Your Team Is Already Using AI. The Question Is Whether Anyone's Managing the Risk.

Somewhere in your organization this week, an employee is doing something reasonable and quietly risky at the same time. They're pasting a patient note, a loss run, or a client's banking details into an AI tool to save a few minutes. They aren't careless. They're efficient. And they may have just handed sensitive information to a system nobody vetted, under terms nobody read.

That's the real face of AI risk. Not a distant, futuristic threat, but ordinary people adopting powerful tools faster than their organizations can set rules for them. Across home health and hospice offices, HME and O&P supply desks, therapy clinics, senior living communities, club back offices, and insurance agencies, AI is already in use, often on personal accounts and free platforms, frequently without a single written guideline.

The instinct in a regulated, relationship-driven business is to wait, to let the technology settle before committing to a policy. That instinct is the exposure. AI adoption isn't a decision leadership gets to make on its own timeline anymore. It's already happening. The only real choice is whether you govern it, or discover it after a loss.

The fraud that no longer sounds fake

For years, we trained employees to catch fraud by its flaws: clumsy grammar, odd phrasing, a generic greeting. AI erased those tells.

Today the phishing email is fluent. The voice on the phone is your owner's voice. The face on the video call is your CFO's face. The Federal Bureau of Investigation has warned that criminals are now using AI to generate convincing text, images, audio, and cloned voices that make phishing and social engineering faster, cheaper, and far harder to detect.

Picture the version that lands in your world. An HME supplier's accounts payable team receives a flawless request to update a manufacturer's banking information. A senior living employee takes a call in the cloned voice of a resident's family member. An agency processes an urgent funds-transfer instruction that appears to come from an insured in the middle of a renewal. Every one of these is plausible right now, and none of them require an elite hacker. They require only a convincing message and an employee conditioned to trust what feels familiar.

That habit is the thing that has to change. When a voice and a face can both be synthetic, "it sounded like her" is no longer verification; it's the vulnerability. The FBI's guidance is direct: when a message creates urgency around money or sensitive information, slow down and confirm it through a separate, trusted channel. Wire transfers, banking and payroll changes, password resets, and record releases should each require independent confirmation, every time, with no exception for the person at the top.

The mistake that wears a confident face

The second risk is quieter, and for many of VGM's customers, more consequential. Generative AI never hesitates. It answers everything with the same authority, whether the information is accurate or invented.

The National Association of Insurance Commissioners cautions that these systems don't understand context and meaning the way people do, and can produce information that looks correct but isn't. That's a harmless annoyance when you're drafting a newsletter. It's a liability when the output shapes patient education, a billing or reimbursement decision, a coverage explanation, or a comparison between two carrier forms.

Agents and brokers should feel this one most sharply. An AI-generated policy summary that invents a coverage term, overlooks an exclusion, or overstates a limit doesn't just create an awkward client conversation. It creates an errors-and-omissions exposure with your name on it. "The software wrote it" has never been a defense a client or regulator accepts. The NAIC is explicit that insurers remain responsible for compliance and consumer protection when they use AI. The technology can draft. It cannot be accountable. Only your people can.

Governance is the whole game

Here's the reframe worth carrying into your next leadership meeting: AI is not an IT project. It's a governance question, and it belongs at the same table as compliance, HR, legal, and risk.

The National Institute of Standards and Technology frames responsible AI around four functions: govern, map, measure, and manage. Set aside the framework language and it says something simple. Know where AI lives in your organization. Decide what it may and may not touch. Keep a human accountable for anything that matters. And treat any data entered into these tools as data that may have left the building for good.

For most, that becomes a short, unglamorous list that prevents the majority of losses:

• Find it. Inventory the AI tools employees actually use, including the personal accounts nobody approved.

• Write it down. Adopt a plain-language policy that names approved tools and the information that must never be uploaded.

• Keep a human on it. Require meaningful review before AI touches patient care, coverage advice, contracts, billing, hiring, or public content.

• Verify the money. Independently confirm every financial or sensitive-data request, regardless of who it appears to come from.

• Vet the vendor. Before adopting an AI-enabled system, know where your data goes, whether it trains someone else's model, and how a breach would be handled.

None of that requires an AI department. It requires a decision to lead the conversation instead of inheriting its consequences.

Where insurance fits, and where it doesn't

Insurance is part of this strategy, not a substitute for it. Subject to the specific terms, conditions, limits, and exclusions of each policy, three coverages are most likely to come into play when AI contributes to a loss.

Cyber liability may respond to certain data breaches, ransomware events, and related costs, though social engineering and funds-transfer fraud are often sublimited or conditioned on specific verification steps, worth confirming before you need them. Crime coverage may apply when an employee is deceived into transferring funds, but the terms and any social engineering provisions matter enormously. Professional liability, or errors and omissions, may respond when AI-assisted advice, documentation, or recommendations cause harm, a rising concern for healthcare providers, suppliers, therapy practices, and insurance professionals alike.

None of this coverage is automatic. AI incidents tend to cross multiple policies and settle in the gaps between them. The time to find those gaps is now, in a policy review, not later, in a claim.

The advisor's opening

For agents and brokers, this is more than an internal checklist. It's the most natural risk conversation to bring into a renewal. Ask a client whether their team uses AI, whether they've written a policy, whether financial requests get verified, and whether their coverage has kept pace. Most haven't thought it through. You just became the advisor who did.

That's the opportunity in this moment. AI will keep moving faster than the rules around it. The organizations that come out ahead won't be the ones that adopted it first or avoided it longest. They'll be the ones that treated it as a business risk worth governing, guided by a partner who helped them see it coming.

Your next step: look inward before the loss

The most valuable thing any leader can do right now is turn these questions on their own business. Before your next leadership meeting, walk through five honest questions:

• Where is AI already being used across your operation, including tools nobody formally approved?

• What information is flowing into it, and would any of it be a problem if it left the building?

• Who reviews the output before it reaches a patient, resident, member, or client?

• How would your team respond to a cloned voice or fraudulent payment request today, not in theory, but this afternoon?

• Does your current coverage reflect the way your organization actually works now?

If any of those answers give you pause, that's not a failure. It's a starting point.

At VGM Insurance, that's the role we intend to play: helping our customers and agency partners identify these exposures early, ask sharper questions, and act before an incident forces the issue. If your organization is adopting AI, or your clients are beginning to ask what it means for their risk and coverage, start the assessment now, while it's still a strategy and not a claim. Our team is ready to help you begin.

This article is provided for general informational purposes only and does not constitute legal, cybersecurity, compliance, or insurance coverage advice. Coverage depends on the specific terms, conditions, limits, exclusions, and facts of each individual policy and claim. Organizations should consult qualified legal, cybersecurity, compliance, and insurance professionals regarding their circumstances.