When Lawyers Expand Beyond Law Practice and Become Cybersecurity and AI Advisers: The Professional Liability Insurance Trap

By Yan Ross JD, Editor-in-Chief, Cyber Defense Magazine

 

NOTE: The author is writing in his individual capacity only, and does not intend this blog to constitute legal advice or a legal opinion. Some research on the topic employed artificial intelligence resources, but the work product is the author’s alone.

 

This manuscript is the author’s original work. During manuscript preparation, the author used ChatGPT to assist with copyediting, drafting selected passages under the author’s direction, and generating data for the purpose of improving clarity, consistency, and production efficiency. All AI-generated content was reviewed, verified, and revised by the author. The author accepts full responsibility for the originality, arguments, accuracy, and final content of this work.

 

In today’s highly competitive legal marketplace, there appears to be a trend where attorneys want to expand the scope of their expertise into specialized professional areas.  It’s understandable that they want to provide potentially profitable services instead of referring clients out to other professionals.

 

Of course, this behavior appears to occur on a one-way street.  After all, lawyers are usually quick to bring to the attention of their Bar organizations incidents of unauthorized practice of law by non-attorneys.

 

There is a certain “tribalism” among professionals where overlaps may occur and be confronted.  It’s not only lawyers.

• Certified Public Accountants (CPAs) don’t want non-CPAs to issue financial audits (or final SOC2 compliance reports, but we’ll save that for another day).
• After establishing a record of many liability and operational tests, CPA professionals have separated out their practices from the consulting services they used to provide for accounting clients (though, like the Terminator and Ma Bell, they are reassembling themselves into unified organizations).
• Credentialed privacy professionals seek to preserve the uniqueness of the consulting and compliance work they perform, but also may find themselves providing advice that looks a great deal like a legal opinion.

 

Today our focus is not on the competitive aspects of these developments, but the liability issues which come into play.

 

“Insurance Creep” comes to mind as a conceptual point for this phenomenon.

 

Attorneys have traditionally secured insurance coverage for professional liability where some aspect of legal representation has fallen short of professional standards and resulted in a loss to the client.  This coverage has been tightly underwritten.  The terms and conditions are based on sound historical claims and loss experience, along with the nature and history of the law firm practice.

 

However, in today’s fast-paced developments involving cyber risks and liabilities, and especially artificial (or super) intelligence, there are many legal implications.  Some of them do arise out of statutory and regulatory provisions which require legal interpretation and advice.

 

A prime example is the proliferation of State privacy laws, many of which provide new remedies like private rights of action for privacy or cyber breaches.

 

It is more likely than not that the near future will bring us State, if not federal, laws on the use, restrictions, and liabilities for using forms of artificial intelligence in both government and business.

 

In a practical sense, the need for cybersecurity and AI-related advice will to some extent require legal expertise.  But technical expertise and application is in short supply among attorneys, and it is imperative to determine whether and how law firm professional liability insurance covers the risk of making a mistake.

 

While the following observations are based on anecdotal rather than statistical evidence, there are situations in which attorneys extend their client services into cyber and AI evaluations and even risk assessments.

 

There is already a strong precedent for professional, D&O, and E&O liability insurance to exclude cyber and AI related events from general coverage.  Over the past few years, it has become the norm for renewal letters to communicate this exclusion, and invite the insured to apply for specific extended coverage.

 

It is to be expected that if a lawyer offers to perform such services as cyber risk assessments, gap analyses, or vulnerability reports, it will be incumbent upon the law firm to seek and secure extended liability coverage.

 

The central issue is deceptively simple: A lawyer’s professional liability insurance does not necessarily cover every professional service the lawyer decides to offer. That distinction becomes especially important when attorneys expand their practices into cybersecurity consulting, artificial intelligence implementation, technology assessments, or managed compliance services.

 

A conventional legal malpractice policy may protect an attorney who negligently advises a client about a cybersecurity regulation. But will that same policy respond when the attorney recommends a particular security architecture, supervises a network assessment, or implements an AI application that produces a damaging result?

 

The answer depends on the policy’s definition of covered professional services, its exclusions, the nature of the engagement, and the allegations in the claim.

 

The most dangerous moment may come not when the attorney accepts the new assignment, but months or years later, when a client suffers a loss and the insurance carrier examines whether the work was actually the practice of law.

 

The legal profession is entering a new liability frontier. Attorneys increasingly advise clients on cybersecurity, artificial intelligence, privacy compliance, and technology governance. Some go further, offering security assessments, AI implementation advice, or technology-based compliance services.

 

But a lawyer’s professional liability insurance is not an all-purpose guarantee against professional mistakes.

 

The distinction is critical: Providing legal advice about cybersecurity is not necessarily the same insured activity as providing cybersecurity services.

 

Recharacterizing a cyber-related loss as ordinary professional negligence does not necessarily defeat an exclusion.

 

A lawyer who assumes that professional liability coverage follows every service offered under the firm’s name may discover otherwise.

 

Artificial Intelligence Creates Another Uncertain Boundary

 

Consider a law firm offering an automated legal compliance platform. If the software generates an erroneous recommendation that causes a client financial harm, is the resulting claim legal malpractice, technology errors and omissions, product liability, or some combination?

 

The answer may determine which insurer, if any, must respond.

 

Insurers are beginning to address AI exposures expressly. Published examples include proposed or marketed exclusions affecting certain professional and management liability products. However, these should not be confused with proof that AI exclusions have become standard in lawyers’ malpractice policies.

 

The challenge is not that AI-related legal work is universally uninsurable. It is that the boundary between insured legal services and potentially uninsured technology services is becoming increasingly difficult to define.

 

As a result, the emerging problem is therefore not universal exclusion. It is uncertainty over what activities and losses the policies actually cover.

 

Five Questions Every Law Firm Should Ask Before Expanding

 

Attorneys contemplating cybersecurity consulting, AI implementation, or other technology-related services should conduct a formal insurance coverage review before accepting their first engagement.

 

At a minimum, that review should answer five questions:

 

1. Scope of professional services: Does the existing malpractice policy expressly include cybersecurity advisory work, technology consulting, AI-related services, and other proposed activities?
2. Advice versus implementation: Does coverage extend beyond legal opinions to technical assessments, recommendations, system configuration, and implementation?
3. Exclusions and limitations: Are claims involving data breaches, security failures, software malfunctions, or AI-generated outputs excluded, restricted, or subject to special conditions?
4. Supplemental insurance: Would technology errors-and-omissions coverage, cyber liability insurance, or another specialized policy address exposures not covered by conventional legal malpractice insurance?
5. Written confirmation: Has the insurer reviewed the proposed services and confirmed the intended coverage in writing, preferably through an appropriate endorsement where necessary?

 

Engagement letters should also distinguish legal advice from technical implementation and identify which entity is responsible for each service.

 

But engagement letters cannot rewrite insurance policies.

 

The Cost of Discovering the Exclusion Too Late

 

Lawyers are trained to recognize risks, allocate responsibilities, and interpret contractual language. Yet the rapid expansion of legal services into cybersecurity and AI creates an uncomfortable possibility: attorneys may overlook the limitations of their own insurance contracts.

 

The solution is not to discourage lawyers from entering these fields. Their expertise in governance, regulatory compliance, professional responsibility, and risk allocation is increasingly valuable.

 

Rather, law firms should treat insurance coverage analysis as an essential prerequisite to expanding their professional services.

 

The time to determine whether a cybersecurity or AI engagement is insured is before the engagement begins, not after a client’s loss results in a lawsuit.

 

The most expensive legal opinion a lawyer may ever receive could be the insurer’s explanation of why the claim is not covered.

 

You can reach the author for additional information by email at yan.ross@cyberdefensemagazine.com

 

Yan Ross is a “recovering attorney” and the Editor-in-Chief of the online monthly Cyber Defense Magazine.  In this capacity over the past 7 years, he has edited over 3500 articles by experts in the cybersecurity industry.  From this body of work and independent research, Yan is pleased to provide this monthly guest blog.

 

Yan is an accredited educator, providing CLE courses for several online providers.

 

He is also co-author of The vCISO Playbook: Virtual CISOs Deliver Enterprise-Grade Cybersecurity to Small and Medium Businesses (SMBs).