The race to build the physical backbone of artificial intelligence is producing some of the largest concentrations of insured value ever assembled in one place. In an interview with CNBC on October 28, Aon CEO Greg Case warned that this concentration could make the data centers powering the AI boom difficult to insure, and that an insurance problem quickly becomes a financing problem.
His reasoning is simple and sobering: if insurance becomes hard to get, the way these projects are financed changes completely, because the debt markets stop being an option.
For anyone studying for the ARM™, this is not an abstract headline. It is risk assessment, risk financing, and business interruption all arriving in the same sentence.
What Aon's CEO Actually Said
Case's argument runs in a straight line. When developers build data centers on top of one another, billions of dollars of equipment and computing capacity end up in a small number of locations. He described that clustering as concentration risk that makes insurance harder to obtain. Without insurance, he said, developers cannot reach the debt markets they depend on to build. And the exposure is not only physical: he expects business interruption at these facilities to be measured in "millions of dollars per minute."
Aon also reported a record pipeline of data center projects in its third-quarter results, which helped drive 7% organic revenue growth in its commercial risk business. This is not a company describing a shrinking market. It is a broker describing a market growing faster than the capacity available to protect it. Case estimates the industry's roughly $4.5 trillion in capital must double or triple to meet demand across cyber, AI, data centers, and other emerging risks, and he sketched a range running from about $5 trillion to as much as $10 to $15 trillion.
The $10 billion data center facility and $2.5 billion energy facility are insurance capacity, meaning pools of risk-bearing capital Aon has arranged for specific industries. They are not construction financing. The connection to financing is indirect but powerful: lenders generally want to see that the asset securing their loan can be insured. When coverage is scarce, the cost and availability of debt follow.
Why Concentration Is the Heart of the Problem
Insurers make money by pooling many independent exposures. A fire at one warehouse in Ohio does not make a fire at a warehouse in Texas more likely, so the losses average out. That independence is what allows an insurer to price risk and hold capital against it.
Concentration breaks that logic. When a large number of expensive, tightly clustered assets can be damaged by the same event, whether a fire, a flood, a grid failure, a cooling failure, or a cyber incident, the losses are no longer independent. They are correlated. One event can produce a loss far larger than any insurer wants to carry on a single location or a single region.
ARM™ 400 Chapter 3 on risk assessment addresses exactly this: exposure, probability, volatility, consequence, and correlation are all measures a risk professional uses to understand a portfolio of risks. A data center campus has high exposure, an unfamiliar loss history, and heavy correlation among its components. That combination is what makes underwriters cautious.
Business Interruption at Machine Speed
The most striking point in the interview is the pace of the business interruption exposure. Traditional business interruption analysis measures downtime in days and weeks, with a waiting period and an indemnity period built around that scale. A facility whose output is computing capacity that other businesses depend on in real time compresses that timeline dramatically, to the point where losses accumulate by the minute.
This is the heart of ARM™ 402 Chapter 1. Business interruption risk depends on two things: how much revenue or value flows through a critical process, and how long that process can be down. For a data center, both variables are extreme. Revenue per hour is enormous, and the customers downstream of the facility have their own interruption exposure, which creates the kind of dependent business interruption and contingent exposure that risk managers must map carefully.
It also raises a practical question that standard policy wording was not written for. When the interruption is measured in minutes, a 72-hour waiting period is not a minor term. It can be the difference between a covered loss and a retained one.
Risk Management Starts Before the Policy Is Written
One of the more useful details in the interview is where Case says the real work begins. According to CNBC, Aon is working with developers on how facilities are designed and where they are located, with the goal of reducing the potential for business interruption and structuring coverage that can support financing. Case described these as engineering conversations about understanding risk.
That is the risk management process doing what it is supposed to do. Rather than treating insurance as something purchased after the design is final, the risk analysis feeds back into the design itself. Examples of that kind of design-stage risk reduction include spacing facilities rather than stacking them, choosing locations with fewer shared hazards, and building in redundancy. Each one changes the underlying exposure before any premium is quoted.
ARM™ 400 Chapter 4 on analyzing risk events covers the tools behind that thinking, including system safety analysis, failure mode and effects analysis (FMEA), and fault tree analysis. Chapter 5 then covers the treatment options that follow. The sequence matters: understand how the system fails, reduce what you can, and then finance what remains.
Where New Capacity Comes From, and the Catch
If the industry's capital must grow by multiples, where does it come from? Case's answer, as CNBC reports it, is to look beyond the insurers and reinsurers that have traditionally carried these risks. He pointed to institutional investors, pension funds, sovereign wealth funds, and wealthy individuals, which he estimates represent a potential pool of roughly $250 trillion, only a fraction of which would substantially expand the market. He also described Aon's ambition as acting less like a broker that places risk with existing insurers and more like a creator of new markets for risk.
This is risk financing evolving in real time. ARM™ 400 Chapter 5 introduces the range of ways organizations pay for risk, from commercial insurance to retention. What Case describes extends that range by bringing capital-markets money into the risk-bearing chain.
CNBC points out the catch: investors in insurance-linked strategies must be able to evaluate the potential for large and correlated losses. Case himself named the critical ingredient as quantifying exposures accurately enough to give investors confidence to commit capital. That brings the story back to risk assessment. Capital will not flow into a risk nobody can measure, and data center concentration is exactly the kind of exposure where measurement is hard.
Six Risk Lessons from the Data Center Boom
The Soft Market Is Not a Strategy
There is a counterpoint in the interview that risk managers should not miss. Commercial insurance pricing has been easing, and some companies are finally seeing relief after years of rising premiums. Case cautioned that this should not be mistaken for a permanent soft market.
He also noted something worth emulating: some clients, once they understand their exposure, use falling unit prices as a chance to restructure their programs and buy more coverage rather than simply bank the savings. That is a sound risk management instinct. A lower price is an opportunity to improve protection, not a reason to stop asking whether the program matches the exposure. Organizations that treat softening rates purely as a cost-cutting exercise may find themselves underinsured when the cycle turns.
Why Risk Managers Outside Tech Should Care
It is tempting to read this as a story about technology giants and their lenders. It is also a story about every organization that depends on cloud services, which is nearly all of them.
If the infrastructure that runs your applications, stores your data, or powers your AI tools is concentrated in a handful of facilities, you inherit part of that concentration risk through your vendors. You may have no contract with the data center, but you have an exposure to it. This is third-party and contingent risk in its purest form, and it is one reason ARM™ 400 Chapter 7 on organizational resilience matters: the ability to keep operating when a critical dependency fails is a function of planning you do before the failure.
There is also a pricing implication. If insurers are stretched on data center capacity, the effect can ripple into cyber and technology coverage more broadly, which is already a market where candidates in the ACRM program study how capacity, exclusions, and terms are shifting.
CNBC's report also points to the cyber side of the same concentration story. On October 21, researchers disclosed two critical vulnerabilities in PHP, a programming language used by roughly 70% of websites, that could let attackers run malicious code on vulnerable servers without authentication. AI played a significant role in discovering and analyzing the flaws. A widely shared technology component combined with AI-accelerated discovery is the cyber version of data center clustering: a single weakness that can reach a very large number of organizations at once. Asked whether cyber risk is escalating faster than insurers can respond, Case's answer was that the industry has to expand beyond its traditional capital base.
This story pairs with another development risk managers are watching. In a recent Global Finance Magazine article on AI insurance exclusions, I observed that the exposure existed before the exclusion; the exclusion simply made it visible. The same dynamic applies here. Data center concentration was always a feature of how AI infrastructure is being built. What is changing is that the insurance and financing markets are now pricing it.
What Risk Managers Should Do Now
The AI buildout is a case study in how risk assessment, risk financing, and business interruption planning are one connected system: when you cannot measure and transfer the risk, you may not be able to fund the project, which is why the risk management conversation has to happen before the construction does.
As of this writing, this is a warning from one of the world's largest brokers, not a market failure. Aon is building capacity, working with developers, and positioning itself to benefit from the demand. But the warning is useful precisely because it comes from a firm that sits between the risk and the capital. When the people who place the coverage tell you the capital may need to double or triple, risk managers should listen.
Risk Assessment, Risk Financing, and Emerging Technology — All Core ARM™ Topics
The redesigned 2026 ARM™ courses cover concentration risk, business interruption, cloud and AI exposures, and risk financing, all of which show up in this story.
Sources: Contessa Brewer, CNBC, "Aon CEO warns AI data center insurance risks could threaten financing" (published October 29, 2026), https://www.cnbc.com/2026/10/29/aon-ai-data-center-insurance-financing.html; Global Finance Magazine, "AI Insurance Is a Risk Officer's Nightmare" (October 2026). Statements attributed to Aon CEO Greg Case are drawn from his October 28, 2026 CNBC interview. This post reflects publicly available information as of November 9, 2026 and is for educational purposes only; it is not investment, legal, or insurance advice.
