Getting your Trinity Audio player ready...

Key takeaways

  • While oil and gas companies are applying rigorous governance to operational risks, many have yet to establish equivalent oversight for AI.
  • While 93% of organizations say they understand AI-related risks, only 43% have implemented a formal risk management framework.
  • As AI becomes embedded, effective governance requires clear accountability. But that responsibility needs to fall on the entire enterprise, not just IT.
  • Building on existing risk management disciplines will help improve accountability and address operational, regulatory and insurance considerations.

AI adoption is outpacing governance frameworks

engineer with a laptop on the background of an oil pump

In the oil and gas industry, no refinery would introduce a new process without a hazard review, nor would any operator bypass a management-of-change procedure. Yet many organizations are introducing AI into critical workflows, such as exploration, maintenance and operational decision-making, without the same level of oversight.

"AI touches everything from operations and finance to legal and HR," explains Trevor Gilstrap, Energy managing director, Oil & Gas, Gallagher. "However, it's hard to shape governance around AI until you truly understand where and how it's embedded within your organization."

As Gallagher AI Adoption and Risk Benchmarking research reveals, while 93% of organizations say they understand AI-related risks, only 43% have implemented a formal AI risk management framework. It's clear that when it comes to how AI is being used and who is responsible for managing its risks, we still have a way to go.

Indeed, as AI becomes more embedded in decision-making processes, governance gaps can create insurance exposures, coverage uncertainty and increased scrutiny from regulators, boards and insurers.

"We're still early in the AI journey and we haven't seen any incidents yet. But it's important to think about governance and risk management from the outset rather than later in the adoption process," says Michael Hogue, Energy managing director, Power & Utilities, Gallagher.

The good news is that the same discipline oil and gas companies use to manage physical and operational risks can provide a strong foundation for managing AI. The challenge is to keep pace with AI adoption.

How AI Powers Oil and Gas Operations

Area AI uses and applications
Exploration and drilling
  • Accelerates seismic interpretation and subsurface modeling.
  • Optimizes drilling parameters in real time, reducing equipment failures.
Asset performance and predictive maintenance
  • Monitors equipment health across thousands of assets.
  • Detects potential failures before breakdowns occur.
Safety and workforce monitoring
  • Verifies personal protective equipment (PPE) compliance in real time.
  • Identifies unsafe behaviors before incidents occur.
Environmental monitoring and process control
  • Detects methane leaks and emissions faster than traditional inspections.
  • Optimizes fuel blending and process performance.
Operations support and decision-making
  • Helps forecast demand, pricing and market shifts.
  • Enables operators to search for technical knowledge and access manuals through conversational AI.

Emerging risks: Where management is key

Understanding AI risk isn't the same as managing it. Gallagher's research also found that only 46% of organizations are developing AI incident response plans, and close to half (45%) conduct ethical or bias-impact assessments.

Many companies underestimate how widely AI is already being used, whether through employee adoption without formal oversight or third-party vendors embedding AI into services and platforms.

Without a clear view of where AI is being used and how it influences business decisions, organizations will struggle to identify, assess and monitor the risks it creates.

"If a significant AI-related incident occurs and there's no governance in place to manage the associated risks, regulators may react unfavorably," says Joey Sylvester, area senior vice president at Gallagher.

AI ownership extends beyond IT

Governance challenges become more complex when AI is treated solely as a technology issue, especially since AI-based decisions affect multiple business areas.

AI systems increasingly draw on data from operational environments, creating cybersecurity, operational and governance considerations that extend beyond traditional IT functions.

Effective governance requires input from operations, legal, cybersecurity, risk management and executive leadership to ensure risks are evaluated from multiple perspectives.

Balancing automation and accountability in operational decisions

The survey findings also reveal that AI errors, misinformation and hallucinations were the leading AI risk concerns identified by business leaders — the majority (57%) viewed them as either moderate or major risks. In operational environments, incorrect outputs can affect safety, reliability and business continuity, with implications that extend well beyond the technology itself.

As Joey Sylvester warns, "as we integrate AI into automated environments such as drilling operations or chemical processes, the potential for real-world consequences is very real. In the oil and gas industry, an AI error or hallucination could directly impact people, assets and operations."

Decision limits: AI automation challenges in drilling operations

Autonomous drilling is a new frontier of AI in the industry. Using real-time operational data, AI systems can adjust drilling parameters to improve efficiency and support performance.
An emerging concern is "excessive agency." This is where AI systems are given too much autonomy without sufficient oversight or accountability.
Without clear limits, validation procedures or human review, AI-driven decisions may fall outside established parameters or safety controls.
"In the realm of IT, this could lead to critical issues like the deletion of entire codebases or changes moving from test environments to production without authorization and before teams are ready. In operational technology (OT), it might result in instances such as drilling too deep, too quickly or in an unsafe manner. In plant operations, it could involve a chemical process that surpasses safety parameters, potentially resulting in an industrial incident," explains Sylvester.
Human oversight, approval thresholds and governance controls are therefore critical, as AI takes on a greater role in operational decision-making.

From governance gaps to coverage gaps

As insurers become more familiar with AI-related exposures, organizations will increasingly be asked to explain where AI is used, who oversees it and how decisions are validated.

"We are still at the early stages, with insurers starting to show interest in this topic," Gilstrap notes. "But we know that underwriting scrutiny is going to increase over time."

That level of attention is only likely to increase as insurers gain more experience of AI-related losses across industries. There are already more than 200 active legal cases involving artificial intelligence and machine learning, covering issues such as data bias, privacy liability, discrimination and regulatory compliance. At the same time, at least one insurer has introduced a stand-alone AI liability policy, while others are offering endorsements to cover the costs of retraining large language models.

Different lines, multiple considerations

The potential implications for the oil and gas industry span multiple lines of coverage.

Contract review is another area attracting attention, particularly in an industry where agreements between operators and contractors are often highly customized. Insurers are examining employment practices, asking whether AI is being used in hiring, recruitment or workforce decision-making.

'Silent AI' is making itself heard

For many risk professionals, AI echoes the early days of "silent cyber," when emerging risks outpaced policy language and coverage expectations.
While many AI-related exposures are currently addressed through existing cyber, professional liability and other policies, insurers are continuing to refine exclusions, endorsements and underwriting requirements.
An AI-driven privacy breach may fall within a cyber policy, while biased hiring decisions, faulty operational recommendations or AI-related liability claims may trigger entirely different coverage considerations.

What an AI governance framework looks like

Oil and gas companies already have extensive experience managing complex operational risks through structured processes, defined accountability and formal oversight procedures.

AI governance can build on the same principles. Rather than treating AI as a technology initiative, organizations can take a cross-functional approach that brings together operations, legal, cybersecurity, risk management and executive leadership. By doing so, operational and risk considerations can be reflected in decision-making.

Workforce readiness is another key consideration. Employees need clear guidance on when and how AI can be used, where human review is required and which decisions are not appropriate to be delegated to automated systems.

The danger is that without appropriate training and oversight, employees may come to rely on AI in situations that require human judgment.

From awareness to action: Building strategic internal partnerships

For many oil and gas companies, the challenge is no longer whether to adopt AI, but how to govern it effectively. Building a successful framework requires more than technology expertise.

AI governance isn't about slowing innovation. It's about adopting new technologies with greater confidence and clarity. Organizations that clarify decision-making responsibilities, strengthen governance and align AI with their risk management strategy may be better positioned to manage these emerging risks.

The oil and gas industry has a long track record of addressing risk before incidents expose vulnerabilities. As AI adoption accelerates, the same discipline can help organizations strengthen governance, improve oversight and make more informed decisions about emerging risks.

Where to begin?

Understanding how AI risks interact with existing insurance programs can help identify potential gaps before a loss occurs. Gallagher supports organizations in connecting AI governance and risk management, ensuring companies in the oil and gas industry have the right coverage in place.

To learn more, contact your Gallagher representative to discuss how AI is embedded in your business, understand governance framework gaps that may be present and get a comprehensive coverage review.