Cyber-insurance in EU policy-making: Regulatory options, the market's challenges and the US example

Abstract

Over the last decades digital technologies have penetrated our daily lives affecting all aspects of our societal and economic activities. Even though the benefits of relying on information systems to run everyday tasks, organise one's business, interact with each other or enjoy public services are undisputable, the increasing use of digital technologies comes with a price: the growing exposure to cyber risks. This new type of threat has been in the center of the EU agenda for over 15 years during which a solid legislative framework for the protection S of network and information systems against cyber incidents has been developed. However, security and resilience of infrastructures and networks is one parameter of the challenge. Dealing with the financial risk emerging from a cyber incident, is another, equally important one. The need to mitigate these risks led to the emergence of a new insurance market, the cyber insurance market. Despite though the constantly growing demand for this type of insurance coverage, the market is still under development. The fast-evolving nature of cyber threats, the lack of a common language as regards risks, losses and coverages and the lack of historical data on cyber incidents are listed among the factors that slow down the market's growth. Currently, all involved stakeholders in the insurance field are considering specific initiatives that would accelerate the process of turning the EU market more competitive and efficient against its many challenges. The example of the US cyber insurance market, with its shortcomings and know-how, could also contribute to this effort, as an example of a market that has been intensively facing these challenges for almost twenty years.