As Arizona companies prepare for 2027, the business insurance landscape is shifting faster than many leaders realize.

Cybercriminals are using AI to mimic executives and the general public. Property losses are rising as extreme heat and floods strain aging buildings. Workforce injuries are becoming more serious. And insurers, facing their own pressures, are demanding stronger controls and more documentation before offering favorable terms.

Two industry experts say entrepreneurs mistakenly assume that this year’s insurance program will protect next year’s risks.

“In a softer property market, it can be tempting to chase the lowest price and assume the job is done,” says James Jorgensen, executive vice president of business insurance at Marsh McLennan Agency Arizona.

“But the real opportunity — with the right partner — is to use favorable market conditions to strengthen the program by closing coverage gaps, validating limits, expanding coverage on other lines, improving business interruption protection, and making sure the structure reflects how the business actually operates.”

Mike Gallaugher, a business insurance advisor with Toro Insurance Group, says companies are making coverage decisions based on short-term savings without understanding the long-term exposure.

“A business can outgrow its insurance program without realizing it,” Gallaugher says.

DEEPER DIVE: How healthcare costs are reshaping 2027 benefits strategies

READ MORE: Phoenix industrial market ranks No. 7 in nation

AI is supercharging criminals

Cybercriminals will up their game, using AI to accelerate the risk in 2027. And both experts say cyber risk is evolving from a technology problem to a human problem.

“Criminals will use AI to trick good employees into making bad decisions,” Gallaugher says.

Jorgensen says he’s seeing increased concern about privacy and regulatory exposure as data use and retention rules become more complex.

“Arizona businesses should expect cyber risk to become less about a single ransomware event and more about a broader mix of operational disruption, data exposure and third-party dependence,” Jorgensen says.

“The biggest emerging risks we’re watching include more sophisticated business email compromises, fraud-driven financial losses, data exfiltration without encryption, vendor and supply-chain compromises, and cyber-physical attacks on operational technology and critical systems.”

Cybercriminals have moved beyond poorly written phishing emails, Gallaugher says. These attacks are eerie and catastrophic. Arizona companies — and those worldwide — should expect voice-cloned phone calls, deepfake video instructions and fraudulent invoices that perfectly mimic past transactions, Gallaugher warns.

Insurance carriers are responding by being more selective and more control-focused in underwriting, according to Jorgensen.

“Even though cyber capacity remains broadly available, insurers are paying closer attention to basic cyber hygiene, incident response planning, data governance, multifactor authentication, backup resilience, third-party oversight, and network segmentation — especially for organizations with operational technology or critical infrastructure exposure,” Jorgensen says.

Gallaugher agreed, saying bluntly, “Cyber insurance is not a substitute for cybersecurity. It’s the financial backstop after good controls are already in place.”

Jorgensen adds, “But the real opportunity is to strengthen the program — close gaps, validate limits, and make sure coverage reflects how the business actually operates.”

AI is creating new efficiencies and new exposures. If AI influences hiring, promotions, compensation or customer communications, employers may face claims that they failed to properly oversee the technology, Jorgensen says.

Gallaugher explains that AI-generated content can create professional liability issues. “AI can produce very confident answers that are still incorrect, and that’s dangerous when employees rely on it without human review.”

Both warn that businesses should not assume a single policy covers all AI-related risks. Employment practices liability, cyber/privacy coverage, directors and officers liability, and errors and omissions may all play a role, depending on how AI is used.

“AI should be treated like a powerful employee, not a magic answer machine,” Gallaugher says. “It needs supervision, controls and insurance protection behind it.”

Heat, storms and supply chain delays

Arizona’s property challenges are intensifying — and insurers are paying attention.

“Extreme heat, severe convective storm activity, wildfires and supply chain volatility are all reinforcing insurers’ focus on property quality, business interruption protection, and risk control measures,” Jorgensen says.

Gallaugher notes that two buildings in the same neighborhood can receive very different estimates. “The market is not treating every building the same anymore,” he says. “Age, roof condition, wildfire exposure, maintenance history — all of it matters.”

Underinsured buildings are a major concern. “Many businesses still have limits based on what the building was worth years ago, not what it would cost to rebuild today,” Gallaugher says.

Even in a soft market, poor risk quality can lead to higher deductibles, roof exclusions, limited water coverage or fewer carrier options. And both experts warn that a severe wildfire or monsoon season could quickly flip the market.

Heat, injuries and rising claim severity

Workers’ compensation remains stable, but underlying pressures are growing.

“Heat-related safety concerns, transportation risk, construction exposures and staffing volatility can all increase the likelihood of preventable claims,” Jorgensen says.

Gallaugher sees rising severity even when claim frequency is stable. “A business may have fewer claims, but when a claim does occur, the cost can be higher because of medical inflation, attorney involvement and delayed recovery.”

Both emphasize the importance of return-to-work programs, supervisor training, telematics for fleets, and data-driven safety strategies.

“The businesses that manage these expenses best treat workforce risk as a leadership issue, not just an insurance issue,” Gallaugher says.

Manage risk as one system

Both experts agree that the companies best positioned for 2027 will treat risk holistically.

“Manage risk as one connected system, not separate silos,” Jorgensen advises. “Cyber, property, supply chain, workforce safety and liability are increasingly intertwined.”

He also stresses the importance of choosing the right partner. “If the firm doesn’t have a comprehensive team backed by data to support risk control, claims management and placement, look elsewhere.”

Gallaugher echoes the sentiment: “Stop managing risk once a year at renewal and start managing it all year long. Risk does not wait for renewal.”

“The goal is not to buy the most insurance. The goal is to buy the right insurance, backed by the right risk management practices, so the business can survive disruption and continue growing with confidence.”