A chatbot knows your loss runs: shadow AI in insurance on new “Rate of Change” podcast

89% of P&C insurance employees use AI tools their company never approved, according to the 2026 State of P&C Insurance Technology report. When Federato asked leaders the same question, 89% of them said yes too, and 40% called it very common.

That makes shadow AI in insurance a leadership problem as much as an employee one. The people who write the AI policy are using the same unapproved tools as the people expected to follow it.

This is the topic of the first episode of “Rate of Change,” Federato's new podcast on AI in insurance. Host Jordan Sher, VP of Corporate Marketing, talks with Sean Wani, General Counsel at Federato, about what the report found and what insurance leaders should do about it. Here are the highlights.

Sean has spent almost four decades writing the contracts and policies behind Silicon Valley technology. He was General Counsel at OpenGov and Ayasdi and worked at Apple, Oracle, Intuit, and Zuora.

“Rate of Change,” a new podcast about AI in P&C insurance

AI is reshaping how insurance works. Insurers are spending more on it every year, and underwriting, claims, and portfolio management are still harder than they need to be.

“Rate of Change” covers what insurance professionals need to know and watch for to stay ahead. Each 15–20 minute episode takes a finding from the 2026 State of P&C Insurance Technology Report and tests it against the daily reality of the people doing the work. Every episode ends with what the finding means for insurance leaders and the steps to take now.

Jordan Sher, VP of Corporate Marketing at Federato, hosts. The conversations are unscripted, and the show covers industry education only, with no product pitches.

Shadow AI grows as companies invest more in AI

The research data on unsanctioned AI use holds two surprises: the first is who uses shadow AI the most, and that shadow AI rises with AI maturity. Companies where AI is broadly used across workflows report 47% frequent shadow AI use. Companies still in isolated use report 27%. The more a company invests in AI, the more its people reach for tools outside the approved stack.

Sean defines shadow AI as any tool an employee uses that the organization has not approved and that falls outside its policies.

The exposure is specific. A single submission holds client PII, loss history, and underwriting logic a carrier spent years building. Every pricing, underwriting, and claims decision has to be explainable to a regulator. More of those decisions now pass through consumer chatbots, with no record of what went in or what came out.

No single person owns AI governance at most companies

Jordan asked Sean who is accountable for AI governance at a carrier when the people who own the policy also work outside it.

"I don't think there's any one person who owns AI governance in a company today," Sean said. A named executive, the general counsel, or the CISO may lead the program. In practice, governance has to run across the enterprise, usually through a council that sets how AI is used and checks that people follow it.

Sean was direct about policies that exist only on paper. "You can take that policy and put it on the shelf, but if nobody really is following it and understands it and is being essentially governed by it, then the policy is worthless."

For boards, he said the expectation is twofold. Companies should use AI, because the value is clear. They also need to know when the policy is not being followed in ways that create risk. In insurance, that includes any AI use that could break compliance or hurt customers, which is why a human still needs to stay at the front of AI-influenced decisions.

Shadow AI could put privilege and client data at risk

Jordan asked whether shadow AI has caused a loss of attorney-client privilege. Sean said he has not seen case law on it yet. He noted the argument is there. If privileged information goes into a general tool that is open to people outside the legal team, a company could lose privilege over it.

On regulation, Sean said no federal AI governance standard exists today. In insurance, the NAIC has put out draft guidance. Its recommendations cover the basics: know which tools you use, know their limits, and know what data they use to train their own models.

That last point is where shadow AI does the most damage. Sean explained that the free tier of a consumer AI tool usually gives a company no way to stop the provider from training on its data, and few assurances about security. An enterprise contract can rule out training on customer data, set security obligations, and keep each customer's data in its own instance.

General Counsel Sean Wani's first 3 steps for AI governance

Jordan closed by asking what Sean would do first at a company with no AI governance and open access to shadow AI tools. His answer:

1. Bring in every stakeholder. Include every group that will use AI to benefit its work, beyond engineering or underwriting.
2. Write a policy and choose vetted tools. Set out how the company intends to use AI, which approvals are required, and who is involved. Approved tools should be secure and vetted, and different teams may need different tools.
3. Require vendors to prove their security. For general business tools, that means SOC 2 compliance. For AI tools that handle policy and underwriting data, it means security protocols audited by a party that understands how insurers need their data protected.

Listen to the full episode

The episode covers more than this summary can, including how Sean thinks about AI-written AI policies and what companies should be ready to attest to their customers.

“Rate of Change,” Episode 1 is available now on YouTube, and wherever you get your podcasts. 

To see the full data on shadow AI, download the 2026 State of P&C Insurance Technology report.