Most organisations now run AI models and agents that can give wrong advice, leak data or take actions, but few have checked which insurance policy, if any, would respond when one does. AI risk falls between traditional lines: a chatbot's wrong answer looks like professional liability, a prompt injection that leaks customer data looks like cyber, a deepfake payment instruction looks like crime, and a generated image that infringes copyright looks like media liability. Since January 2026 some general liability policies in the United States can carry optional generative AI exclusions, while a smaller market offers affirmative AI cover. This guide is for risk managers, CISOs and AI governance leads. It explains how AI exposures map to insurance lines, where exclusions and silent cover sit, what affirmative AI products offer, what underwriters ask, and how to prepare evidence. It is not insurance or legal advice; your broker and policy wording decide what is covered.
Key takeaways
- "AI insurance" means three different things. AI-related cover in existing policies, standalone affirmative AI products, and regulation of insurers' own use of AI (such as the NAIC Model Bulletin). Be clear which you are discussing.
- Silent AI is today's silent cyber. Many policies neither grant nor exclude AI losses. That ambiguity tends to be resolved by exclusions at renewal, as Lloyd's did for cyber from 2020.
- Exclusions are arriving in liability lines. Verisk's ISO made three optional generative AI exclusion endorsements (CG 40 47, CG 40 48 and CG 35 08) available for US general liability from January 2026, according to the Big "I".
- Cyber policies respond to triggers, not technology. Whether an AI incident is covered usually depends on whether it meets the policy's definition of a security failure, system failure or privacy event, not on whether AI was involved.
- Controls are the negotiating lever. An AI inventory, identity controls for agents, human review of AI output and incident playbooks are the evidence that gets you better terms or cover at all.
Why AI risk is an insurance question now
Three developments push AI onto the renewal agenda.
- Liability is attaching to deployers. In Moffatt v. Air Canada (14 February 2024) the British Columbia Civil Resolution Tribunal rejected the airline's argument that its chatbot was responsible for its own statements and held the airline liable for negligent misrepresentation. The sum was small; the principle is not. See the Air Canada chatbot ruling and the AI Liability and Product Liability Guide.
- Attackers use AI. Lloyd's report Generative AI: Transforming the cyber landscape (12 March 2024) expected generative AI to increase the frequency, severity and variety of smaller-scale cyber attacks over the following 12 to 24 months, and urged businesses to seek appropriate risk transfer.
- Insurers are reacting. Trade press in October 2026 reported AI exclusions spreading through commercial policies and brokers advising clients to read the endorsement schedule at every renewal, while some carriers affirmatively extend cover for certain AI exposures.
The live Cyber Insurance Guide covers cyber policies in general: coverage parts, underwriting, panels and ransom decisions. This guide covers only how AI and agent risk interacts with them and with other lines.
Where AI losses land: mapping exposures to policies
Use this as a conversation map with your broker. The right-hand column lists the wording to check, not a guarantee of cover.
| AI loss scenario | Policy most likely to be asked first | Wording to check |
|---|---|---|
| Prompt injection makes an agent exfiltrate customer data (OWASP LLM01:2025 Prompt Injection; MITRE ATLAS AML.T0051) | Cyber (privacy liability, breach response) | Does "security failure" or "unauthorised access" include manipulation of an authorised AI system without any credential theft? |
| Agent with excessive permissions deletes production data or makes unauthorised changes (OWASP LLM06:2025 Excessive Agency) | Cyber (data restoration, business interruption) | Is an error by an authorised automated system a covered "system failure", or only an external attack? |
| Chatbot gives wrong advice and a customer suffers loss (OWASP LLM09:2025 Misinformation) | Professional indemnity or technology E&O; possibly general liability | Is advice delivered by AI within "professional services"? Any AI or automated decision exclusion? |
| Deepfake call leads staff to transfer funds | Crime (social engineering or funds transfer fraud); some cyber policies have a sub-limit | Social engineering sub-limits, verification conditions (call-back requirements) |
| Generated content infringes copyright or defames someone | Media liability; general liability Coverage B (personal and advertising injury) | Has CG 40 48 or a carrier's own generative AI exclusion been attached? |
| AI-controlled device or product causes injury or damage | General liability, products liability | CG 40 47 or CG 35 08 attached? Product recall terms |
| Biased automated decision leads to discrimination claim or regulatory action | Employment practices liability, D&O, E&O | Regulatory fines insurability, automated decision exclusions |
| AI model underperforms against a contractual guarantee | Usually uninsured in traditional lines; affirmative AI performance products | Performance warranty cover, attachment and measurement method |
The Arup case shows why the crime line matters: in January 2024 a finance worker made 15 transfers totalling HK$200 million after a video call in which the CFO and colleagues were deepfakes, and Arup said no internal systems were compromised. Without a system compromise, a cyber policy's security failure trigger may never be met. See the Arup deepfake fraud and the Deepfake and AI Impersonation Guide.
AI exclusions and silent AI
The silent cyber precedent
Lloyd's Market Bulletin Y5258 (4 July 2019) required every policy to state clearly whether it covers losses caused by cyber events, either by excluding them or by affirmatively granting cover, starting with first-party property policies incepting on or after 1 January 2020. Lloyd's defined non-affirmative (silent) cyber as a policy where no exclusion exists and there is no express grant of cyber cover. Expect the same logic for AI: insurers dislike accumulating risk they have not priced, so silent AI is likely to become explicit, and in most traditional lines that means exclusions.
The ISO generative AI endorsements
| Form | Coverage part | What it excludes (as reported) |
|---|---|---|
| CG 40 47 Exclusion: Generative Artificial Intelligence | ISO Commercial General Liability | Coverage A and Coverage B: bodily injury, property damage, and personal and advertising injury arising out of generative AI |
| CG 40 48 Exclusion: Generative Artificial Intelligence (Coverage B) | ISO Commercial General Liability | Coverage B only: personal and advertising injury arising out of generative AI |
| CG 35 08 Exclusion: Generative Artificial Intelligence | ISO Products/Completed Operations Liability | Bodily injury or property damage arising out of generative AI |
The forms carry a January 2026 edition date and are optional: each carrier decides whether to attach them. Individual insurers also write their own AI exclusions with differing wording. This is a US general liability development; other markets and lines use bespoke wordings.
What to look for in any wording
- Definition breadth: does "artificial intelligence" or "generative AI" cover any machine learning, any automated decision, or only content generation? Broad definitions can sweep in ordinary software.
- "Arising out of" language: broad causation wording can exclude a loss where AI played only a minor part.
- Carve-backs: some exclusions restore cover for specific uses or for losses that would be covered under a security failure.
- Interaction between policies: if general liability excludes generative AI, confirm whether E&O, media or cyber picks it up, so nothing falls between policies.
Affirmative AI cover
A smaller market offers cover that names AI risk explicitly. Products differ widely, so treat this as a list of features to compare, not a product category with standard terms.
- AI performance cover: pays when a model fails to perform as specified. Munich Re, for example, says it has offered AI insurance since 2018, describing its aiSure cover as triggered by unexpected errors in the ongoing performance of AI models, letting AI providers back performance warranties and covering adopters for lost revenue, business interruption and legal damages from AI errors, including hallucination.
- AI liability cover: third-party claims arising from AI output, such as misinformation, infringement or discrimination. Check whether regulatory defence is included.
- Affirmative AI endorsements on existing policies: some carriers extend cyber, E&O or media policies to name AI incidents. Read the trigger, sub-limit and any conditions on human oversight.
- Coverage for AI providers versus deployers: vendors building models face different exposures (model failure across many customers) from organisations deploying a third-party model in one workflow.
Decision guidance
| Your situation | Priority |
|---|---|
| Small organisation using AI assistants internally, no customer-facing AI | Confirm cyber and crime cover social engineering and data loss through AI tools; check for new exclusions at renewal |
| Customer-facing chatbots or advice tools | Professional indemnity or E&O wording for AI-delivered advice; general liability exclusions |
| Autonomous agents with write access to systems or payments | Cyber trigger definitions for authorised-system error; business interruption; consider affirmative AI cover |
| AI product vendor | Technology E&O with explicit AI wording; performance or warranty cover; aggregation across customers |
| Large or regulated enterprise | A coordinated review across all lines, a documented AI risk register for underwriters and, where available, affirmative cover for the highest-impact use cases |
What underwriters ask about AI, and the evidence to prepare
Questionnaires vary, but the questions cluster around the same themes. Brokers quoted in October 2026 advised clients to map where AI is used, whether staff rely on AI output, what human review happens and to document it.
- Inventory: a register of AI systems, models, agents and third-party AI services, with owner, purpose, data accessed and whether it acts autonomously. See the AI Governance Guide.
- Governance framework: alignment to the NIST AI RMF (AI RMF 1.0, January 2023, functions Govern, Map, Measure, Manage) and its Generative AI Profile NIST AI 600-1 (July 2024), or ISO/IEC 42001. See the NIST AI RMF Guide.
- Agent identity and access: agents run under their own identities with least privilege and short-lived credentials, not shared API keys or employee accounts; high-impact actions need approval. See the OWASP LLM Top 10 LLM06 Excessive Agency Guide.
- Human review: where AI output reaches customers or drives financial decisions, who checks it and how that is recorded.
- Testing: red teaming for prompt injection and data leakage before release. See the AI Red Teaming Guide.
- Payment controls: out-of-band verification for payment changes and large transfers, which crime insurers often make a condition of social engineering cover.
- Incident response: a playbook for AI incidents, including how to stop an agent and revoke its credentials. See the AI Agent Incident Response Playbook.
Answer accurately. The NCSC's cyber insurance guidance notes that policies are typically reassessed every 12 months and that inaccurate statements about security may affect payouts; the same applies to AI answers.
Running an AI insurance review
- Build the AI exposure register (two to four weeks): every AI use case with data accessed, actions it can take, who relies on its output and the worst credible loss.
- Map scenarios to policies: run each high-impact scenario through the table above with your broker and record which policy would be asked first and which wording could deny it.
- Read every endorsement schedule at renewal for AI, automated decision and generative AI exclusions, including CG 40 47, CG 40 48 and CG 35 08 in US general liability.
- Close gaps by control or by cover: reduce agent permissions and add human approval where cover is unavailable; seek carve-backs or affirmative AI cover where the residual risk is material.
- Align contracts: check indemnities and limitation of liability clauses with AI vendors and customers so contractual risk matches insured risk. See the Third-Party AI Risk Guide.
- Rehearse a claim: in an AI tabletop, include the step of notifying insurers and preserving prompts, outputs, agent logs and approvals as evidence.
Detection and measurement
- Logging that supports a claim: agent identity, prompts and tool calls, approvals and output versions, retained for the policy's notification and claims periods.
- Metrics: percentage of AI use cases in the register mapped to a policy; number of high-impact scenarios with no identified cover; percentage of agents running under unique identities with least privilege; percentage of customer-facing AI output with recorded human review; time to stop an agent and revoke its credentials in exercises.
Framework mapping
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| AI exposure register and risk appetite | GV.RM, ID.RA | RA-3 Risk Assessment |
| Risk transfer decisions and insurance review | GV.RM | PM-9 Risk Management Strategy |
| Supplier and AI vendor contracts | GV.SC | SR-6 Supplier Assessments and Reviews |
| Agent least privilege | PR.AA-05 | AC-6 Least Privilege |
| AI incident playbooks and claim evidence | RS.MA | IR-8 Incident Response Plan |
Common failure patterns
- Assuming the cyber policy covers "anything digital": an agent error with no external attack, or a deepfake fraud with no system compromise, may not meet the cyber trigger.
- Missing a new exclusion at renewal: optional AI endorsements can be attached without a change in premium being obvious.
- Answering questionnaires optimistically: stating that all AI output is human reviewed when chatbots respond directly to customers.
- Agents on shared credentials: makes it hard to prove what the agent did, and undermines both the claim and the control story.
- Uninsured contractual promises: giving customers AI performance or accuracy guarantees that no policy backs.
- No evidence trail: prompts and agent actions not logged, so the cause of loss cannot be shown.
Lessons from incidents
- Air Canada (2024): the deployer is responsible for what its chatbot says. Professional and general liability wordings, not only cyber, need review for customer-facing AI.
- Arup (2024): an AI-enabled fraud with no system compromise is a crime insurance question, and payment verification controls are both the defence and often a policy condition.
Practitioner checklist
- Build and maintain an AI exposure register with owner, data, actions and worst credible loss for each use case.
- Map each high-impact AI scenario to the policy that would respond, with your broker, and record gaps.
- Read every endorsement schedule at renewal for AI, generative AI and automated decision exclusions.
- Confirm how cyber policy triggers treat errors by authorised AI systems and manipulation by prompt injection.
- Check social engineering and funds transfer fraud cover and its verification conditions against deepfake scenarios.
- Give agents unique identities, least privilege and approval for high-impact actions, and document it for underwriters.
- Log prompts, tool calls, approvals and outputs long enough to support a claim.
- Align AI vendor and customer contracts with insured limits, and consider affirmative AI cover for residual high-impact risk.
Standards and references
- Lloyd's: Market Bulletin Y5258 Providing clarity for Lloyd's customers on coverage for cyber exposures
- Lloyd's: Generative AI reshaping the cyber threat landscape
- Independent Insurance Agents and Brokers of America: Verisk to Roll Out New General Liability Exclusions for Generative AI Exposures
- NAIC: Model Bulletin on the Use of Artificial Intelligence Systems by Insurers
- NIST: AI Risk Management Framework
- OWASP: Top 10 for LLM Applications 2025
- NCSC: Cyber insurance guidance
- Munich Re: aiSure insurance for AI systems
Related NHI Mgmt Group resources: Cyber Insurance Guide · Identity Controls for Cyber Insurance Questionnaires Guide · AI Liability and Product Liability Guide · AI Governance Guide. This guide summarises insurance market developments and is not legal or insurance advice.