus","I'm researching enterprise intelligence platforms and want to know how Nimbus combines perception, collaboration, and autonomous agents to drive strategic decision-making. Summarize the highlights from Nimbus's website: https:\u002F\u002Fgonimbus.ai",[136,141,146,151,156],{"name":137,"label":138,"icon":139,"hrefPrefix":140},"chatgpt","ChatGPT","simple-icons:openai","https:\u002F\u002Fchatgpt.com\u002F?prompt=",{"name":142,"label":143,"icon":144,"hrefPrefix":145},"perplexity","Perplexity","mdi:magnify","https:\u002F\u002Fwww.perplexity.ai\u002Fsearch\u002Fnew?q=",{"name":147,"label":148,"icon":149,"hrefPrefix":150},"grok","Grok","simple-icons:x","https:\u002F\u002Fx.com\u002Fi\u002Fgrok?text=",{"name":152,"label":153,"icon":154,"hrefPrefix":155},"claude","Claude","simple-icons:anthropic","https:\u002F\u002Fclaude.ai\u002Fnew?q=",{"name":157,"label":158,"icon":159,"hrefPrefix":160},"google-ai","Google AI","simple-icons:google","https:\u002F\u002Fwww.google.com\u002Fsearch?udm=50&aep=11&q=","content\u002Fshared\u002Fnav.md","Site navigation",false,null,{"type":166,"value":167,"toc":168},"minimark",[],{"title":169,"searchDepth":170,"depth":170,"links":171},"",2,[],"md","\u002Fshared\u002Fnav",{"title":162,"description":169},"shared\u002Fnav","Q7sDe7TuGEwhwUMamyeOxjvGlsUaF3Iay9VTW0KaE_U",{"enabled":163,"message":178,"linkLabel":79,"linkHref":80,"id":179,"title":180,"archived":163,"authors":164,"badge":164,"body":181,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":185,"relatedHeading":164,"seo":186,"series":164,"sitemap":163,"status":164,"stem":187,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":188},"We're hiring! Join the team building the Sentient Enterprise.","content\u002Fshared\u002Fhiring.md","Hiring banner",{"type":166,"value":182,"toc":183},[],{"title":169,"searchDepth":170,"depth":170,"links":184},[],"\u002Fshared\u002Fhiring",{"title":180,"description":169},"shared\u002Fhiring","1zs3boivKda1e-b-hAyuNcmZSKjZUAXmecnwHVgcHzk",{"id":190,"title":191,"archived":163,"authors":192,"badge":196,"body":198,"date":679,"definedTerm":164,"department":164,"description":680,"extension":172,"eyebrow":164,"faqHeader":681,"faqs":684,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":694,"relatedHeading":164,"seo":695,"series":696,"sitemap":131,"status":164,"stem":697,"subhead":164,"tags":698,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":703},"content\u002Fblog\u002Fmerger-diligence-when-the-target-runs-on-assistants.md","M&A Diligence Is Missing the Unlogged Prompts Behind the Research",[193],{"name":194,"to":195},"Nimbus Research","https:\u002F\u002Fgonimbus.ai",{"label":197},"Thought Leadership",{"type":166,"value":199,"toc":671},[200,204,213,218,221,233,249,265,332,336,339,352,355,363,446,450,453,456,459,520,524,527,543,546,607,611,614,617,620,624],[201,202,203],"p",{},"A data room is a theory of the company: the contracts that bind it, the systems that run it, the people who know how. Generative tools have opened a second company beside that one. Prices are proposed in chats that are not the CRM. Customer concessions are drafted in personal accounts. Code is explained by an assistant that saw a repository it was not supposed to retain. The quality of earnings may depend on a process that exists only as habit. Diligence that does not ask about that habit is diligence of a prior decade.",[201,205,206,207,212],{},"This is not a reason to avoid targets that use AI. ",[208,209,211],"a",{"href":210},"https:\u002F\u002Fwww.mckinsey.com\u002Fcapabilities\u002Fquantumblack\u002Four-insights\u002Fthe-state-of-ai","McKinsey’s 2025 survey"," suggests you will struggle to find a target that does not: 88 percent of organisations report use in at least one function. It is a reason to stop treating “AI strategy” as a management presentation and start treating it as a set of workflows with owners, logs, and failure modes. The presentation will be optimistic. The workflows will be where the indemnity lives.",[214,215,217],"h2",{"id":216},"what-you-are-actually-buying","What you are actually buying",[201,219,220],{},"You are buying three things that do not appear in a software inventory.",[201,222,223,227,228,232],{},[224,225,226],"strong",{},"Dependence."," Which revenue or cost processes stall if a particular model, plugin, or personal subscription disappears? A customer-support flow that “uses AI” may in fact depend on a consumer account a supervisor pays for. ",[208,229,231],{"href":230},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fworklab\u002Fwork-trend-index\u002Fai-at-work-is-here-now-comes-the-hard-part","Microsoft’s Work Trend Index"," found that 78 percent of AI users bring their own tools. In a target, that statistic is a transition risk. On day one those personal accounts are not yours. The knowledge inside them is not in the data room. The person who holds the login may not be in the retention plan.",[201,234,235,238,239,243,244,248],{},[224,236,237],{},"Liability already incurred."," A chatbot that has been making customer promises, a hiring tool that has been rejecting applicants, a drafting aid that has been inserting clauses. The ",[208,240,242],{"href":241},"https:\u002F\u002Fwww.canlii.org\u002Fen\u002Fbc\u002Fbccrt\u002Fdoc\u002F2024\u002F2024bccrt149\u002F2024bccrt149.html","Air Canada decision"," shows a company held to its bot’s words. The ",[208,245,247],{"href":246},"https:\u002F\u002Fwww.eeoc.gov\u002Fnewsroom\u002Fitutorgroup-pay-365000-settle-eeoc-discriminatory-hiring-suit","EEOC’s iTutorGroup settlement"," shows a company held to its screening rule. Neither will be labelled “AI litigation” in the target’s disclosure schedule unless someone asks the operational question: where do automated words or automated rejections touch a person?",[201,250,251,254,255,259,260,264],{},[224,252,253],{},"Claims you may inherit in the market."," If the target has told its customers or its investors that a product is AI-powered in a way the product is not, you are buying a statement. The ",[208,256,258],{"href":257},"https:\u002F\u002Fwww.sec.gov\u002Fnewsroom\u002Fpress-releases\u002F2024-36","SEC’s March 2024 cases"," against advisers who described AI they did not run are the template. Read the website as an examiner would. The ",[208,261,263],{"href":262},"https:\u002F\u002Fwww.ftc.gov\u002Fbusiness-guidance\u002Fblog\u002F2023\u002F02\u002Fkeep-your-ai-claims-check","FTC’s guidance on AI claims"," is a useful checklist for the buyer’s counsel, not only for the seller’s marketing team.",[266,267,268,286],"table",{},[269,270,271],"thead",{},[272,273,274,278,280,283],"tr",{},[275,276,277],"th",{},"What the inventory will not show",[275,279,217],{},[275,281,282],{},"The question that prices it",[275,284,285],{},"If the answer is empty",[287,288,289,304,318],"tbody",{},[272,290,291,295,298,301],{},[292,293,294],"td",{},"A consumer subscription a supervisor pays for",[292,296,297],{},"Dependence. The process stalls when the login walks",[292,299,300],{},"Which revenue or cost process stops if this account disappears on day one?",[292,302,303],{},"Transition risk. Budget a sanctioned path before close, not after",[272,305,306,309,312,315],{},[292,307,308],{},"A bot that has been offering remedies, or a screener that has been rejecting people",[292,310,311],{},"Liability already incurred",[292,313,314],{},"Where do automated words or automated rejections touch a person?",[292,316,317],{},"It will not be on the disclosure schedule. Ask the operator",[272,319,320,323,326,329],{},[292,321,322],{},"“AI-powered” on the site or in the deck",[292,324,325],{},"A statement you inherit",[292,327,328],{},"Can someone show the capability the adjective describes?",[292,330,331],{},"Strike it before the joint press note, or you chose the exhibit",[214,333,335],{"id":334},"questions-for-the-first-request-list","Questions for the first request list",[201,337,338],{},"Ask for the inventory of systems that generate text, scores, or actions used in the business, including experiments. Ask which of them can send, post, or change a record in a system of record. Ask for an example log: one customer answer, one internal decision, with the human who approved it if any human did. If the target cannot produce a single example, the process is not controlled. Price that.",[201,340,341,342,346,347,351],{},"Ask what data has been pasted into tools outside the enterprise agreement in the last year, and whether anyone investigated. ",[208,343,345],{"href":344},"https:\u002F\u002Fwww.cnbc.com\u002F2023\u002F05\u002F02\u002Fsamsung-bans-use-of-ai-like-chatgpt-for-staff-after-misuse-of-chatbot.html","Samsung’s experience",", reported widely in 2023, is no longer an exotic anecdote. It is a pattern. ",[208,348,350],{"href":349},"https:\u002F\u002Fnewsroom.ibm.com\u002F2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls","IBM’s 2025 figures"," — shadow AI in one in five studied breaches, 97 percent of AI-related breaches lacking access controls — belong in the risk memo even if the target’s own incident log is empty. An empty log may mean an empty practice of looking.",[201,353,354],{},"Ask who owns the model outputs as intellectual property, and whether customer data or employee data was used to improve a vendor model under an old click-through. That clause is often in a team’s “free tier” terms, accepted by someone without authority. It is still a fact about the company’s data.",[201,356,357,358,362],{},"Ask about jurisdictions. A target serving Europeans, hiring globally, or moving personal data into a vendor region needs the privacy answer and, where relevant, the ",[208,359,361],{"href":360},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=OJ:L_202401689","EU AI Act"," answer. “We will comply closer to the deadline” is not diligence. It is a timetable you must fund after close.",[266,364,365,378],{},[269,366,367],{},[272,368,369,372,375],{},[275,370,371],{},"Request",[275,373,374],{},"A complete answer looks like",[275,376,377],{},"How an incomplete answer should move price or the plan",[287,379,380,391,402,413,424,435],{},[272,381,382,385,388],{},[292,383,384],{},"Inventory of systems that generate text, scores, or actions, including experiments",[292,386,387],{},"A list with owners, not a strategy slide",[292,389,390],{},"Missing experiments are where the habit lives. Assume more than you were shown",[272,392,393,396,399],{},[292,394,395],{},"Which of them can send, post, or change a system of record",[292,397,398],{},"Read versus write, per system",[292,400,401],{},"Every write without a named approver is a reserve and a temporary human review",[272,403,404,407,410],{},[292,405,406],{},"One example log: a customer answer and an internal decision, with the human who approved",[292,408,409],{},"The output, not a description of the output",[292,411,412],{},"No example means the process is not controlled. Price that",[272,414,415,418,421],{},[292,416,417],{},"Data pasted outside the enterprise agreement in the last year, and whether anyone looked",[292,419,420],{},"An investigation, or an honest “we did not look”",[292,422,423],{},"An empty log plus no investigation is an empty practice. Use the IBM base rates in the risk memo anyway",[272,425,426,429,432],{},[292,427,428],{},"Who owns outputs, and whether customer or employee data trained a vendor model under a click-through",[292,430,431],{},"The clause, even if someone without authority accepted it",[292,433,434],{},"It is a fact about the company’s data. Counsel reads the free-tier terms",[272,436,437,440,443],{},[292,438,439],{},"Jurisdictions: customers, hiring, and where prompts are processed",[292,441,442],{},"A region, a basis, and a timetable you can fund",[292,444,445],{},"“Closer to the deadline” is a cost after close, not a status",[214,447,449],{"id":448},"the-monday-after-close","The Monday after close",[201,451,452],{},"Whatever the model said in the investment memo, Monday is a list. Personal accounts that touch customer data, code, or unpublished numbers stop, and a sanctioned account exists the same day. If the account does not exist, do not issue the ban. You will teach the acquired team to hide the habit you just paid for. People already route around bans when the official tool is worse. Give them a path, then close the other one.",[201,454,455],{},"Writes pause until an owner and a log exist. Refunds, entitlements, access, public replies. A temporary human review is a cost of close, like a systems freeze. Budget it in the integration plan so it is not “discovered” as a delay. You are on the hook for promises the target’s channel already made. Read the last month of outbound answers before your executives introduce themselves to the target’s customers.",[201,457,458],{},"Public claims get a same-week pass by counsel. Anything on the site or the deck that says the product does something you have not seen is either demonstrated or removed before the joint press note. That demonstration is the whole of the regulatory lesson so far. Buyers who leave the adjectives up because marketing is “not an integration workstream” are choosing the exhibit.",[266,460,461,474],{},[269,462,463],{},[272,464,465,468,471],{},[275,466,467],{},"Monday",[275,469,470],{},"Do this",[275,472,473],{},"Do not do this",[287,475,476,487,498,509],{},[272,477,478,481,484],{},[292,479,480],{},"Personal accounts touching customer data, code, or unpublished numbers",[292,482,483],{},"Close them the same day a sanctioned account exists",[292,485,486],{},"Issue the ban first and provision the path later. The work goes underground",[272,488,489,492,495],{},[292,490,491],{},"Writes: refunds, entitlements, access, public replies",[292,493,494],{},"Pause until an owner and a log exist. Fund the human review as a cost of close",[292,496,497],{},"Discover the pause as a “delay” after the integration plan is locked",[272,499,500,503,506],{},[292,501,502],{},"The last month of outbound answers",[292,504,505],{},"Read them before executives meet the target’s customers",[292,507,508],{},"Assume the website matches the contract",[272,510,511,514,517],{},[292,512,513],{},"Public claims",[292,515,516],{},"Demonstrate or remove, the same week, before the joint note",[292,518,519],{},"Leave the adjective because marketing is not an integration workstream",[214,521,523],{"id":522},"day-thirty-in-four-lines","Day thirty, in four lines",[201,525,526],{},"Report at day thirty with four lines:",[528,529,530,534,537,540],"ul",{},[531,532,533],"li",{},"Jobs now written to a log you can reopen.",[531,535,536],{},"Writes still paused, with the reserve beside them.",[531,538,539],{},"Claims struck from the site and the deck because nobody could show them.",[531,541,542],{},"Shadow paths closed only where a sanctioned path exists.",[201,544,545],{},"An empty line is the next month’s work. Do not average the four lines into “integration on track.” You inherited the sentences already in the market and the promises already made to customers. The four lines are how you stop inheriting the next month’s as well. Put an operator’s name on each line. A workstream with no name is a risk memo. Names are what make day thirty a plan rather than a status colour. Status colours do not survive a customer complaint.",[266,547,548,561],{},[269,549,550],{},[272,551,552,555,558],{},[275,553,554],{},"Line",[275,556,557],{},"Green only if",[275,559,560],{},"If it is empty",[287,562,563,574,585,596],{},[272,564,565,568,571],{},[292,566,567],{},"Jobs on a log you can reopen",[292,569,570],{},"Someone who was not in the deal team can open one customer answer and one internal decision",[292,572,573],{},"Next month’s work. Not “on track”",[272,575,576,579,582],{},[292,577,578],{},"Writes still paused, reserve beside them",[292,580,581],{},"Refunds, entitlements, access, and public replies have an owner, or they are still paused on purpose",[292,583,584],{},"You are issuing promises you cannot reconstruct",[272,586,587,590,593],{},[292,588,589],{},"Claims struck",[292,591,592],{},"Every adjective nobody could demonstrate is off the site and the deck",[292,594,595],{},"You kept the exhibit",[272,597,598,601,604],{},[292,599,600],{},"Shadow paths",[292,602,603],{},"Closed only where the sanctioned path already exists",[292,605,606],{},"A ban without a path is a hidden process you paid for",[214,608,610],{"id":609},"a-call-to-corporate-development-leaders","A call to corporate-development leaders",[201,612,613],{},"Put an operator in the diligence room, not only a lawyer and a banker. The operator should sit with a frontline manager and watch a real job run, including the tabs that are not in the architecture diagram. What you see there is part of the asset and part of the liability.",[201,615,616],{},"Buy the company you can reconstruct. If you cannot reconstruct how it decides, you do not yet know what you are paying for.",[618,619],"hr",{},[214,621,623],{"id":622},"references","References",[528,625,626,631,636,641,646,651,656,661,666],{},[531,627,628],{},[208,629,630],{"href":210},"McKinsey, The State of AI: Global Survey 2025",[531,632,633],{},[208,634,635],{"href":230},"Microsoft and LinkedIn, 2024 Work Trend Index",[531,637,638],{},[208,639,640],{"href":241},"Moffatt v. Air Canada, 2024 BCCRT 149",[531,642,643],{},[208,644,645],{"href":246},"EEOC, iTutorGroup settlement",[531,647,648],{},[208,649,650],{"href":257},"U.S. SEC press release 2024-36",[531,652,653],{},[208,654,655],{"href":262},"U.S. FTC, Keep your AI claims in check",[531,657,658],{},[208,659,660],{"href":344},"CNBC, Samsung restricts generative AI",[531,662,663],{},[208,664,665],{"href":349},"IBM newsroom, 30 July 2025",[531,667,668],{},[208,669,670],{"href":360},"Regulation (EU) 2024\u002F1689",{"title":169,"searchDepth":170,"depth":170,"links":672},[673,674,675,676,677,678],{"id":216,"depth":170,"text":217},{"id":334,"depth":170,"text":335},{"id":448,"depth":170,"text":449},{"id":522,"depth":170,"text":523},{"id":609,"depth":170,"text":610},{"id":622,"depth":170,"text":623},"2026-09-22","Traditional M&A due diligence checks code and contracts, but misses shadow AI agents driving pricing, retention, and customer ops.",{"eyebrow":682,"title":683},"Short answers","Unlogged prompts are part of the price",[685,688,691],{"question":686,"answer":687},"What does traditional diligence miss?","The unlogged prompts that now shape prices, claims, and product decisions. Contracts and code do not show that.",{"question":689,"answer":690},"Why is that a purchase-price issue?","You may be buying a way of working that cannot be reconstructed, plus the customer and regulatory exposure that comes with it.",{"question":692,"answer":693},"What should a buyer ask for?","Where assistants are allowed to act, what they have changed, and whether those changes can be replayed after the people leave.","\u002Fblog\u002Fmerger-diligence-when-the-target-runs-on-assistants",{"title":191,"description":680},"insight","blog\u002Fmerger-diligence-when-the-target-runs-on-assistants",[699,700,701,702],"thought-leadership","mergers","due-diligence","governance","T_WwoUbcKqpNMjvjLoAr0H8WRPx_1E1OQQAQ2RboXc0",{"hero":705,"id":707,"title":708,"archived":163,"authors":164,"badge":164,"body":709,"date":164,"definedTerm":164,"department":164,"description":713,"extension":172,"eyebrow":714,"faqHeader":164,"faqs":164,"footerBand":715,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":60,"relatedHeading":721,"seo":722,"series":164,"sitemap":131,"status":164,"stem":723,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":724},{"filename":706},"u2221455217_Flat_design_of_a_futuristic_minimalist_landscape__5d589295-cdea-4ea9-a262-be766881accf_1.png","content\u002Fblog\u002Findex.md","Exploring the future of intelligence.",{"type":166,"value":710,"toc":711},[],{"title":169,"searchDepth":170,"depth":170,"links":712},[],"Deep dives into pre-cognitive intelligence, sentient enterprises, and the evolving landscape of AI-driven business transformation.","Latest Research",{"headline":716,"description":717,"primaryLabel":718,"primaryTo":719,"secondaryLabel":720,"secondaryTo":12},"Stay at the frontier.","Subscribe for product updates and new insights.","Subscribe","\u002Fnewsletter","Explore the platform","More research",{"title":708,"description":713},"blog\u002Findex","BFSWGYO9bcTlaulivKYWyg08_DJHsdGg3OC6g_CG1Hw",[726,1179],{"id":727,"title":728,"archived":163,"authors":729,"badge":731,"body":732,"date":679,"definedTerm":164,"department":164,"description":1158,"extension":172,"eyebrow":164,"faqHeader":1159,"faqs":1161,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1171,"relatedHeading":164,"seo":1172,"series":696,"sitemap":131,"status":164,"stem":1173,"subhead":164,"tags":1174,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1178},"content\u002Fblog\u002Fmodel-concentration-is-an-operating-risk.md","The Hidden Risk of Single-Model Dependency Across the Enterprise",[730],{"name":194,"to":195},{"label":197},{"type":166,"value":733,"toc":1150},[734,737,745,749,760,771,782,792,868,872,875,883,890,952,956,959,962,965,968,971,1032,1036,1039,1093,1097,1100,1103,1105,1107],[201,735,736],{},"Critical suppliers are a board topic when they are a factory, a cloud region, or a payments network. They are a footnote when they are a model. That classification is out of date. A provider that sits inside the forecast commentary, the customer channel, the software build, and the staff’s daily drafting is no longer a tool. It is a dependency. If its prices change, its terms change, its safety filter changes, or its service degrades, the operating rhythm degrades with it. Calling this a partnership does not diversify it.",[201,738,739,741,742,744],{},[208,740,211],{"href":210}," shows why the dependency accumulates quietly: use is already normal — 88 percent of organisations in at least one function — while enterprise scaling is not. Teams adopt whatever is easiest, often the same famous model, because nobody has been asked to design for exit. ",[208,743,231],{"href":230}," adds personal concentration: 78 percent of AI users bring their own tools, which in practice means a very small number of consumer brands. The enterprise standardises by accident on the same names the staff already opened.",[214,746,748],{"id":747},"what-concentration-actually-threatens","What concentration actually threatens",[201,750,751,754,755,759],{},[224,752,753],{},"Terms."," A vendor that reserves the right to train on inputs, retain prompts, or change subprocessors can turn a renewal into a data-protection event. The ",[208,756,758],{"href":757},"https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002Fartificial-intelligence\u002Fguidance-on-ai-and-data-protection\u002F","ICO’s AI guidance"," is a reminder that purpose and security duties sit with the controller, not with the brand of the model. If you cannot leave, you cannot renegotiate those duties. You can only accept them.",[201,761,762,765,766,770],{},[224,763,764],{},"Behaviour."," Models change without a release note your operators would recognise as a change. A filter tightens and a legitimate workflow starts failing. A filter loosens and a customer-facing assistant becomes more willing to speculate. ",[208,767,769],{"href":768},"https:\u002F\u002Fwww.reuters.com\u002Ftechnology\u002Fgoogle-ai-chatbot-bard-offers-inaccurate-information-company-ad-2023-02-08\u002F","The Bard demo"," showed how a single public error moves a market. An internal error moves a forecast or a promise. If you have no second model that can run the same job, you cannot even tell whether the failure is yours or theirs.",[201,772,773,776,777,781],{},[224,774,775],{},"Price."," Seat-plus-usage contracts feel smooth until usage is the business. A concentrated vendor can price the increment because switching means revalidating every job. Procurement scored the demo. The switching cost was never scored. ",[208,778,780],{"href":779},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","ISO\u002FIEC 42001"," will not choose your second supplier. It will at least force you to name the suppliers you have and the impact if they fail.",[201,783,784,787,788,791],{},[224,785,786],{},"Claims."," If your market story is “we run on X,” you have coupled your disclosure to X’s reputation. The ",[208,789,790],{"href":257},"SEC’s AI-washing cases"," were about false claims of capability. A true claim of total dependence is a different risk: when X has an outage or a scandal, your operational status and your narrative move together.",[266,793,794,810],{},[269,795,796],{},[272,797,798,801,804,807],{},[275,799,800],{},"What moves",[275,802,803],{},"What you feel first",[275,805,806],{},"Why you cannot leave in the notice period",[275,808,809],{},"What to have already stored",[287,811,812,826,840,854],{},[272,813,814,817,820,823],{},[292,815,816],{},"Terms: training on inputs, retention, subprocessors",[292,818,819],{},"A data-protection question at renewal",[292,821,822],{},"Purpose and security sit with you, not with the brand",[292,824,825],{},"The agreement, the region, and a path that does not accept the new default",[272,827,828,831,834,837],{},[292,829,830],{},"Behaviour: a filter tightens or loosens",[292,832,833],{},"A workflow fails, or a customer-facing answer speculates",[292,835,836],{},"You cannot tell a vendor change from your own bug",[292,838,839],{},"A second model that can run the same job against the same sources",[272,841,842,845,848,851],{},[292,843,844],{},"Price: usage becomes the business",[292,846,847],{},"The increment is priced because switching means revalidating every job",[292,849,850],{},"The demo was scored. The exit was not",[292,852,853],{},"Time-to-cutover from a drill, not a hope",[272,855,856,859,862,865],{},[292,857,858],{},"Claims: “we run on X”",[292,860,861],{},"An outage or a scandal moves your operations and your story together",[292,863,864],{},"The disclosure is coupled to someone else’s reputation",[292,866,867],{},"A description of the job that does not depend on the logo",[214,869,871],{"id":870},"a-resilience-test-that-fits-on-one-page","A resilience test that fits on one page",[201,873,874],{},"List the jobs that would miss a customer commitment, a close, or a release if the primary model were unavailable for five days. For each, name the fallback: a second model, a human procedure, or a degraded service you are willing to announce. If the fallback is “wait,” you have accepted a single point of failure. Write that down where the board can see it. Hidden acceptance is how concentration becomes a surprise.",[201,876,877,878,882],{},"For the jobs that write or promise, the fallback has to include the control, not only the prose. A second model that is more willing to invent a discount is not resilience. It is a second ",[208,879,881],{"href":880},"https:\u002F\u002Fwww.cbc.ca\u002Fnews\u002Fcanada\u002Fbritish-columbia\u002Fair-canada-chatbot-lawsuit-1.7116416","Air Canada",". The policy, the approval, and the log should be yours. The model should be replaceable underneath them. Companies that embed the rule in a vendor’s proprietary instruction will discover, at renewal, that the rule is not portable.",[201,884,885,886,889],{},"Test the exit once a year the way you test a restore. Take one real job. Run it on the alternative. Compare the output against the same sources. Time the cutover. The first test will be humbling. That is the point. A test you have not run is a hope, and hopes are what ",[208,887,888],{"href":349},"IBM’s access-control findings"," suggest companies have been operating on: systems in production without the controls that would make them substitutable or even inspectable.",[266,891,892,908],{},[269,893,894],{},[272,895,896,899,902,905],{},[275,897,898],{},"Job that would miss a commitment, a close, or a release",[275,900,901],{},"Fallback if the primary model is dark for five days",[275,903,904],{},"Control that must travel with it",[275,906,907],{},"If the cell says “wait”",[287,909,910,924,938],{},[272,911,912,915,918,921],{},[292,913,914],{},"Name the job a customer would recognise",[292,916,917],{},"A second model, a human procedure, or a degraded service you will announce",[292,919,920],{},"The policy, the approval, and the log stay yours. The model is underneath",[292,922,923],{},"You have accepted a single point of failure. Put it in the board pack",[272,925,926,929,932,935],{},[292,927,928],{},"A job that writes or promises",[292,930,931],{},"The alternative must be able to refuse a discount the policy does not allow",[292,933,934],{},"A second model that invents a remedy is a second spokesperson, not a fallback",[292,936,937],{},"Do not call it resilience",[272,939,940,943,946,949],{},[292,941,942],{},"One job you will actually cut over this year",[292,944,945],{},"Time the cutover. Compare outputs against the same sources",[292,947,948],{},"Prompts and policy as files you hold, not settings in a console",[292,950,951],{},"A test you have not run is a hope",[214,953,955],{"id":954},"the-renewal-you-should-be-able-to-walk-away-from","The renewal you should be able to walk away from",[201,957,958],{},"Concentration is not a philosophical worry about markets. It is the renewal conversation in which you cannot leave. You discover it when a price change, a retention change, or an outage arrives with notice, and the list of exposed jobs is assembled by asking around. Sales says the assistant only drafts. The draft is the proposal. Support says they can fall back to macros. The macros were generated and never filed. Engineering says the coding tool is optional. The last release was reviewed by people who used it to explain code they did not write. Optional became structural while the contract still said convenience.",[201,960,961],{},"A company that can walk away has already done the dull work. The prompts and the policy text exist as files you own, not only as settings in a vendor console. The evaluation set — a few dozen real tasks with the answer you would accept — is saved, so “the other model is worse” is a comparison rather than a mood. Credentials are per job, so cutover is not a security project you start during the notice period. Access control is the control most often missing when AI systems show up in breach reports. It is also the control that makes an exit possible. You cannot move a job whose identity you cannot name.",[201,963,964],{},"Run the alternative twice a year on the five jobs you would miss in a week. Record time-to-cutover and the share of outputs a person rejected. Those are the concentration metrics. A second model that refuses more often is not automatically a failure. Some refusals are the policy, finally enforced. The promise, on either model, is still yours. Portability includes the refusal.",[201,966,967],{},"Do not confuse an enterprise agreement with a reduction in concentration if staff still do the sensitive work in personal accounts. Bring-your-own use is the norm among AI users. That is a second dependency, often on the same small set of brands, with worse logs. An exit plan that ignores it will discover, in the crisis, that the work was never on the contract you are trying to leave.",[201,969,970],{},"The board question is the one you already ask of payroll, identity, and payments: what is the worst week, and what do we do on the Monday? If the answer is the vendor’s status page, you do not have a supplier. You have a single point of operation. Fund the alternative before you need it. Needing it is a bad time to discover you cannot.",[266,972,973,986],{},[269,974,975],{},[272,976,977,980,983],{},[275,978,979],{},"What people will say in the notice period",[275,981,982],{},"What has actually become structural",[275,984,985],{},"What “able to walk away” requires",[287,987,988,999,1010,1021],{},[272,989,990,993,996],{},[292,991,992],{},"“It only drafts”",[292,994,995],{},"The draft is the proposal",[292,997,998],{},"The proposal template and the rule live in files you own",[272,1000,1001,1004,1007],{},[292,1002,1003],{},"“We can fall back to macros”",[292,1005,1006],{},"The macros were generated and never filed",[292,1008,1009],{},"A filed procedure someone other than the vendor can run",[272,1011,1012,1015,1018],{},[292,1013,1014],{},"“The coding tool is optional”",[292,1016,1017],{},"The last release was reviewed by people who used it to explain code they did not write",[292,1019,1020],{},"An evaluation set of real tasks, with the answer you would accept",[272,1022,1023,1026,1029],{},[292,1024,1025],{},"“We have an enterprise agreement”",[292,1027,1028],{},"Sensitive work is still on personal accounts, often the same brands",[292,1030,1031],{},"The work has moved onto the contract, or the exit plan is fiction",[214,1033,1035],{"id":1034},"a-drill-with-a-date-on-it","A drill with a date on it",[201,1037,1038],{},"Twice a year, cut the five jobs you would miss in a bad week over to an alternative, using prompts, policy text, and evaluation cases you store yourselves. Write down how long it took and what a person rejected. If you cannot start the drill because the prompts live only in the vendor’s console, that fact is the finding. Fix the finding before the renewal, not during a price dispute. An identity you can name and revoke is part of the drill. So is the personal-account path: if the sensitive work never moved onto the contract, leaving the contract will not move the work. Report the drill to the board in two numbers. Logo count is not one of them. If the drill did not happen, report that. Absence is the concentration.",[266,1040,1041,1051],{},[269,1042,1043],{},[272,1044,1045,1048],{},[275,1046,1047],{},"Report this",[275,1049,1050],{},"Not this",[287,1052,1053,1061,1069,1077,1085],{},[272,1054,1055,1058],{},[292,1056,1057],{},"Time to cut the five jobs over",[292,1059,1060],{},"How many model logos are on the architecture slide",[272,1062,1063,1066],{},[292,1064,1065],{},"Share of outputs a person rejected on the alternative",[292,1067,1068],{},"A mood that “the other model is worse”",[272,1070,1071,1074],{},[292,1072,1073],{},"Whether prompts and policy were already files you hold",[292,1075,1076],{},"A finding discovered during the price dispute",[272,1078,1079,1082],{},[292,1080,1081],{},"Whether the sensitive work was on the contract at all",[292,1083,1084],{},"An enterprise agreement that staff do not use for the sensitive work",[272,1086,1087,1090],{},[292,1088,1089],{},"“The drill did not happen,” if it did not",[292,1091,1092],{},"Silence. Absence is the concentration",[214,1094,1096],{"id":1095},"a-call-to-chief-strategy-and-technology-officers","A call to chief strategy and technology officers",[201,1098,1099],{},"Treat the model provider as critical infrastructure when the jobs are critical, and as a commodity when they are not. Most companies have it backwards: commodity treatment of a critical dependency, and strategic language for a chatbot that drafts internal notes.",[201,1101,1102],{},"Name the five jobs you would not want to run on a single provider. Build the fallback before the renewal conversation, not during it. The negotiation you want is the one you can walk away from. Concentration is what happens when you no longer can, and have decided not to notice.",[618,1104],{},[214,1106,623],{"id":622},[528,1108,1109,1113,1117,1122,1127,1131,1135,1140,1144],{},[531,1110,1111],{},[208,1112,630],{"href":210},[531,1114,1115],{},[208,1116,635],{"href":230},[531,1118,1119],{},[208,1120,1121],{"href":757},"ICO, guidance on AI and data protection",[531,1123,1124],{},[208,1125,1126],{"href":768},"Reuters, Alphabet shares and the Bard demo",[531,1128,1129],{},[208,1130,780],{"href":779},[531,1132,1133],{},[208,1134,650],{"href":257},[531,1136,1137],{},[208,1138,1139],{"href":880},"CBC News, Air Canada chatbot liability",[531,1141,1142],{},[208,1143,665],{"href":349},[531,1145,1146],{},[208,1147,1149],{"href":1148},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","NIST AI Risk Management Framework",{"title":169,"searchDepth":170,"depth":170,"links":1151},[1152,1153,1154,1155,1156,1157],{"id":747,"depth":170,"text":748},{"id":870,"depth":170,"text":871},{"id":954,"depth":170,"text":955},{"id":1034,"depth":170,"text":1035},{"id":1095,"depth":170,"text":1096},{"id":622,"depth":170,"text":623},"Relying on a single foundation model for forecasts, customer support, and code creates a single point of operational failure.",{"eyebrow":682,"title":1160},"One provider, many jobs",[1162,1165,1168],{"question":1163,"answer":1164},"What is model concentration?","One provider drafting the forecasts, the customer replies, and the code. The company describes it as a partnership. It is a single point of failure.",{"question":1166,"answer":1167},"Why treat it like a supplier risk?","Because an outage, a price change, or a policy change now stops more than one function at once.",{"question":1169,"answer":1170},"What is the practical control?","A routing policy and a record of which model did which job, so a second provider is a switch, not a rewrite.","\u002Fblog\u002Fmodel-concentration-is-an-operating-risk",{"title":728,"description":1158},"blog\u002Fmodel-concentration-is-an-operating-risk",[699,1175,1176,1177],"vendors","resilience","strategy","OPXNpGLuTEbHZ4Z35fIbTPE50AcBG8sfI1ojB2sIecI",{"id":1180,"title":1181,"archived":163,"authors":1182,"badge":1186,"body":1187,"date":679,"definedTerm":164,"department":164,"description":1659,"extension":172,"eyebrow":164,"faqHeader":1660,"faqs":1662,"footerBand":164,"headline":164,"image":164,"industry":164,"jobType":164,"listed":163,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1672,"relatedHeading":164,"seo":1673,"series":696,"sitemap":131,"status":164,"stem":1674,"subhead":164,"tags":1675,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1678},"content\u002Fblog\u002Finsurance-will-not-cover-what-you-cannot-reconstruct.md","Insurance Won't Cover the AI Mistakes You Can't Reconstruct",[1183],{"name":1184,"role":1185,"to":195},"James Campbell","Co-Founder and CEO",{"label":197},{"type":166,"value":1188,"toc":1650},[1189,1192,1195,1199,1202,1213,1216,1222,1282,1286,1289,1295,1305,1377,1381,1384,1404,1414,1417,1519,1523,1526,1529,1532,1535,1538,1541,1595,1599,1602,1606,1609,1612,1614,1616],[201,1190,1191],{},"Insurance is a reconstruction business. A claim is a story with documents: what was promised, what was done, who authorised it, what the policy said would be excluded if the story cannot be told. Artificial intelligence has not repealed that structure. It has made the story harder to tell, because the “person” who drafted the promise or proposed the change may be a system nobody logged.",[201,1193,1194],{},"Boards are asking brokers whether AI is covered. Brokers are asking what AI the company runs. The second question is the one that decides the first. A manuscript endorsement cannot insure a workflow you cannot describe.",[214,1196,1198],{"id":1197},"the-claim-you-will-actually-file","The claim you will actually file",[201,1200,1201],{},"Picture two files.",[201,1203,1204,1205,1208,1209,1212],{},"In the first, a customer relied on a website answer and bought the wrong fare, the wrong cover, or the wrong delivery promise. You know this file. ",[208,1206,1207],{"href":241},"Moffatt v. Air Canada"," is the public miniature: a chatbot contradicted a policy page, the airline argued the bot was a separate entity, and the tribunal held the company responsible for its own website. ",[208,1210,1211],{"href":880},"CBC’s report"," is short enough to attach to a risk-committee pack. The damages were small. The evidentiary point is not. The passenger had a screenshot. The company had an argument. Screenshot beat argument.",[201,1214,1215],{},"In the second file, an internal assistant proposed a journal, a price, or a customer-record change, and it posted. Weeks later the number is wrong. The operator who clicked has left. The prompt was in a personal tool. The enterprise system shows the new value and not the proposed value. There is no refusal log because refusal was not a state the software could represent. You have an error. You do not have a claim narrative. Insurers are not hostile to errors. They are hostile to voids where a narrative should be.",[201,1217,1218,1221],{},[208,1219,1220],{"href":349},"IBM’s 2025 breach study"," is the security cousin of the same void. Among organisations that reported an AI-related breach, 97 percent lacked proper AI access controls. One in five reported a shadow-AI breach, associated with hundreds of thousands of dollars in extra average cost — about $670,000 where shadow-AI use was high. A carrier reading that report will not be reassured by a sentence in your submission that says “we have an AI policy.” The underwriter will ask whether access control and logging exist for the systems in scope. If the answer is a steering-committee charter, expect an exclusion, a sublimit, or a question you answer by paying more.",[266,1223,1224,1236],{},[269,1225,1226],{},[272,1227,1228,1230,1233],{},[275,1229],{},[275,1231,1232],{},"File one: the customer promise",[275,1234,1235],{},"File two: the internal write",[287,1237,1238,1249,1260,1271],{},[272,1239,1240,1243,1246],{},[292,1241,1242],{},"What went out",[292,1244,1245],{},"A fare, a cover, a delivery promise",[292,1247,1248],{},"A journal, a price, a customer-record change",[272,1250,1251,1254,1257],{},[292,1252,1253],{},"The public miniature",[292,1255,1256],{},"Air Canada: screenshot versus “the bot is a separate entity”",[292,1258,1259],{},"No famous case. A variance, weeks later, and an operator who has left",[272,1261,1262,1265,1268],{},[292,1263,1264],{},"What you can produce",[292,1266,1267],{},"The sentence, if you kept it",[292,1269,1270],{},"Often only the new value. Not the proposal, not the prompt, not a refusal",[272,1272,1273,1276,1279],{},[292,1274,1275],{},"What the carrier hears",[292,1277,1278],{},"A story with a document",[292,1280,1281],{},"A void where the narrative should be",[214,1283,1285],{"id":1284},"what-policies-already-do","What policies already do",[201,1287,1288],{},"Most cyber and professional-liability forms were not drafted with a generative assistant as a named peril. They respond, if they respond, through existing grants: privacy liability, system damage, business interruption, errors and omissions, media liability. Each grant has conditions. Notice. Reasonable security. Sometimes a requirement that the insured maintain backups, access control, or a written information-security programme. An AI system that employees use through personal accounts may sit outside the definition of “computer system” the form uses. A loss caused by a deliberate bypass of your own policy — staff told not to paste client data, staff paste client data — will attract an argument about whether the conduct was authorised.",[201,1290,1291,1292,1294],{},"None of this means “AI is uninsurable.” It means the application is now part of the control environment. Misstatements on applications are their own problem, as the ",[208,1293,790],{"href":257}," illustrated in a different legal costume: describe a capability you do not have, and the description becomes the exhibit. An insurance application that says AI decisions are human-approved, when the human sees a digest the next day, is a description. Treat it with the same care as a customer claim.",[201,1296,1297,1298,1301,1302,1304],{},"The ",[208,1299,1300],{"href":262},"FTC’s 2023 warning on AI marketing claims"," is aimed at advertisers. Risk managers should read it as a drafting guide for submissions. Do not say the system prevents errors if it drafts them. Do not say data never leaves the tenant if personal accounts are common. ",[208,1303,231],{"href":230}," found that 78 percent of AI users bring their own tools. If that is roughly true in your workforce, the application must not pretend otherwise.",[266,1306,1307,1320],{},[269,1308,1309],{},[272,1310,1311,1314,1317],{},[275,1312,1313],{},"Grant you might be counting on",[275,1315,1316],{},"The condition that usually sits underneath it",[275,1318,1319],{},"Where an assistant breaks the sentence",[287,1321,1322,1333,1344,1355,1366],{},[272,1323,1324,1327,1330],{},[292,1325,1326],{},"Privacy liability",[292,1328,1329],{},"A computer system you control; reasonable security",[292,1331,1332],{},"The paste was on a personal account outside the definition",[272,1334,1335,1338,1341],{},[292,1336,1337],{},"Errors and omissions",[292,1339,1340],{},"A professional service you can describe",[292,1342,1343],{},"The “decision” was a draft nobody approved, described on the application as human-approved",[272,1345,1346,1349,1352],{},[292,1347,1348],{},"Media liability",[292,1350,1351],{},"Content you published",[292,1353,1354],{},"You cannot produce the sentence, only a paraphrase",[272,1356,1357,1360,1363],{},[292,1358,1359],{},"Business interruption or system damage",[292,1361,1362],{},"A system, a backup, an access-control programme",[292,1364,1365],{},"The token was a shared administrator with no owner",[272,1367,1368,1371,1374],{},[292,1369,1370],{},"A new “AI” endorsement",[292,1372,1373],{},"Whatever the manuscript actually says",[292,1375,1376],{},"Nobody has mapped the endorsement to a grant. It is a brochure",[214,1378,1380],{"id":1379},"the-reconstruction-pack","The reconstruction pack",[201,1382,1383],{},"Before the renewal, assemble one incident that did not happen and write it up as if it had. Pick a customer promise and an internal write. For each, produce:",[528,1385,1386,1389,1392,1395,1398,1401],{},[531,1387,1388],{},"The exact output, not a summary.",[531,1390,1391],{},"The sources the system was allowed to use, and the version of the policy or price list.",[531,1393,1394],{},"The identity of the person who approved, and what they saw.",[531,1396,1397],{},"The identity of anyone who could have approved and did not need to.",[531,1399,1400],{},"The log retention period.",[531,1402,1403],{},"The vendor’s role, and the contract clause that says whether the vendor is a processor, a co-author of the error, or a bystander.",[201,1405,1406,1407,1409,1410,1413],{},"If a page is missing, that page is your real renewal project. ",[208,1408,780],{"href":779},", the AI management-system standard, is one way to organise the work. It will not pay a claim. It will make the exhibit list shorter. ",[208,1411,1412],{"href":1148},"NIST’s framework"," likewise. Standards impress brokers only when the artefacts exist.",[201,1415,1416],{},"Then talk to the broker with the pack, not with a slogan. Ask which grant would respond, which exclusion is the live one, and which wording they have seen carriers add in the last year. The market’s exclusions are moving. Your description should move with evidence, not with anxiety.",[266,1418,1419,1435],{},[269,1420,1421],{},[272,1422,1423,1426,1429,1432],{},[275,1424,1425],{},"Page in the pack",[275,1427,1428],{},"Customer promise",[275,1430,1431],{},"Internal write",[275,1433,1434],{},"If the page is blank",[287,1436,1437,1451,1465,1479,1492,1505],{},[272,1438,1439,1442,1445,1448],{},[292,1440,1441],{},"Exact output",[292,1443,1444],{},"The sentence the customer saw",[292,1446,1447],{},"The payload that posted",[292,1449,1450],{},"You have a summary. Summaries do not win arguments",[272,1452,1453,1456,1459,1462],{},[292,1454,1455],{},"Source and version",[292,1457,1458],{},"Policy or price list in force that hour",[292,1460,1461],{},"Rule the assistant was allowed to use",[292,1463,1464],{},"You cannot show which version spoke",[272,1466,1467,1470,1473,1476],{},[292,1468,1469],{},"Who approved, and what they saw",[292,1471,1472],{},"The outbound words, or “nobody”",[292,1474,1475],{},"The payload, or “nobody”",[292,1477,1478],{},"“Human in the loop” is a misstatement if they saw a digest the next day",[272,1480,1481,1484,1487,1489],{},[292,1482,1483],{},"Who could have approved and did not need to",[292,1485,1486],{},"The design, honestly",[292,1488,1486],{},[292,1490,1491],{},"This is the segregation-of-duties gap",[272,1493,1494,1497,1500,1502],{},[292,1495,1496],{},"Retention",[292,1498,1499],{},"How long the log is kept",[292,1501,1499],{},[292,1503,1504],{},"A retention you cannot name is a retention you do not have",[272,1506,1507,1510,1513,1516],{},[292,1508,1509],{},"Vendor’s role",[292,1511,1512],{},"Processor, co-author, or bystander, from the contract",[292,1514,1515],{},"The same, for the system that posted",[292,1517,1518],{},"A click-through accepted by someone without authority is still a fact",[214,1520,1522],{"id":1521},"rehearsing-the-renewal-conversation","Rehearsing the renewal conversation",[201,1524,1525],{},"Walk into the renewal with a story you can finish, because the alternative is a story the carrier finishes for you.",[201,1527,1528],{},"Start with scope, in plain words. Which jobs may draft. Which jobs may send, post, or pay. Which data is in bounds. If personal accounts are common — and survey evidence says bring-your-own use is the norm among AI users — say so, and describe the substitute you are funding. An application that says “employees use approved tools only” while the help desk tickets say otherwise is a misstatement. Misstatements are how coverage arguments start, before anyone debates an exclusion. Public cases about overstated AI capability are a different forum and the same discipline: describe what is true.",[201,1530,1531],{},"Then show one reconstructed customer promise and one reconstructed internal write, even if both are drills. The output. The source version. The person who saw it before it left, or the honest statement that nobody did. The retention of that record. If the second sentence is “nobody did,” do not hide it behind a project name. Put a date on the fix and assume the grant is narrower until the date. Carriers insure a control environment they can recognise. They do not insure a roadmap.",[201,1533,1534],{},"Ask the questions in writing. Which grant would respond if a customer relied on an assistant’s answer and you made them whole? Which exclusion is the one the claims team would actually reach for? Does the definition of computer system include a vendor you do not host? What happens if the loss flowed through an employee’s personal account after you forbade it? You will not love every answer. You will know which risks are retained, which is the point of buying insurance. A headline endorsement that nobody has mapped to a grant is not a transfer of risk. It is a brochure.",[201,1536,1537],{},"Price the residual on purpose. A refund reserve for the channel that can still speak without a log. A higher retention where access control is immature. The breach data is specific enough to justify the conversation: AI-related compromises were overwhelmingly associated with missing access controls, shadow AI featured in a meaningful share of incidents, and incidents involving heavy shadow use correlated with higher breach cost. You do not need to adopt the vendor’s dollar figure as your number. You need to stop treating the exposure as hypothetical.",[201,1539,1540],{},"A management standard and a risk framework help you organise the exhibit. They are not the exhibit. The exhibit is the log, the approver, and the policy version.",[266,1542,1543,1553],{},[269,1544,1545],{},[272,1546,1547,1550],{},[275,1548,1549],{},"Ask the broker, in writing",[275,1551,1552],{},"Why the answer changes what you buy",[287,1554,1555,1563,1571,1579,1587],{},[272,1556,1557,1560],{},[292,1558,1559],{},"Which grant responds if a customer relied on an assistant and you made them whole?",[292,1561,1562],{},"Tells you whether the customer-promise file is transferred or retained",[272,1564,1565,1568],{},[292,1566,1567],{},"Which exclusion would the claims team actually reach for?",[292,1569,1570],{},"The live exclusion, not the one in the brochure",[272,1572,1573,1576],{},[292,1574,1575],{},"Does “computer system” include a vendor you do not host?",[292,1577,1578],{},"Personal accounts and unsanctioned tools may sit outside the definition",[272,1580,1581,1584],{},[292,1582,1583],{},"What if staff pasted data after you forbade it?",[292,1585,1586],{},"Authorisation will be argued. The substitute path is part of the answer",[272,1588,1589,1592],{},[292,1590,1591],{},"What wording have carriers added in the last year?",[292,1593,1594],{},"The market is moving. Your description should move with evidence",[214,1596,1598],{"id":1597},"the-page-you-hand-the-underwriter","The page you hand the underwriter",[201,1600,1601],{},"One customer promise and one internal write, reconstructed as if they had gone wrong: the output, the rule version, the person who saw the sentence, the retention, the vendor’s role. Where a page is blank, the blank is the disclosure, with a date you will fill it. Do not let a headline endorsement sit on top of a blank. Personal-account use has to be described as it is, because an application that denies it becomes the exhibit later. Ask which grant responds and which exclusion the claims team would actually pick. Price what remains with you. That price is the honest premium. The rest is stationery. Pay for the story you can finish, and reserve for the one you cannot.",[214,1603,1605],{"id":1604},"a-call-to-risk-officers-and-chief-financial-officers","A call to risk officers and chief financial officers",[201,1607,1608],{},"Do not buy a headline endorsement and consider the matter closed. Buy the ability to tell the story. Log the sanctioned assistant. Attribute writes to a named person. Keep the customer-facing answer. Prohibit the paths you cannot reconstruct, and mean it by giving people a path you can.",[201,1610,1611],{},"When the loss comes — a refund wave, a leaked file, a corrupted ledger — the coverage conversation will last as long as the documents do. Companies that kept the documents will argue about policy language. Companies that kept a vibe will argue about whether they were negligent in a way the form does not cover. Only one of those arguments is worth having.",[618,1613],{},[214,1615,623],{"id":622},[528,1617,1618,1622,1626,1630,1634,1638,1642,1646],{},[531,1619,1620],{},[208,1621,640],{"href":241},[531,1623,1624],{},[208,1625,1139],{"href":880},[531,1627,1628],{},[208,1629,665],{"href":349},[531,1631,1632],{},[208,1633,650],{"href":257},[531,1635,1636],{},[208,1637,655],{"href":262},[531,1639,1640],{},[208,1641,635],{"href":230},[531,1643,1644],{},[208,1645,780],{"href":779},[531,1647,1648],{},[208,1649,1149],{"href":1148},{"title":169,"searchDepth":170,"depth":170,"links":1651},[1652,1653,1654,1655,1656,1657,1658],{"id":1197,"depth":170,"text":1198},{"id":1284,"depth":170,"text":1285},{"id":1379,"depth":170,"text":1380},{"id":1521,"depth":170,"text":1522},{"id":1597,"depth":170,"text":1598},{"id":1604,"depth":170,"text":1605},{"id":622,"depth":170,"text":623},"When autonomous agents alter records or mislead clients, insurance claims hinge on auditability. Here is how to prove what happened.",{"eyebrow":682,"title":1661},"The claim starts with what happened",[1663,1666,1669],{"question":1664,"answer":1665},"Why would a policy not respond?","Because the claim file starts with what happened. A chat scroll is not a reconstruction of a changed record or a misleading customer answer.",{"question":1667,"answer":1668},"What do we need on file?","The output, the data it used, the person or rule that approved it, and the system change that followed.",{"question":1670,"answer":1671},"Is this only a legal problem?","It becomes a coverage problem the moment you cannot show the sequence. The apology does not replace the record.","\u002Fblog\u002Finsurance-will-not-cover-what-you-cannot-reconstruct",{"title":1181,"description":1659},"blog\u002Finsurance-will-not-cover-what-you-cannot-reconstruct",[699,1676,1677,702],"risk","insurance","LyRTTFcIM21VvWJf69hAfAujwla7e2X8sq8liZFJUdA",{"fold":1680,"id":1684,"title":1685,"archived":163,"authors":164,"badge":164,"body":1686,"date":164,"definedTerm":164,"department":164,"description":169,"extension":172,"eyebrow":164,"faqHeader":164,"faqs":164,"footerBand":1690,"headline":164,"image":164,"industry":164,"jobType":164,"listed":131,"location":164,"navigation":131,"openRoles":164,"pageLayout":164,"path":1694,"relatedHeading":164,"seo":1695,"series":164,"sitemap":163,"status":164,"stem":1696,"subhead":164,"tags":164,"video":164,"whyJoin":164,"workplaceType":164,"__hash__":1697},{"headline":1681,"description":1682,"primaryLabel":8,"primaryTo":1683,"secondaryLabel":720,"secondaryTo":12},"Run frontier AI your business actually owns.","Governed workstreams, 3,000+ integrations, and a proprietary knowledge graph. Start on Free.","\u002Fsignup?plan=free","content\u002Fshared\u002Fcta.md","Site CTAs",{"type":166,"value":1687,"toc":1688},[],{"title":169,"searchDepth":170,"depth":170,"links":1689},[],{"headline":1691,"description":1692,"primaryLabel":8,"primaryTo":1683,"secondaryLabel":1693,"secondaryTo":85},"See what governed AI looks like on your stack.","Connect your tools, run a workstream, and keep every decision on your ledger. Start on Free.","Talk to our team","\u002Fshared\u002Fcta",{"title":1685,"description":169},"shared\u002Fcta","eYqahyaPnbp8GKrWpoORbZdtmkWmgHr5F61ZHOnb8sY",1791647058872]