More than 60 property and casualty insurance groups filed for AI exclusions in 2026, according to a September analysis by Gregory C. Allen at CSIS. The list of filers reads like the top of the industry: Berkshire Hathaway, Chubb, Travelers, AIG, Tokio Marine, W.R. Berkley, Great American and Fairfax. Citing reporting by The Information, the same analysis says state insurance commissioners approved more than 80% of carrier requests to exclude AI-related damages from corporate policies.
The coverage of this has mostly been about the labs. OpenAI reportedly carries up to $300 million of cover brokered through Aon, sources disagree on how much is really available, and Anthropic paid its $1.5 billion authors’ settlement off its own balance sheet. Those are interesting numbers. They are also somebody else’s problem.
The problem that belongs to you is quieter. If your company runs an AI agent against a system of record, the policy that would have paid for its mistakes last year may not pay this year, and nothing on the renewal will say so in large type.
Silent AI is ending, and the replacement is not a clear “no”
For most of the last three years, AI risk was covered the way early cyber risk was covered: by accident. Nobody wrote AI into the general liability, D&O or tech E&O forms, so nobody wrote it out either. The industry calls this “silent AI.” Aon has analysed more than 300 AI-related lawsuits and disputes and estimates more than 90% of AI-related exposure still sits in that silent coverage.
Carriers are now closing it, and they are not doing it in one place. A June 2026 review by Fenwick sums up the result in five words: “The result is not clarity but fragmentation.” Three moves matter.
General liability. Verisk’s ISO unit released three optional generative AI endorsements carrying a January 2026 edition date. CG 40 47 removes both Coverage A and Coverage B for bodily injury, property damage and personal and advertising injury arising out of generative AI. CG 40 48 strips only Coverage B. CG 35 08 does the same job on the products and completed operations part. The definition is wide: a “machine-based learning system or model that is trained on data” with the ability to create content or responses, “including but not limited to text, images, audio, video or code.”
Management liability. This is where the blunt instruments live. Berkley’s endorsement for D&O, E&O and fiduciary products, which Hunton Andrews Kurth called the first “absolute” AI exclusion, reaches claims tied to “any actual or alleged use, deployment, or development of Artificial Intelligence by any person or entity.” Its definition of AI opens with “any machine-based system that, for explicit or implicit objectives, infers, from the input it receives.” Read that slowly. A fraud-scoring model infers. So does a spam filter. “By any person or entity” means your vendor’s AI counts too. Hunton’s own verdict: “The potential breadth of this exclusion cannot be overstated.”
Cyber. For now, the exception. Fenwick describes cyber as “the most stable source of coverage for AI-related risks,” because many carriers still treat AI incidents as extensions of familiar perils: unauthorized access, data breach, social engineering. Note the “for now.”
The CSIS paper puts the pattern in one table. Of 112 cells in an Aon-derived coverage matrix, 13 are marked available, 9 limited and 90 excluded.
The question your claim will turn on: was it a breach or was it output?
Here is the part I have not seen anyone spell out for people who actually run agents.
Cyber still covers unauthorized access. The excluded lines cover what software does when it is working as designed and gets it wrong. An AI agent incident can be described either way, and the description decides which policy answers.
Take an agent you deployed with write access to your billing system. It misreads a contract, issues 4,000 incorrect credits, and a customer sues. Nobody broke in. The agent used credentials you gave it to take actions you authorized it to take. That reads like an output failure, which is exactly the zone Berkley-style language and the new E&O carve-outs are built to remove.
Now take an agent that wanders outside its sandbox and reaches a system it was never granted, the shape of the OpenAI evaluation agents that compromised Hugging Face in July. That reads like unauthorized access, which cyber still tends to treat as home turf.
Fenwick makes the general point in lawyer’s language: coverage often turns on how a claim is characterized, not on the technology involved, and the narrowing may be “a form of ‘quiet’ coverage erosion that may only become apparent at the claims stage.” Translated for operations: the first time you learn which side of the line your agent sits on may be the day an adjuster tells you.
That is also why the paperwork matters more than it used to. In the same year that a Senate bill put operator liability for reckless agent deployments on the table, the carriers that would have backstopped that liability were filing to step away from it. Your defence in front of a court and your argument in front of an adjuster now rest on the same record: what the agent was scoped to do, what it actually did, and whether you can prove the difference. If you have not built that record, the trace-and-attest approach to agent observability is the place to start.
The renewal questionnaire is now your AI audit
Twenty years in IT operations at a large telecom taught me that the cyber insurance renewal was the most effective control audit we never asked for. When the carrier started asking whether every admin account had MFA and whether backups were tested offline, those controls got funded within a quarter, because a “no” carried a price. Security teams had been asking for the same things for years. The application form did what the memos could not.
AI is getting the same treatment. Expect your next application to ask what models you use, which ones can write to production systems, and who approves their actions. Answer it as if it were an audit, because functionally it is one. Three things to do before your next renewal:
- Inventory first. Fenwick recommends an AI-use inventory, and you cannot answer an underwriter, or check a definition as broad as Berkley’s, without one. Include vendor features that switched on AI by default.
- Read every line together. Pull the cyber, tech E&O, D&O and general liability forms into one review and find each AI endorsement, exclusion and definition. An exclusion in the D&O form and a carve-back in cyber can leave a gap neither broker flags.
- Price the affirmative market, and know its ceiling. Dedicated AI cover exists. AIUC writes agent policies with limits up to $50 million, and in February ElevenLabs became the first company to launch an AIUC-1-backed policy, covering its voice agents. CSIS puts the specialty range at roughly $25 million to $50 million per insured. That is real money for a mid-size deployment and a rounding error for a large one.
Insurance is regulating AI by leaving the room
Allen’s argument at CSIS is that insurance has become the most important de facto regulator of AI deployment in the United States, and that it is regulating by withdrawal rather than by setting standards. Cyber insurance shaped corporate security by pricing MFA and backups. On AI, carriers cannot yet see which models an insured runs or how they are governed, so they are excluding instead of pricing. His fixes include a NIST incident database modelled on aviation’s anonymous reporting system and a staged federal backstop along the lines of Price-Anderson for nuclear.
I think he is right about the mechanism and that his timeline is the risk. Those fixes take years. Your renewal does not. In the meantime the practical outcome is that AI risk is sliding from the insurer’s balance sheet back onto yours, one endorsement at a time, while agent deployments keep growing.
Treat that as an input to the deployment decision, not a footnote to it. An agent that can write to a system of record now carries a retained risk you may be holding uninsured. That is not a reason to stop. It is a reason to scope the agent as if no one else is paying for its mistakes, because increasingly no one is.