As we noted last year, COVID-19 business interruption disputes continue to wend their way through the courts. Insureds have continued to argue, under the laws of nearly every state, that COVID-19 losses should be covered under policies dealing with "direct physical loss" or "damage to property." The overwhelming majority of courts continued to reject these claims in 2022, with appellate courts creating binding precedents for their jurisdictions. In late December 2021, the Second Circuit held that, under New York law, COVID-19 was not a "direct physical loss" or "physical damage" sufficient to trigger liability under business interruption policies. Numerous state and federal courts of appeals, applying state law, have now likewise rejected that same argument. Indeed, as the Seventh Circuit noted in E. Coast Ent't of Durham, LLC v. Houston Cas. Co., "[t]he growing national consensus regarding the meaning of 'direct physical loss' underscores that this case"—and others like it—do "not turn on variations in state contract law."

Nonetheless, there is still some remaining risk for insurers who wrote business interruption policies. In the waning days of 2022, the Ninth Circuit in Another Planet Ent't, LLC v. Vigilant Ins. Co. asked the California Supreme Court to decide whether business closures due to COVID-19 were "direct physical loss or damage to property" under California insurance law. The Ninth Circuit noted that California's intermediate appellate courts have decided both ways on whether the presence (or potential presence) of COVID-19 constituted physical loss or damage and therefore concluded that it could not resolve this question absent guidance from the California Supreme Court. The California Supreme Court is sometimes an outlier on insurance coverage disputes, so the industry will have to watch this case closely, with potentially significant implications for policies written in the country's largest jurisdiction.

Artificial Intelligence's Effect on Underwriting and Claims

We are also closely watching emerging issues arising from the use of complex algorithms and big data across the industry. Insurers have long used actuarial models in making various insurance decisions, but with advances in machine learning and the availability of novel data sets, many companies have started using AI to assist in the marketing, pricing and underwriting of insurance, as well as fraud detection and claims processing.

Insurance regulators in Connecticut, California, and Colorado have recently released guidance or draft regulations on the use of AI for insurance, with a particular focus on the risk that these tools potentially may unfairly discriminate against protected classes. Picking up on these concerns, the plaintiffs' bar has begun taking aim at the use of AI and big data by insurers. In December 2022, a putative class of policyholders of property insurance filed suit claiming that the insurer's computer models were unfairly discriminatory because they required African Americans to jump through more hoops than other policyholders to get their claims processed and that they were more likely to be flagged for potential fraud. According to plaintiffs, those computer programs created a disparate impact on racial minorities, whether intentionally or unintentionally. The case presents not only a novel theory of liability, but also a new evidentiary basis for the claim: the alleged unfair discrimination is based on an academic study that used survey data. Whether or not these claims are successful, scrutiny of insurers' use of AI and big data is likely to continue for some time, with many novel theories of liability and new defenses being tested in the courts and in regulatory investigations.

Cyberattack Litigation: The Next Frontier of Insurability?

In recent years, insurers have increasingly had to grapple with the insurability of cyberattacks. These attacks can cause catastrophic losses to their targets, including those relating to shutting down large parts of the business, damage to information systems, the leaking of sensitive company or client information, significant legal and vendor fees and in some cases, substantial ransom payments. This, in turn, can expose insurers to extensive losses, depending on policy terms. On the one hand, some insurers have embraced this challenge and written policies or riders specifically designed to cover cyberattack losses. On the other hand, other insurers have forcefully argued that their policies do not cover losses from cyberattacks, arguing in court against "silent cyber coverage" and asserting that the losses fell into an excludable category such as an exception for "warlike" losses or lacked the physical damage necessary to trigger coverage. Some have argued that cyberattacks will become "uninsurable" if the magnitude and frequency of attacks continue to grow.

In light of the potential scale of losses and the social consequences of cyberattacks, the federal government announced in October 2022 that it was considering whether it should play a greater role in insuring these risks. As the government noted in its request for comments, one model might be a public-private partnership in the same vein as the government's Terrorism Risk Insurance Program, which provides a mix of private and public funding to cover losses. Although these proposals are only in their infancy, they reflect a common understanding that cyberattacks, including ransomware and the decision whether to pay ransoms, are an increasing conundrum facing the insurance industry and our society as a whole.

These views are the authors' own.

Eric Dinallo ([email protected]) is a partner and Chair of the Insurance Regulatory practice at Debevoise & Plimpton LLP, where Marshal Bozzo ([email protected]) is a counsel, and Michael Gramer ([email protected]) and Samuel Rosh ([email protected]) are associates. The authors can also be reached at (212) 909-6000.