EIOPA Supervisory Statement On The Management Of Non-affirmative Cyber Exposures

In early August 2022, the European Insurance and Occupational Pensions Authority (EIOPA) published a draft supervisory statement on non-affirmative cyber risks and held a public consultation on the draft statement. In late September 2022, EIOPA published a feedback statement summarising the main findings of the consultation and a resolution of comments paper outlining the individual comments they received and their responses to the comments. The supervisory statement is now in final form.

The statement deals with potential cyber-related losses through insurance policies where cyber coverage is neither explicitly included nor excluded, i.e. non-affirmative coverage. With economic and financial activities becoming more digitalised in recent years, the frequency and sophistication of cyber incidents in the financial sector have increased significantly. As underwriters in the cyber market will be well aware, incidents such as the NotPetya attack in 2017 can lead to