AI Insurance for Model Failures Is Real, and Your Evidence Sets the Price

Insurers wrote AI out of standard policies before they wrote it back in as a product. In January 2026 the Insurance Services Office issued three generative AI exclusions for commercial general liability. Affirmative AI insurance now exists to fill that hole, and the price you pay for it turns on evidence most buyers have never been asked to produce.

The short answer

AI insurance is affirmative cover for losses caused by an AI system doing its job badly, including hallucinations, model drift and unauthorised agent actions. It sits beside cyber and technology errors and omissions rather than inside them. Underwriters price it on governance evidence: evaluations, approval gates, retained logs and stated authority limits.

What AI insurance actually covers

Start with the thing that makes this category different from cyber. Cyber insurance responds to an attacker. AI liability cover responds to your own system behaving badly with nobody attacking it at all.

That distinction is the whole product. A model that quietly drifts, a support agent that invents a refund policy, a marketing tool that produces copy someone else owns: none of those involve a compromise, and all of them produce a bill.

Armilla, a managing general agent and Lloyd's coverholder, launched affirmative AI liability insurance with Chaucer on 30 April 2025. The announcement describes a trigger built around underperformance of AI applications, including failure to perform as intended and critical errors, hallucinations or inaccuracies leading to damages.

Read that carefully. The insured event is defined by output quality. That is unusual, and it explains why underwriters want to see your evaluation results before anything else.

My view is that this is the correct design and it is also the hardest thing to administer. Quality is a spectrum, and every claim will involve an argument about where on that spectrum the failure sat.

Two shapes of cover exist, and they are not substitutes. The first is third-party liability. Someone sues you because your AI system harmed them, and the policy pays defence costs and damages. That is the Lloyd's product and the HSB product.

The second shape is a performance warranty. The vendor promises a model will hold a stated accuracy threshold, and an insurer stands behind that promise. Armilla's warranty product is backed by Swiss Re, Greenlight Re and Chaucer, and it pays the buyer when a verified model falls below its benchmark.

Buyers keep conflating these. A warranty protects your investment in a tool. Liability cover protects you from what the tool does to a third party. You can need both, and buying one does not touch the other.

The exclusions came first, and that is the real story

Most coverage of this topic leads with the new products. That is the smaller half of the news.

In January 2026 the Insurance Services Office, part of Verisk, issued three generative AI exclusion endorsements for US commercial general liability policies. They do not attach automatically. Each carrier decides whether to use them, and you find out at renewal.

Form numbers and scope as summarised by Gallagher and Claims Journal, 2026. Adoption is at each carrier's discretion, so the presence of these forms on your policy is a fact to check rather than assume.

The gap is not one hole, it is four. Fenwick's June 2026 analysis makes the sharper point. Cover is fragmenting independently across cyber, technology errors and omissions, directors and officers, and employment practices, and a single AI incident can touch several of them at once.

Each line narrows on its own schedule. No single underwriter is looking at the combined picture. That is how a company ends up with four policies and no cover for the event that actually happens.

The industry name for the old state of affairs is silent AI: policies that neither affirmed nor denied the exposure and left the argument for claim time. Silent AI was never a benefit. It was an unpriced option that you would have had to litigate to exercise.

Who is writing this cover today

Three distinct routes to market have appeared, and they suit different buyers.

The Lloyd's specialist route

Armilla operates as a managing general agent and Lloyd's coverholder focused solely on AI liability, with capacity from certain underwriters at Lloyd's including Chaucer. This is the route for AI vendors and for enterprises deploying models in regulated workflows.

The reinsurer route into small business

HSB, the Munich Re specialty carrier, launched AI liability insurance for small and mid-sized businesses on 18 March 2026. It covers bodily injury, property damage and personal and advertising injury arising from AI use, which maps precisely onto what the ISO forms take away.

HSB does not sell direct. The cover is added to partner carriers' business policies, subject to regulatory approval. So for most small firms this will appear as an endorsement option rather than a purchase decision, and the broker conversation is where it gets caught or missed.

The certification-first route

The third route inverts the order. AIUC publishes an auditable standard, AIUC-1, covering data and privacy, security, safety, reliability, accountability and societal risks, then underwrites against audit results. Named certifications include KPMG's document capture platform and Intercom's support agent Fin.

In February 2026, ElevenLabs announced insurance for its AI agents backed by that certification, after more than 5,000 adversarial simulations across the standard's domains. The company framed it as insuring the agent the way you would insure an employee.

I think this route wins the enterprise segment, for an unglamorous reason. It gives the underwriter something to underwrite.

What underwriters ask for

The submission for AI liability looks nothing like a general liability application. It looks like a security questionnaire written by someone who has read your incident log.

The clearest public map of the questions comes from an academic framework rather than a broker. A June 2026 preprint by Quanyan Zhu at New York University, Insurance of Agentic AI, sets out the underwriting structure directly. It is a preprint and not peer reviewed, which matters, and it is the most specific published account available.

The exposure inventory

First they establish what you have running. Use case, autonomy level, permissions to change external state, transaction volume, and any interface to physical systems.

Most companies cannot produce this list. That is the finding, not an administrative delay. If you cannot enumerate your agents and what each one is allowed to touch, you are asking an insurer to price an unknown, and they will price it as one.

The control evidence

Then they test the controls. Approval gates, least-privilege architecture, logging and monitoring, model evaluation, rollback mechanisms, and defences against prompt injection.

Each of those is a checkable artefact. An approval gate is either in the code path or it is not. A documented human review step in the architecture is worth more at underwriting than a policy document saying humans review things, because one is evidence and the other is intent.

The telemetry commitment

The third block is the one buyers underestimate. The framework requires the insured to preserve prompts, tool traces, access logs, model and version records, approval records and rollback history.

This is a continuing obligation, not a one-time disclosure. It also implies a notification duty when you change a model version in a way that expands autonomy or removes an approval gate. If you ship weekly, that is an operational commitment your engineering team has to agree to before anyone signs.

There is a second-order effect worth naming. Once retention is a policy condition, your production monitoring for agent drift stops being an engineering nicety and becomes a contractual artefact. Insurance is quietly doing what compliance frameworks have failed to do, which is make observability non-optional.

Left and middle columns are the pattern we see in buyer conversations. The right column follows the control and telemetry categories set out in the NYU framework. Treat it as a preparation checklist, not as any single carrier's application form.

That last row is the one legal teams miss. Your own liability caps and remedies for AI agents define the exposure the insurer is standing behind. If your contracts promise uncapped indemnity for AI output, you are asking an underwriter to absorb a commitment you chose to make.

Certification is becoming the pricing engine

The interesting structural change is not the policy wording. It is that a third-party audit now sits between you and the price.

Armilla includes independent AI system certification with its policies. AIUC ties cover directly to audit results against AIUC-1, a standard built with input from MITRE's ATLAS threat framework, Stanford academics and the law firm Orrick. Schellman is its first accredited auditor.

ISO/IEC 42001:2023 is the international management system standard for AI, and certification against it gives an underwriter third-party evidence of governance controls. Practitioners report it helping with cyber and technology errors and omissions terms.

Be precise about what it proves. ISO 42001 certifies that you have a management system, with policies, roles and review cycles. It does not certify that your model is accurate. An organisation can hold the certificate and still ship a system that hallucinates in production.

So the two layers are complementary rather than interchangeable. Management system certification answers whether you are governed. Model evaluation answers whether this specific system works. A governance maturity assessment is a reasonable way to find out which layer you are missing before a broker finds out for you.

What agents change about the submission

Everything above holds for a model that answers questions. It changes when the system can act.

The NYU framework treats agentic AI as a continuum of autonomy, delegation and authority rather than a category. That is the right frame for a submission, because the underwriter's real question is how much authority you delegated and what stops it.

Authority limits are becoming the practical equivalent of a deductible. An agent that can draft a refund is a different risk from one that can issue a refund, and an agent with a spend ceiling is a different risk from one without. Your authority clauses for AI agents are underwriting inputs now, not legal boilerplate.

Prompt injection sits in an awkward place across this whole map. It looks like a security event, so cyber may respond, and it produces a bad output, so AI liability may respond. Anyone deploying agents with tool access should read how prompt injection actually breaks agent security before assuming either policy picks it up cleanly.

What it costs, and why nobody will quote you a number

Here is the honest position. There is no public rate for AI liability insurance, and any article giving you a premium range is extrapolating.

The Lloyd's product describes high aggregate limits without publishing figures. HSB distributes through partner carriers, so pricing sits inside each carrier's filed rates. Standalone AI liability is written on a submission-by-submission basis, which is the market's own signal that it does not yet have a rating table.

What is public is the market forecast. Deloitte projects roughly $4.7 billion in annual global AI insurance premiums by 2032, growing near 80% compounded from a base close to zero. A projection off a near-zero base carries very wide error bars, and it should be read as direction rather than as a number to plan against.

The practical consequence is that your submission quality has unusual leverage on price right now. In a mature line, good controls move you within a rating band. In a line with no rating table, the evidence pack is most of what the underwriter has. That asymmetry will close as loss data accumulates, so the firms that prepare properly this year get the best relative terms they will ever get.

Where this argument is weakest

I have just spent 2,000 words telling you to prepare for an underwriting conversation. Here is the case against doing much about it yet.

There is almost no loss history

The NYU paper is blunt about it: publicly available insured-loss datasets specific to agentic AI remain limited. Pricing without loss experience is guesswork with a spreadsheet attached.

The legal picture is thin too. The Database of AI Litigation at GW Law tracked about 260 cases as of March 2026, and roughly 40 of those concern copyrighted works used in training, which is a vendor problem rather than a deployer one. That is not a large enough body of resolved claims to calibrate an insurance product against.

The most-cited deployer precedent remains small. In Moffatt v. Air Canada, a British Columbia tribunal held the airline responsible for its chatbot's fabricated bereavement policy and awarded CAD 812.02. The principle is important and the quantum is a rounding error. Nobody has yet tested a large AI hallucination claim through to judgment.

The exclusions may be broader than the cover

This is the risk I would flag hardest to a buyer. The ISO forms exclude injury arising out of generative AI, which is expansive language, while affirmative products describe specific triggers.

If exclusions are drafted broadly and cover is drafted narrowly, buying both leaves a seam. Until claims have tested both wordings, nobody can tell you how wide that seam is, including the people selling you the policy.

Certification could become theatre

Audit-based underwriting works while audits are hard to pass. The failure mode is familiar from security questionnaires, where certification became a procurement ritual that predicted very little about actual breaches.

I do not think AI certification is there yet, because the standards are new and the audits involve adversarial testing rather than document review. Ask me again in three years. If certification volume grows faster than auditor rigour, the pricing signal degrades and we are back to underwriting on judgement.

Frequently asked questions

Where to start this week

Two tasks, and the first one is not an insurance task at all.

Build the register. One row per AI system in production, with the owner, the model and version, what it can read, what it can write, whether a human approves anything, and what you keep when it goes wrong. Most teams will find the register takes a fortnight and reveals two systems nobody was tracking. That finding is worth more than the policy.

Then ask your broker one specific question before renewal: which AI exclusion endorsements, by form number, are attached to each of our policies this year. Not whether AI is covered. The form numbers. A broker who cannot answer that within a week has not read your wordings, and that is the more urgent problem. The same discipline applies to what you sign with vendors, which is covered in the piece on the AI contract clauses a CFO should insist on.

Related reading