It usually arrives as one new section on a form you’ve filled in every year. A cyber insurance renewal, or a client’s supplier questionnaire, now asks something like “Do you use generative AI tools? Do you have a policy governing their use? How do you prevent confidential data being entered into them?”
The temptation is to tick “yes” and move on. Please don’t, at least not yet. That form is a statement your firm signs. If something goes wrong later, it’s the first thing anyone reads.
The good news: a truthful answer is usually within reach in a few weeks, and most of it is useful anyway.
What the questions are really asking
The wording varies by insurer and by client, but in my experience the questions come down to three things:
- Do you know which AI tools your staff use? Not which ones you’ve approved. Which ones are actually in use.
- Have you written down the rules? A policy that says what’s allowed, with what kind of information, and who decides.
- Can you show it’s being followed? Settings, records, a date. Something more than a promise.
Those three are worth taking seriously because the gap is real. In one survey, 79% of Canadian office workers said they use AI tools at work (IBM and Censuswide, 2025). In another, only 29% of Canadian employees said their employer has a comprehensive AI policy (KPMG Canada, 2025). Most firms are somewhere in that gap, which is exactly what the form is probing.
What a good answer looks like
A good answer is short, specific and dated. Something like this:
| The question | A weak answer | A good answer |
|---|---|---|
| Do you use generative AI? | "Yes, responsibly." | "Yes. Approved: Microsoft 365 Copilot Chat, signed in with work accounts. Not approved: personal ChatGPT accounts for client work." |
| Do you have a policy? | "Yes." | "Yes, a one-page AI-use policy, adopted 3 March 2027, read and acknowledged by all staff." |
| How do you protect confidential data? | "Staff are trained." | "Copilot only sees what each person can already open; we reviewed and tightened file sharing on 17 February 2027. Unapproved apps can't be granted access to mailboxes without an administrator." |
The dates in that example are made up. Yours need to be real, and every line needs something behind it you could produce if asked.
What you need in place before you sign
A list of the tools in use. Ask your staff; you’ll get a more honest answer if you make clear nobody’s in trouble. Then check which apps have been given access to your Microsoft 365, because some won’t come up in conversation. Microsoft documents where that list lives and how to stop staff approving new ones on their own (Microsoft Learn).
A one-page policy. One page is enough, and it gets read. It should say which tools are approved, what information can and can’t go into them, who to ask about a new tool, and who owns the policy. Long policies get filed. Short ones get followed.
The settings that match the policy. If the policy says client files stay inside Microsoft 365, the sharing settings should make that true. If it says only work accounts, multi-factor sign-in should be on for every account. Microsoft’s security defaults are the simplest starting point for that (Microsoft Learn).
A dated before-and-after page. One page saying what you found, what you changed, and when. This is the document that turns “yes, we have controls” into something you can attach.
What not to write
- Don’t claim controls you don’t have. “We block all AI tools” is rarely true, and it’s easy to disprove.
- Don’t promise where AI processes your data unless you’ve checked. Where Microsoft processes Copilot data is set by Microsoft, and it changes. Write what’s true today, as a decision your firm made, not a guarantee.
- Don’t assume a good answer will lower your premium. It might help the conversation. Nobody can promise the price.
Keeping it true
The answer you write in March has to still be true at next year’s renewal. New staff join, someone shares a folder with everyone again, a new app gets approved. That’s why the checking matters as much as the fixing: one look a month at what changed, written down, means the next form takes ten minutes instead of a week.
If you’d rather I did it
Every item behind those answers is on the free AI Guardrails checklist, with where to find each setting. If you’d rather hand it over, AI Guardrails is exactly this: a set-up month that produces the policy, the settings and the dated before-and-after page, then one page a month that shows it’s still true.
Sources: IBM and Censuswide (2025) and KPMG Canada (2025) surveys, and Microsoft Learn, as linked above, checked 8 November 2026. The example answers are illustrations, not wording approved by any insurer.