The Hidden Insurance Risks of Using AI in Australian Businesses

Australian courts have already sanctioned lawyers, ordered costs against firms, and stripped a solicitor of his ability to practise, all over AI-fabricated content submitted without being checked. What none of these matters actually resolved is a separate, open question: whether professional indemnity cover follows when that kind of error happens. Courts have tested professional conduct and liability. Whether the policy responds is still, in most cases, untested and unclear.

The Cases Are Real, and the Timeline Matters

Four distinct Australian matters, across four different courts and regulators, played out within a few weeks of each other in mid-2025.

In Murray on behalf of the Wamba Wemba Native Title Claim Group v State of Victoria [2025] FCA 731, a junior solicitor at Melbourne firm Massar Briggs Law used Google Scholar to source citations for a Federal Court filing. When First Nations Legal and Research Services tried to verify them, several didn’t check out. Justice Murphy found it likely, not certain, that the false citations came from generative AI, and ordered Massar Briggs Law to pay costs on an indemnity basis.

On 13 August 2025, Rishi Nathwani KC apologised to the Supreme Court of Victoria after AI-generated fake quotes and non-existent case citations were submitted in a murder matter, DPP v GR [2025] VSC 490. Justice Elliott was direct: it is not acceptable for AI to be used unless its output is independently and thoroughly verified, and the same standard applies to solicitors filing court documents.

Six days later, on 19 August 2025, the Victorian Legal Services Board varied the practising certificate of a solicitor the court referred to only as “Mr Dayal”, the first Australian sanction of its kind. His underlying conduct, submitting false citations in a family law proceeding before the Federal Circuit and Family Court, had been referred to the Board back in October 2024; the certificate variation, stripping him of the ability to practise as a principal lawyer, came almost a year later.

Separately, in a different federal matter that same August, a solicitor was referred to the Legal Practice Board of Western Australia after relying on four completely fabricated case citations in a federal immigration matter, and then failing to initially admit AI had been used when the court questioned the submissions. The solicitor was ordered to pay costs.

By late July 2026, Damien Charlotin’s AI Hallucination Cases Database, the most comprehensive public tracker of this pattern globally, listed 110 Australian matters. It’s worth being precise about what that figure represents: the database only counts cases where a court explicitly found, or clearly implied, reliance on hallucinated material, not every allegation. Globally, a substantial share of entries involve self-represented litigants rather than legal professionals, though professionals account for a meaningful proportion too, roughly two-fifths of the global total as at mid-2026. This isn’t confined to law, but law is where it’s most visible, because courts are where a fabricated citation gets caught, written up, and published for anyone to find.

Client Confidentiality Is a Separate Exposure

The fabrication risk isn’t the only one. Uploading client information into a generative AI tool can raise its own confidentiality question, separate from whether the output itself was accurate. The Office of the Australian Information Commissioner’s guidance on using commercially available AI products recommends businesses not enter personal information into publicly available generative AI tools, and sets out what’s expected around data handling, consent and governance when AI tools are part of client-facing work. If a tool trains on submitted data, or an engagement doesn’t clearly address AI use, that’s worth resolving before client information goes anywhere near it, not after.

The practical framing worth keeping in mind: AI isn’t a sub-consultant you can delegate risk to. It behaves more like a junior team member whose work still needs to be checked by someone who carries the responsibility for it, because that responsibility doesn’t transfer to the software.

The Real Gaps in Professional Indemnity Cover

The general “silent AI” framing, a policy that neither clearly covers nor clearly excludes an AI-caused error, is real, but it understates how specific the actual exposures are. A negligent error is usually a negligent error regardless of what tool produced it, so a straightforward mistake made using AI is unlikely to sit outside normal PI cover any differently to a mistake made without it. The sharper risks sit elsewhere:

Costs orders, fines and penalties. In several of the matters above, the immediate financial consequence was a costs order or a fine, and these are generally not the kind of loss professional indemnity cover is designed to respond to in the first place, regardless of what caused the underlying conduct.

Dishonesty exclusions. Where a practitioner misleads a court about their use of AI, as happened in the WA matter, most PI policies carry a dishonesty or fraud exclusion that can remove cover entirely, independent of whatever the original AI-related error was.

Disciplinary proceedings costs. The cost of responding to a regulator, as in the Dayal matter, typically depends on whether the policy carries a specific extension for disciplinary or regulatory proceedings costs, something worth confirming exists rather than assuming.

New disclosure exposure on proposal forms. Insurers, including Victorian and NSW legal professional indemnity insurers, have been publishing guidance for practitioners on managing AI risk and are increasingly asking about AI use directly at renewal. A firm that answers those questions incompletely or inconsistently is creating a fresh disclosure risk, on top of whatever underlying AI risk prompted the question.

Firms in Victoria and NSW should check what their own professional indemnity scheme has published specifically on this: the Legal Practitioners’ Liability Committee in Victoria and Lawcover in NSW have both published guidance directly addressing these Australian cases. Other professions should check whether their own indemnity insurer or professional body has published equivalent material.

A Widening International Pattern, Named Precisely

This isn’t unique to Australia, and overseas insurance forms are already responding directly. Effective 1 January 2026, Verisk’s ISO division released three optional endorsements for US commercial general liability policies addressing generative AI specifically: CG 40 47, the broadest, excluding bodily injury, property damage and personal and advertising injury; CG 40 48, a narrower version limited to personal and advertising injury; and CG 35 08, covering products and completed operations. All three are optional, a carrier chooses whether to attach them, and a single policy could carry all three at once. Separately, W.R. Berkley has introduced an absolute AI exclusion, Form PC 51380, for its directors and officers, errors and omissions, and fiduciary liability products, which goes further than the ISO forms by excluding any AI use at all, not just generative AI specifically.

These are US instruments and don’t apply to Australian policies directly, but they show clearly where the broader market is heading on this question.

This Extends Well Beyond Law

Lawyers are the clearest public example because fabricated citations get caught in open court and reported. The same verification duty applies just as directly to accountants relying on AI-drafted financial analysis, engineers using AI-assisted calculations or reports, consultants producing AI-drafted client deliverables, and financial advisers using AI tools in preparing advice. None of these professions have had a public court case quite as visible as the legal matters above, but the underlying exposure, an AI output presented as verified when it wasn’t, sits in exactly the same place regardless of which profession is involved.

Worth flagging as well: separate amendments to the Privacy Act commencing December 2026 introduce new transparency obligations for organisations using automated decision-making that significantly affects individuals. This applies to organisations covered by the Privacy Act generally (broadly, those above the $3 million turnover threshold) and to decisions that actually use personal information to significantly affect someone, not routine AI-assisted drafting or analysis work. Firms using AI in ways that could meet that threshold should start documenting it well ahead of the commencement date.

What This Actually Means for Your Business

1. Verify before you rely. Every Australian matter above involved AI-generated content submitted without being independently checked first. That single step, confirming a citation, figure or claim actually exists and says what the AI claims it says, is what separates an efficiency gain from a professional indemnity exposure.
2. Know what your policy actually says about AI-related costs, not just AI-related errors. Ask your broker directly whether your policy responds to costs orders connected to AI-related conduct, whether a dishonesty exclusion could apply if AI use was misrepresented, and whether disciplinary proceedings costs are covered by extension.
3. Treat client data deliberately, not casually. Before uploading client information into any AI tool, confirm whether that tool trains on submitted data and check the OAIC’s guidance on what your obligations actually require.
4. Build a simple internal AI policy, even a short one. Insurers are increasingly asking whether a firm has any governance around AI use at all. Being able to answer “yes, and here’s what it says” is a materially different position at renewal than having no answer.
5. If you’re in a regulated profession with published AI guidance from your own indemnity scheme, read it. Victorian and NSW legal practitioners specifically have scheme-level guidance available; other professions should check whether their own indemnity insurer or professional body has published equivalent material.

The Bottom Line

The risk here isn’t that AI makes mistakes, every tool does. It’s that professional indemnity cover was largely built around human error, and the specific ways an AI-related failure actually bites, costs orders, dishonesty exclusions, disciplinary costs, disclosure gaps at renewal, don’t map cleanly onto that assumption. Given how many Australian courts have already tested professional conduct on this exact question, confirming how your own cover responds is worth doing before your business is the one being tested.

Want to know whether your professional indemnity cover addresses AI-related exposure? Speak with Knightsbridge Insurance Group about your professional indemnity policy.

Important Disclaimer: This article provides general information only and does not constitute legal or financial advice. Professional indemnity insurance coverage for AI-related errors varies significantly based on individual policies, professions, and insurers, and is an actively evolving area. The court matters referenced reflect the specific facts of those cases and tested professional conduct and liability, not whether insurance cover responds, which remains a separate and largely untested question. Readers should review their specific policy wording and consult with qualified legal and insurance professionals before making decisions about AI use in client-facing work. Knightsbridge Insurance Group holds Australian Financial Services Licence 514855.

Frequently Asked Questions