OneInfinity, a virtual asset insurance product by digital insurer OneDegree, announced a major upgrade to its cyber insurance product. The upgraded cyber policy addresses AI-related risks insofar as they intersect with cyber security, data protection, and network compromise.

The enhancement addresses the urgent global demand for AI risk protection and aligns with the Protection of Critical Infrastructure (Computer System) Ordinance, effective January 1, 2026 in Hong Kong. The upgrade provides a holistic solution integrating compliance, risk management, and financial safeguards to build a sustainable AI risk ecosystem for local enterprises.

AI Risk Insurance Gap Rapidly Widening as Major Insurers Refuse Coverage

In recent years, several global insurance giants have successively applied to regulators to add exclusion clauses to commercial policies. These clauses exempt coverage for legal liabilities arising from enterprises’ deployment of AI technologies, excluding losses caused by the use or integration of AI tools (such as chatbots and agentic AI systems) from the scope of coverage. Reports indicate that some insurers have even included exclusions for any “actual or alleged use of AI,” leaving many companies actively adopting generative AI exposed to highly systemic and interconnected risks with virtually no protection.

Recent incidents have shown how AI can materially amplify cyber risk when used as part of an attack vector — including AI-generated voice deepfakes used for large-scale financial fraud¹, AI-enhanced phishing campaigns leading to credential compromise and data breaches², and the use of AI to automate ransomware and extortion activities³. These developments highlight the growing need for cyber insurance solutions that explicitly address AI-enabled cyber threats, rather than standalone AI liability.

OneInfinity Takes Proactive Enhancement: AI-related Risks Now Covered

While many insurers are retreating by adding exclusion clauses, OneInfinity is proactively upgrading its product that include AI risks within the coverage scope, offering enhanced protection for enterprises actively adopting AI—particularly SMEs and innovative companies implementing generative AI, AI agents, and automated decision-making systems.

Through collaboration with its sister company Vulcan, which offers AI red‑teaming and real‑time guardrail solutions, OneInfinity combines active AI defence technology with insurance 
risk transfer. The product is designed to help companies scale AI adoption confidently while 
limiting potential financial losses from AI errors, misuse, or malicious exploitation.

Businesses can choose coverage levels up to US $2 million, balancing affordability and protection. The product continues OneInfinity’s tradition of clear policy terms combined with a digital application process, allowing for quick online completion.

Key AI-related cyber coverages include:

• Cyber losses and third-party liability arising from security incidents where artificial intelligence technologies are used within the insured’s systems or exploited as part of a cyberattack, resulting in network compromise, data breaches, or system disruption.

• Costs associated with incident response, business interruption, data recovery, network security, and privacy liability following cyber events in which malicious actors leverage or exploit artificial intelligence to gain unauthorized access, exfiltrate data, or impair system availability.

OneInfinity has incorporated risk layering and sub-limit management in the product design and provided clear compensation boundaries within a sustainable risk framework. OneInfinity have also secured A-rated reinsurer capacity to ensure sustainability.

Michelle Ip, AIFT Group Managing Director said: “With the new ordinance in effect, we expect growing demand for cyber security protection. In today’s AI‑driven environment, proactive monitoring and prevention are essential. AI can be both a risk and a safeguard — it’s a double‑edged sword. By embedding AI risk cover directly into our products, we’re helping enterprises take advantage of AI innovation while managing its challenges responsibly.”

New Cybersecurity Law Spurs Demand and Sector Growth

The Protection of Critical Infrastructure (Computer System) Ordinance had officially come into effect on January 1, 2026, imposing three major statutory obligations on designated “critical infrastructure operators”: establishing a security management framework; formulating and implementing security management plans with regular risk assessments; and incident reporting and response arrangements. The regulated sectors cover key industries such as energy, information technology, banking and financial services, transportation, healthcare, telecommunications, and broadcasting—expected to significantly drive local enterprises to enhance their cyber and information security standards.

As AI reshapes the cyber risk landscape, demand for consulting and technology solutions is expected to increase, attracting new providers and foreign investment. OneInfinity aims to support Hong Kong enterprises with integrated insurance, advisory, and compliance service, empowering them to pursue AI innovation with confidence under a sustainable risk framework.

Remarks:

1  World Economic Forum – Deepfake AI used in $25m corporate fraud case (https://www.weforum.org/stories/2024/07/deepfake-ai-cybercrime-arup/)
2 BlackFog – AI powering a new wave of phishing attacks (https://www.blackfog.com/ai-phishing-powering-a-new-wave-of-cyberattacks/)
3 Proofpoint – Generative AI accelerating phishing and social engineering
(https://www.proofpoint.com/us/threat-insight/post/generative-ai-and-phishing), Dark Reading – Cybercriminals using AI to scale ransomware and extortion (https://www.darkreading.com/cyberattacks-data-breaches/how-cybercriminals-are-using-ai)