AI Insurance Australia: 5 Real Cases Every Business Should Know

AI is increasingly used to create reports, process customer data, make decisions and automate business tasks. But errors, privacy breaches and misuse can lead to financial losses, legal disputes and regulatory action. These 5 real-world AI incidents from Australia and overseas show what can go wrong, the consequences for businesses and where technology professional indemnity (Tech PI) or cyber insurance may be relevant, subject to policy terms and exclusions.

Tech PI insurance is designed to cover claims that your advice, service or work caused a client financial loss. It may include legal defence costs, compensation and any settlement you are legally liable to pay, subject to the policy terms.

Cyber insurance is designed to cover costs after a data breach or cyber attack. Third party cover may respond to claims from customers or regulators.

Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.

Key takeaways

• Documented incidents include AI-generated report errors, personal information uploaded to a public AI tool and deepfake impersonation.
• Tech PI may be relevant to client financial loss claims, while cyber insurance may be relevant to privacy and fraud incidents.
• Refunds and the cost of redoing your own work are commonly excluded under Tech PI.

What are AI risk incidents?

The Organisation for Economic Co-operation and Development (OECD) defines an AI incident as an AI system's "development, use or malfunction" leading to harm. Its AI incident methodology explains how incidents are classified.

Which covers may be relevant to AI-related claims?

Tech PI or cyber insurance may be relevant to AI-related claims, depending on what happened and the allegations made.

Whether a policy responds to AI-related claims varies between insurers and policy wordings. Speak to your insurance broker or the upcover team about the cover that may be relevant to your business.

Which AI incidents in Australia can businesses learn from?

Three Australian incidents involving Deloitte, the NSW Reconstruction Authority and Bunnings illustrate different risks associated with AI use.

Deloitte report errors and Azure OpenAI disclosure (2025)

• What happened: A Deloitte report for the Department of Employment and Workplace Relations (DEWR) was replaced on 26 September 2025. Fortune reported non-existent references and a fabricated quote. The revised report disclosed the use of an Azure OpenAI-based tool chain.
• What followed: Deloitte agreed to a partial refund.
• Cover to check: Tech PI may be relevant where a client alleges that a technology business's work caused financial loss, subject to the policy wording and the insurer's assessment.
• May not be covered: Refunds and the cost of redoing your own work are commonly excluded under Tech PI policies.

NSW Reconstruction Authority data uploaded to ChatGPT (2025)

• What happened: Between 12 and 15 March 2025, a former temporary employee uploaded personal information relating to 2,031 people to ChatGPT, according to the NSW Government.
• What followed: The Authority reported the breach to the NSW Privacy Commissioner and engaged forensic analysts.
• Cover to check: Cyber insurance may be relevant to response costs such as forensics and notifying affected people, subject to the incident, policy wording and insurer's assessment.
• May not be covered: Cyber insurance commonly excludes incidents known or reasonably foreseeable by a senior executive before cover starts.

Bunnings facial recognition (2024 to 2026)

• What happened: In November 2024, the Office of the Australian Information Commissioner (OAIC) found that Bunnings Group Limited breached privacy law. Its facial recognition system, using CCTV, captured faces in 63 stores between 2018 and 2021.
• What followed: On 4 February 2026, the Administrative Review Tribunal affirmed that Bunnings contravened Australian Privacy Principles (APP) 1 and 5. The Tribunal also found that exemptions to consent could apply for the limited purpose of combating retail crime and protecting staff and customers, according to the OAIC's statement.
• Cover to check: Cyber insurance third party cover may be relevant, depending on the allegation, policy wording and insurer's assessment.
• May not be covered: Prior or known matters may be excluded, depending on the cyber policy wording.

Our automated decision-making guide explains privacy rules relevant to AI decisions about people.

Which overseas AI liability cases matter to Australian businesses?

Two overseas incidents from 2024 illustrate how AI-related impersonation and inaccurate chatbot information can lead to financial consequences.

Arup deepfake video call (Hong Kong, 2024)

• What happened: In January 2024, an Arup employee in Hong Kong made transfers totalling HK$200 million after a deepfake video call, according to Dezeen.
• What followed: Arup confirmed that fake voices and images were used, but said its financial stability and business operations were not affected.
• Cover to check: Cyber insurance may be relevant to social engineering losses where funds transfer fraud cover is included, subject to the policy wording and insurer's assessment.
• May not be covered: Cyber insurance commonly excludes dishonest or fraudulent acts by, or known by, a senior executive.

Air Canada liable for its chatbot's answers (2024)

• What happened: In February 2024, the British Columbia Civil Resolution Tribunal found Air Canada liable for misinformation provided by its chatbot, as reported by the American Bar Association.
• What followed: The tribunal awarded approximately CAD $650 in damages, plus pre-judgment interest and filing fees.
• Cover to check: Tech PI may be relevant where a client alleges that a chatbot supplied by a technology business caused financial loss, subject to the policy wording and insurer's assessment.
• May not be covered: Tech PI commonly includes a contractual liability exclusion, which may exclude liabilities accepted only because of a contract.

What do tech professional indemnity and cyber covers commonly exclude?

Tech PI and cyber insurance commonly exclude certain circumstances known before cover starts. Other exclusions depend on the policy.

Tech professional indemnity exclusions

Exclusions commonly include, but are not limited to:

• Service credits, liquidated damages and other liability you take on under a contract that would not otherwise exist under the law (contractual liability exclusion)
• Claims and circumstances you knew about before the policy started

Cyber insurance exclusions

Exclusions commonly include, but are not limited to:

• Incidents known or reasonably foreseeable by a senior executive before cover starts
• Dishonest or fraudulent acts by, or known by, a senior executive

Important: These lists are not exhaustive. Exclusions vary between insurers. Always refer to the policy wording and its terms and conditions for the exclusions that apply to you. If you have questions, speak to your insurance broker or the upcover team.

How upcover can help

upcover arranges Tech PI and cyber insurance for Australian AI businesses and works with more than 80 insurance partners.

• 70,000+ businesses covered across Australia
• 4.9/5 customer rating
• 80+ insurance partners

Get a quote for your AI business.

Frequently asked questions

Is there an insurance policy for AI risk incidents?

AI risks are commonly assessed under existing policies, such as Tech PI and cyber insurance. Our AI startup insurance guide and AI agent liability guide explain which cover questions may arise.

Where are AI incidents recorded?

The OECD's AI Incidents and Hazards Monitor documents AI incidents and hazards.

What did the Bunnings decision mean for facial recognition?

In July 2026, the OAIC said the Administrative Review Tribunal's Bunnings decision confirmed that there is a high bar for using facial recognition technology in Australia. See the OAIC's updated guidance.

Does cyber insurance cover deepfake fraud?

Cover for deepfake fraud varies by policy. For email payment fraud, some policies may require a separate social engineering endorsement. See our guide to business email compromise.

Do insurers need to know how a business uses AI?

Insurers may ask about AI use before quoting. Our AI startup insurance guide explains what insurers may assess. Your duty of disclosure may require you to provide information relevant to the insurer's assessment of your risk.

‍

_{Written by upcover's editorial team.}

_{This article provides general information only and does not take into account your objectives, financial situation or needs. It is not legal advice: the incidents and decisions described here are summarised from the linked sources as at the time of writing (October 2026); get legal advice about how privacy, consumer or other laws apply to your use of AI. Insurance availability and cover are subject to underwriting and the terms, conditions, limits and exclusions of the relevant policy. Read the policy wording and its terms and conditions before deciding. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.}