Takeaways:
- Parametric insurance for climate risk requires more education
- Third parties are the biggest cybersecurity vulnerability
- Insurers should take stock of their risks from using AI
In May, EY and the Institute of International Finance published their
This article is from a longer interview and edited for clarity.
How are insurers dealing with climate risk?
Climate risk is clearly a high risk. The protection gap, unfortunately, continues to increase. First, insurers are trying to tackle the risk itself. The magnitude of climate risk is not insurable by the insurance industry alone. How do you educate more people to understand the risk and use technology to predict risks?
We all know it will be a long term journey to reduce climate risk. Unfortunately, you see governments changing their views and not really investing where they need to invest. We cannot bet that climate risk is going to decrease. How can we ensure better resilience against climate risk? That's where insurers start to play a big role, by being more predictive, educating and having programs. Some help their clients understand the risk and what they should do to prevent the risk.
Japan is doing that really well, because it's an island with tsunami and earthquake risk. You cannot build anything which is not anti-seismic. Compared to other regions – in the U.S., in Florida, you have houses that, the first hurricane, the house will be down. Prevention is super important to prevent the risk.
Is parametric insurance for climate risks catching on?
In parametric, we see some interesting initiatives to help when you have risks that happen often. Insurers say the appetite for parametric is not that high. They are surprised to see there is more appetite for those products than they thought. There's education, explaining what it is and making it really simple. There are opportunities, there are initiatives, but the demand is maybe not at the level that it could be.
For small and medium size businesses, parametric avoids having to declare your turnover, which may be not totally accurate, but even with that, you don't see a strong appetite. There is still some work to do in education, but we see quite a lot of initiative.
It works well in underdeveloped countries, where you have parametric insurance for very small things. It works so well because people see the link between what they pay and what they receive. I pay a premium, and I know that if I break my phone, I will receive 10 euros or the equivalent. It's more difficult in the more developed countries, but there are opportunities there, and we see already some interesting products developing.
What are insurers doing to assess, mitigate and prevent cybersecurity risk?
There is a diverse appetite for insurers to cover this risk. Some are quite proactive in selling cyber risk products. Some are less proactive, but in most of the cases, to insure against cyber risk, we can assess how you protect yourself, advising you based on your business and IT infrastructure. We expect you to do certain things to protect yourself. If you do that, we insure. It's a double positive impact, because it helps protect the clients, and it's easier to insure because it's more contained. The problem with cyber risk is you don't know the magnitude. It can be a systemic risk by definition. That's why some insurers are quite hesitant to cover this risk.
The weakest point, usually, is a small third-party vendor that you use, that you share data with, and who is not protected. You can have some solutions where you mandate, if you want to be insured, I want a full assessment of your cyber risk, including your third-party vendors. That would be a virtuous circle.
How is AI evolving from Gen AI into agentic AI?
Agentic AI is really a step up. Gen AI was quite the big change. One of my technology leaders presenting to a client said, "Gen AI is a 10-plus value compared to before, but agentic AI is a 10 multiplied value." It's exponential. With agentic AI, you can make decisions. You can orchestrate different tasks. It's not sequential. It's not just ingesting data. It's able to orchestrate making decisions, which creates other challenges, of course, to ensure that you control things and always have a human in the loop, but this opens very interesting opportunities.
We see some testing or proof of concept with agentic AI. The point is that you cannot wait and see what will happen. People need to embrace that, because it will be too late if they wait to look at what's going on. The technology works. So how people can embrace that? That's the challenge ahead for everyone, with fears which are very understandable, governance challenges and risk challenges. People need to be willing to reinvent processes to take advantage of this new technology.
What are the challenges for insurers embracing AI? How should they address these?
The first thing is, what is your risk appetite? Because if you want to really innovate at scale, you will make mistakes. What is your risk appetite that you already defined? What is the governance? How do you ensure you know what's going on? How do you ensure that you comply with your risk appetite? How do you define the broad race on the use of AI, including at the board level? It's not only management, it's also whether a board is comfortable with what you do, or want to do.
Interestingly, one challenge we see now is to inventory everything, using AI or Gen AI. More and more companies have their own ChatGPT, which is more secure with data. When you can innovate at your desk, how do you ensure you know who is using AI in day-to-day processes? That is quite an interesting challenge.
What is EY's insurance practice looking at next?
We invest a lot in technology because our clients need to invest a lot. Technology through partnerships and managed services are really our sweet spot for the future. We will continue to invest a lot in technology, just to cope with what's going on, to be ahead of the wave, to help clients navigate all those changes and also define what they want to do, because it's very costly. How do you prioritize? For our clients, it's also quite complicated to really define what they want to do, and how they want to do it.
