Viewpoint: Prudent or Not, an Insured’s Extra Expense Must Be Strictly ‘Necessary’

Insurance Journal's report on the Illinois appellate court's ruling that reasonable but contractually unnecessary payments made by an insured following a cyberattack did not constitute insured “extra expense” highlights the importance of strict policy interpretation. This means that website owners who have experienced cyberattacks, such as those involving AI bot traffic, must carefully review their insurance policies to understand what constitutes "extra expense" and ensure they are only claiming necessary expenditures. The court's ruling emphasizes the need for precise language and contractual adherence, which may impact how website owners navigate insurance claims related to AI-related incidents. To mitigate potential risks, website owners should take the following steps: review their cyber insurance policies to identify specific provisions related to "extra expense"; maintain detailed records of expenditures following a cyberattack to demonstrate necessity; and consider updating their llms.txt files to reflect changes in insurance coverage or claims procedures, ensuring they are prepared for potential AI bot traffic and associated costs.