What happens when the smartest systems we build start creating losses that no insurance company on earth can fully absorb? That question stopped being theoretical the moment one of the leading AI developers laid out its concerns in black and white. The filing made it clear: some AI-related harms could prove simply uninsurable. And this is not a problem limited to tech giants. Every company now weaving artificial intelligence into daily operations faces a similar shadow.
Why AI Liability Suddenly Feels Too Big For Traditional Coverage
I have spent years watching how new technologies first slip under existing policies and then force the entire insurance industry to scramble. Cyber risk followed that path. AI appears to be sprinting along the same track, only faster and with higher stakes. The core issue is scale. When a single model can influence decisions across thousands of users or generate content that reaches millions overnight, the potential for concentrated harm grows far beyond ordinary accident or error scenarios.
The language in recent disclosures is unusually direct. Models may act in ways no developer or user intended. Claims arising from those actions could produce substantial liability. More striking still is the admission that existing policies might not stretch far enough, and that the insurance industry as a whole may lack both the capacity and the expertise to underwrite catastrophic AI events. That is not marketing caution. That is a frank assessment of market reality.
In my view, the most interesting part is how quickly everyday business tools have entered this conversation. Chatbots that answer customer questions, systems that screen job applications, or algorithms that guide medical triage no longer sit at the edge of risk. They sit in the middle of it. And the policies most companies already own were never designed with these tools in mind.
How Current Cyber Policies Handle AI And Where They Stop
Right now cyber insurance carries most of the load for AI-related incidents. When a model contributes to a data breach, a privacy violation, a system outage, or a sophisticated deepfake fraud scheme, cyber policies often respond. Some carriers have even widened their wording to capture AI-driven security events. That helps. Yet nearly every cyber form still draws a hard line at bodily injury.
This exclusion creates what many brokers now call a gaping hole. Cyber was built for data and dollars, not for people getting hurt. If an AI system contributes to a physical injury or worse, the claim often falls outside the policy. General liability sometimes steps in, but underwriters remain cautious. They need clear evidence of how the risk is managed before they will extend coverage. Most companies cannot yet map every place employees use AI tools, so underwriters hesitate.
Insurers are essentially saying they cannot cover what companies cannot show them. Visibility into AI use has become the first practical requirement.
Professional liability and other specialty lines are also adjusting, each in its own way. The result is a patchwork. Coverage exists for some losses and evaporates for others. Businesses that treat AI as just another software tool may discover too late that their protection is thinner than expected.
The Parallel With Early Cyber Insurance Offers Clear Lessons
Anyone who lived through the rise of cyber insurance recognizes the pattern. For years cyber risk sat quietly inside general liability policies. Then insurers began naming it, excluding it, and selling it back as a separate product. The checklists those underwriters imposed effectively became the de facto security standards for many organizations. AI appears headed down the same road, only the timeline is compressed.
Until recently the conversation focused almost entirely on adoption. How fast can we put AI into the business? That focus has shifted. Leaders now ask what happens when the technology goes wrong. The change has exposed how poorly AI fits inside the policies companies already own. Exclusions can activate whenever AI sits anywhere in the causal chain, including inside a vendor product that the insured never fully understood.
Underwriters have started asking pointed questions. Where is AI used? Who oversees it? What human review exists before an automated decision reaches a customer or patient? Companies that cannot answer clearly may face higher premiums, lower limits, or outright exclusions. Those that invest early in documentation and controls will likely find better terms.
Bodily Injury And Physical Harm Remain The Hardest Frontier
Financial loss coverage for AI is expected to become relatively routine. It will be priced and structured much like cyber. Bodily injury is different. Experts anticipate tight underwriting, modest sub-limits, and strict requirements for human oversight. In healthcare-adjacent fields some businesses may discover they cannot buy meaningful coverage at all.
The concern is not abstract. Research already tracks cases in which AI systems played some role in fatalities. The numbers remain modest today but are projected to climb. Courts will eventually decide where liability lands, yet insurers must set terms long before those decisions arrive. The uncertainty itself slows product development.
I find it telling that many carriers still prefer to exclude rather than underwrite these exposures. They are not being overly cautious. They are acknowledging that the loss data simply does not exist yet. Without reliable historical patterns, pricing becomes guesswork, and insurance markets dislike guesswork when the potential severity is high.
Everyday Business Uses Create Hidden Exposure
It is easy to focus on frontier models and overlook the quieter risks. A local company website chatbot that gives a customer incorrect safety advice. An HR team relying on automated screening that later faces discrimination claims. A logistics algorithm that routes vehicles in a way that contributes to an accident. These scenarios no longer feel distant.
The challenge is visibility. Many organizations cannot say with confidence where employees are using public AI tools. Shadow AI is real. When a claim arises, the first question from the insurer will be whether the tool was authorized and properly governed. Companies that cannot demonstrate basic controls risk discovering that coverage does not apply.
- Customer-facing chat systems that provide advice or recommendations
- Automated decision tools in hiring, lending, or claims handling
- Content generation systems that may infringe intellectual property
- Monitoring or diagnostic tools used in safety-critical environments
- Third-party AI embedded inside vendor platforms
Each of these use cases can trigger different policy responses. Some fall under cyber. Others lean on professional liability or general liability. A few may find no natural home at all. Mapping the actual footprint of AI inside the organization has become a practical first step for risk managers.
Will AI Insurance Become A Separate Product Or Stay Embedded
Opinion inside the industry remains divided. Some believe financial-loss AI coverage will simply fold into existing cyber forms and become standard. Others argue that the unique characteristics of AI, especially the potential for novel and correlated losses, will eventually require dedicated products.
One practical argument against separation is administrative complexity. Creating one general liability policy for everything that does not touch AI and a second for everything that does would create endless disputes over causation. AI is already becoming invisible and ubiquitous. Isolating it in the causal chain of every loss may prove impractical.
At the same time, the industry has not yet encountered a wholly new category of risk created solely by AI. Existing harm categories still dominate: privacy events, security failures, intellectual property disputes, and professional errors. That could change. The operative word remains “yet.”
What Underwriters Are Already Asking Companies
Conversations with risk managers reveal a consistent set of questions. Carriers want to know which models are in use, whether they are proprietary or third-party, what training data practices were followed, and what human review processes exist before automated outputs reach the public. They also ask about monitoring for drift and unexpected behavior.
Companies that have implemented baseline controls tend to receive more constructive engagement. Those that have not may eventually face exclusions if they show no willingness to improve. Most carriers still prefer partnership over exclusion. They want to help clients manage the risk rather than simply decline it. That attitude can change quickly once claim patterns shift.
Intellectual property claims currently dominate the early loss activity. Developers face allegations of scraping protected content for training. Users face allegations that generated material infringes existing rights. Privacy-related claims appear as well. Pure security events driven by AI are harder to isolate because attackers already use the technology to improve social engineering, making the AI contribution difficult to measure after the fact.
Practical Steps Companies Can Take While The Market Develops
Waiting for perfect insurance products is not a strategy. Organizations can reduce their uninsured exposure today by improving governance. Start with an inventory. Identify every significant AI use case, including those introduced by vendors. Document the purpose, the data involved, and the human oversight in place.
Next, strengthen the controls that underwriters value most. Clear usage policies, logging of high-impact decisions, and escalation paths when models produce unexpected results all help. Training employees on the limits of the tools they use reduces the chance of careless reliance.
Finally, review existing policies with a specialist who understands both cyber and emerging technology language. Many wordings already contain subtle AI-related exclusions or conditions that only surface after a claim. Clarifying those points now is far cheaper than litigating them later.
The Capacity Question No One Can Fully Answer Yet
Perhaps the most sobering statement in recent disclosures concerns capacity. For a truly catastrophic AI-related incident, no single insurer and potentially the entire industry may lack sufficient capacity or expertise to provide meaningful coverage. That possibility forces a different kind of conversation. Self-insurance, captives, and government backstops begin to enter the discussion once traditional markets reach their limits.
We are not there yet for ordinary business use. Most day-to-day AI applications still produce losses that existing markets can absorb. The concern sits at the tail of the distribution, the low-probability, high-severity events that could affect many policyholders at once. Correlated risk is the insurance industry’s least favorite characteristic, and advanced AI systems have the potential to create exactly that kind of correlation.
In my experience, markets eventually find ways to price almost anything once enough data accumulates. The open question is how much pain occurs during the learning period. Early cyber insurance went through cycles of aggressive pricing followed by sharp retrenchment when claims arrived. AI coverage may follow a similar path, only with larger numbers involved.
Looking Ahead Without Panic Or Complacency
The responsible stance is neither alarm nor indifference. AI will continue to spread through every sector because the productivity gains are real. At the same time, the liability landscape is still forming. Companies that treat insurance as an afterthought will discover gaps at the worst possible moment. Those that treat risk management as an ongoing discipline will negotiate from a stronger position.
Regulators are beginning to pay closer attention. Meaningful federal rules could eventually shape both the technology and the insurance response. Until then, private markets and court decisions will set the practical boundaries. Insurers often end up writing the standards that companies follow long before legislation catches up. That pattern is already visible here.
The next few years will reveal whether AI risk remains an extension of familiar categories or evolves into something genuinely new. Either way, the companies that map their exposure, document their controls, and maintain open dialogue with their insurers will navigate the transition with fewer surprises. The ones that assume their existing policies automatically cover every new tool may learn expensive lessons.
I keep returning to a simple observation. Technology moves faster than insurance forms. That gap has always existed. The difference today is the potential severity of the outcomes when the forms lag too far behind. Closing that gap requires honesty about what current coverage actually provides and disciplined work to improve both the technology’s governance and the insurance products designed to protect it.
The conversation has only started. Every organization that relies on AI, which increasingly means every organization, has a stake in how it develops. Paying attention now is not optional. It is simply prudent.
As more claims surface and more data accumulates, underwriters will refine their appetite. Some risks will become insurable on commercial terms. Others may remain partially or wholly outside the private market. Understanding which category each exposure falls into will become a core competence for risk teams. The earlier that work begins, the more options remain available.
Ultimately the goal is not to eliminate every risk. That is impossible. The goal is to understand the risks clearly enough to decide which ones to retain, which ones to transfer, and which ones require changes in how the technology itself is deployed. Insurance is only one tool. Governance, monitoring, and thoughtful design matter just as much. The organizations that balance all three will be best positioned when the next wave of AI-related claims arrives.
That wave is coming. The only open question is how prepared each company will be when it does.
