How will it Respond?

​

Artificial Intelligence ("AI") has rapidly moved from a technological curiosity to a mainstream business tool. Industry insight all points in the same direction: businesses are increasingly adopting AI across customer service, operations, compliance, risk management and strategic decision-making, with research studies suggesting most organisations are now using AI in at least one business function and increasing numbers redesigning entire workflows around it.

​

Coverage Matters is now using AI to help us analyse complex wordings and to check our work. 

​

The debate about whether organisations will adopt AI is therefore effectively over. The more interesting question for risk professionals is how insurance products will respond when AI becomes embedded in the activities they already insure. And how insurance products respond to loss caused by AI actions, outage or acting outside of its remit or authority.

​

The insurance market faced a similar challenge before. A decade or so ago, attention turned to "silent cyber" exposure, where policies written before widespread digitisation suddenly found themselves confronted by potential losses they had never expressly contemplated. The result was years of debate, wording development and ultimately the Lloyd's silent cyber campaign in 2019 / 2020. Most of us remember this. 

​

Where are we now? The UK Prudential Regulation Authority has not issued a “Dear CEO” letter to insurance companies requiring them to manage this risk. Neither has there been any formal mandate from the Corporation of Lloyd's requiring affirmative AI wording or the removal of non-affirmative AI exposure. 

​

Commentators are however now beginning to ask whether AI could become the next “silent” challenge. The Lloyd's Market Association (LMA) is studying AI exposures, considering possible wording responses and exploring whether AI-related losses should be expressly covered, expressly excluded or addressed through targeted endorsements. 

​

It therefore seems likely "silent AI" will become the next major market campaign. But this time, whilst silent AI poses similar cover challenges as silent cyber, the underlying risk is different, including with a few exceptions, the absence of an established AI Product to absorb AI specific risks which traditional Financial Lines products do not cover.  

 

With Deloitte forecasting that AI insurance could be a US$4.8 billion market by 2032, the business opportunity of addressing AI risk with coverage certainty is being made. The evolution of cyber insurance from a similar point in time may not have been a completely smooth transition but there is no doubt now that the need for coverage was real and the risks met the basic fundamental test of insurability. It looks like AI is heading down the same path – the challenge is how those risks might be addressed by traditional or new policy wordings. 

​

Where Do Exposures Really Lie? 

​

One of the challenges with this subject is working out where to start in the analysis to make sure all the bases are covered.

​

One helpful way of analysing AI exposures from the perspective of policy coverage is to focus on the role played by the insured in its relationship with AI rather than the technology itself.

​

The EU AI Act may not directly apply to the UK (although it does apply to AI outputs in the EU wherever sourced from), but it does provide some useful categories on which to base the analysis, including:

​

• providers – these are the tech companies that are developing AI systems (the well-known market leaders are being joined by an ever increasing cast of challenger firms);

• distributors – these are companies that sell or make AI available; and

• deployers – these are the users: companies like yours (insurance companies, brokers and buyers) and mine that use AI systems in their business operations. If your company is tailoring the AI and embedding it in its business it may also be deemed a provider. 

 

The Act prescribes different responsibilities for each of the above categories so it is clearer where ultimate responsibility for the consequences of using AI may lie. 

​

Consider two organisations:

​

• The first develops AI software and licenses it to thousands of customers.

• The second uses an off-the-shelf AI system to help manage administrative processes.

 

Both are using AI, but the potential liabilities they face are clearly very different.

 

An AI provider may face systemic issues concerning inherent flaws or defects in the AI system itself, intellectual property, regulatory concerns or performance claims. A user of AI may instead face allegations arising from its reliance on AI-generated outputs.

 

The market will therefore not be able to treat "AI risk" as a single homogeneous exposure with a “one size fits all” approach. The nature of the risk will depend on where the insured sits within the AI ecosystem. Any new clauses, exclusions or coverage extensions need to recognise this.

 

When Does AI Matter From An Insurance Perspective?

​

It is tempting to talk about AI as though it creates an entirely new category of risk. In practice, the position is more nuanced.

​

Many current AI applications simply assist users in carrying out activities that were already being performed (and covered by existing insurance) before AI arrived. Examples include:

​

• research;

• document production;

• presentations;

• summaries and comparisons;

• customer service support;

• workflow automation; and

• internal productivity tools.

 

If an employee uses AI to prepare a report but remains responsible for checking and approving the final output, has anything fundamentally changed from an insurance perspective? We would say no. The final output may well be better than if the employee had done all the work themselves. 

​

A professional indemnity policy covering negligent advice will still respond to negligent advice. A Directors' & Officers' liability policy will still respond to alleged wrongful acts by directors. A cyber policy will still respond to cyber events. The consequences of failure may remain largely unchanged even if the process used to arrive at the failed outcome looks different.

​

Recent analysis by Aon suggests that more than 90% of AI-related insurance exposure currently falls within policies that neither expressly cover nor expressly exclude AI. 

​

As such, the majority of current AI deployments are likely to be perfect examples of risk subject to a ‘silent AI’ ambiguity, presenting new coverage challenges for insurers, brokers and insureds. The real coverage challenge will however begin when AI moves beyond being a tool and starts becoming part of the decision-making process itself.

​

Are Existing Policies Already Covering AI?

​

Gallagher's 2026 AI Adoption & Risk Survey found that only 53% of insurance-sector respondents believed existing insurance arrangements fully covered AI-related losses, highlighting the uncertainty many organisations still face when assessing whether traditional policies will respond to AI-driven incidents. That finding is more pessimistic than the Aon analysis mentioned above but nevertheless suggests products have some catching up to do, in managing perception as well as in addressing the reality.  Brokers in particular will appreciate this. 

​

If AI is now becoming part of ordinary business processes, what exactly are existing insurance policies covering or expressly not covering and how well do those relying on the coverage understand the extent of cover provided – or not provided?

​

In some products, the underlying risks and potential liabilities are not fundamentally changed by the use of AI tool, eg: 

​

• Professional negligence remains professional negligence.

• Misleading statements to investors remain misleading statements to investors.

• Copyright infringement remains copyright infringement.

 

The introduction of AI does not necessarily create a new cause of action. Sometimes it simply changes the mechanism through which the loss occurs and of course may well greatly magnify it.

​

However, in other instances loss caused by an “agentic” AI agent acting independently from a human actor, may create a new underlying peril which is unaddressed in current wordings.

​

This is one reason why the LMA's work has focused not only on AI-specific losses but on whether existing liability, professional indemnity, crime, cyber and other policies may already respond to AI-related claims. 

​

Questions that are increasingly arising include:

​

• If AI-assisted professional advice is wrong, has the professional negligently provided a service?

• If directors rely upon flawed AI outputs, is this simply another form of management error?

• If an AI-enabled process fails, does the resulting claim fit comfortably within an existing “service failure” or “system failure” insuring clause?

• If an AI system creates a harmful output, is that a cyber issue, a technology issue, a professional indemnity issue, a governance issue, or something else entirely?

• If an AI agent undertakes actions which prove to be harmful to the proprietor or a third party, is this even an error, or a crime, as traditionally understood? 

 

These questions do not always produce clear answers and will certainly require careful consideration and drafting to ensure the intended outcome is achieved under any specific policy wording.

​

The Market is Talking About "Silent AI"

​

Existing wordings may be mostly silent on the issue of AI coverage, but there is activity beneath the surface. The LMA has publicly stated that it is studying AI exposures and considering the use of model clauses to insure, limit or exclude AI-related risks. It has also explored numerous AI loss scenarios across multiple classes of business. Brokers have also recently started to argue against the use of broad exclusions.  The market therefore appears to be at an interesting stage. 

​

You just have to hang around the Lloyd’s canteen for a bit to notice there is considerable discussion around:

​

• AI definitions;

• coverage intent;

• underwriting approaches;

• exclusions;

• endorsements; and

• new dedicated products.

 

However, on such a fast evolving and complex exposure insurers may be hesitant to move affirmatively in the short term, adopting a wait and see approach. This risks unintended cover, policy disputes and missed opportunities. Whilst not all covers require an affirmation, insurers do need to review their products and consciously make this decision, whilst also considering new exposure which needs to be underwritten. 

 

Getting down to Drafting

​

Before any insurer can decide whether to cover or exclude AI, it must first decide what AI actually means. This sounds obvious but is likely to be THE threshold issue in the product debate. 

​

If you are looking for a definition of “AI system” consider Article 3(1) of the EU’s AI Act as a starter for ten:

​

“a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”

​

The LMA Wordings Forum has already discussed specimen AI definitions drawing on concepts from the EU AI Act and other sources. 

Questions quickly emerge:

​

• Does AI include traditional machine learning?

• Does it include predictive analytics?

• Does it include expert systems?

• Is there a distinction between generative AI and other forms of AI?

• How should future technological developments be accommodated?

 

Insurance contracts rely heavily on defined terms to function effectively. Market definitions of cyber events, cyber war, terrorism, and pollution all generated significant debate before commonly accepted drafting approaches emerged. AI is unlikely to be much different.

​

There will be a Need for Affirmative or Extended Cover Clauses

​

Following on from the above, whilst silence on AI may in many cases be sufficient, clauses that affirm AI cover seem likely to be demanded at least in the short term. Examples include:

​

• In professional liability, where AI is simply used as a tool to undertake the same service already insured where humans are still involved it is hard to escape a conclusion that an affirmative cover clause could easily be added so long as there is a human meaningfully in control (and not just a bystander). 

 

• As with silent cyber, it is difficult to see why D&O policies should be anything other than affirmative (or silent) on AI so long as the directors are natural persons.

 

• In cyber, where the Insured is a victim of an attack from outside by an AI this is surely the same as any attack that ought to be covered (silence would be sufficient although an affirmative clause may be demanded). However, where the Insured’s own AI attacks another party’s computer system this is not currently clearly covered under cyber policies and would need an affirmative extension of cover or otherwise an additional specialised product. 

 

• In crime, where the Insured is a victim of an external crime perpetrated by a human using an AI agent, this is simply another way the external crime can be committed and so should be covered (so silence would be sufficient although an affirmative clause may be demanded). However, if AI acts autonomously to commit a third party “crime” against the Insured this is probably not already covered due to the particular definitions of external crime and so there would be a need for an affirmative extension of cover. There is currently no cover for an internal crime perpetrated against the Insured by its own AI (as opposed to an employee) so if required an extension or new product would be needed.

 

What Might Future AI Exclusions Look Like?

​

At the other end of the spectrum there will inevitably be discussion about exclusions at least in the short to medium term. 

​

When markets face emerging exposures whose frequency, severity or potential for aggregation remain uncertain, product exclusions are an option to mitigate the risk. We have already seen discussion within market forums around AI exclusions and AI-specific wording structures. 

​

What might such exclusions look like?  Some options appear below. 

​

Absolute AI Exclusions

​

The broadest approach would be an absolute exclusion for losses arising from the design, development, deployment or use of AI systems. I remember silent cyber starting here.

​

While simple, such clauses will be difficult to sustain commercially as they potentially remove core cover and could lead to customer outcomes considerations. 

​

Autonomous Decision Exclusions

​

Autonomous AI is an area where wordings may need explicit clarity through an exclusion, affirmation or an extension (see comments above). A targeted approach might focus on losses arising from AI-generated decisions, actions or advice where there is little or no meaningful human oversight.

​

This would distinguish between AI as a tool and AI as an autonomous decision-maker such as in the case of agentic AI. On the flip side, this might be the segway to new products (see below). Cyber exclusions on non-cyber products only really became acceptable once it was possible to get the same cover from a cyber policy, so there was no coverage gap. 

​

Provider-Based Exclusions

​

Other clauses might focus on excluding loss caused by defects within AI systems, tools or agents supplied by third-party providers. The primary focus of this exclusion would be to remove loss arising from defects embedded in an AI tool provided by any third party vendor. 

​

The exclusion could also be used either to limit cover only for specific vendors (where there are quality assurance concerns or aggregation issues) or with a specific vendor specific carve back once underwriting standards relating to testing are satisfied.  

​

Governance-Based Exclusions

​

The market might also consider restricting AI related cover where specific governance standards have not been met. Restrictions may be drafted as an exclusion, cover condition or a warranty (see below). General areas of governance standards may include, for example: 

​

• AI outputs were not subject to appropriate review;

• governance processes were inadequate;

• required controls were absent;

• there were no oversight mechanisms; 

• insufficient training and patchy implementation; or

• governance standards were too easy to bypass.

 

However, such restrictions would require great care and a high degree of specificity in drafting to ensure both they do not overreach and importantly achieve legal effectiveness.

​

In an environment where there is considerable uncertainty on AI governance, this type of cover restriction may be a valuable tool as standards on AI adoption and integration evolve and improve, and may contribute positively by incentivising buyers to address governance robustly.  

​

Overview

​

If the evolution of cyber insurance provides any guide, early exclusions may be broader while later versions become progressively narrower as experience develops and confidence grows, and specialised products are born. 

​

Great care will be required in drafting exclusionary language to ensure it achieves the intended outcome and no more. Where possible, exclusions should be targeted not wide-ranging. 

​

A New Underwriting Challenge: What Happens Between Day One And Day 365?

​

In the old days new technology took years, even decades, to evolve sufficiently to become widely adopted. The sheer pace of AI adoption creates an unprecedented challenge for insurers, brokers and buyers as potentially significant new exposure is evolving during the policy period, which is likely not required or indeed able to be disclosed on inception.   

​

An organisation using limited AI tools at inception could be completely dependent on them by expiry. This might be a material change in risk. 

​

As AI adoption accelerates, practitioners may begin asking new questions:

​

• Should significant changes in AI usage be reported mid-term?

• Are AI-related warranties appropriate? (see below)

• Should there be continuing disclosure obligations regarding AI deployment?

• Are premium adjustment mechanisms needed where AI usage changes significantly during the policy period?

 

If insurers determine they do require mid-term disclosure they need to ensure the policy language is clear. There needs to be clarity on what specific changes need to be disclosed, what the cover position is in the interim, what rights of the parties are to amend cover, and what happens if parties cannot agree. 

​

A Word about Insurance Warranties

​

Warranties were for a long time a taboo in many lines – seen as an unfair weapon used by insurers to remove all cover if breached regardless of whether the breach had any material consequence. 

​

However, since the UK Insurance Act 2015, the insurance warranty has no longer been a “nuclear” remedy for insurers.  These days warranties must be proportionate in their effect and are used in some lines to ensure the systems and controls in place at inception of the policy which were underwritten by the insurer remain in place throughout the policy period. 

​

A failure to do so would be a breach of the warranty which would suspend the cover until such matters were addressed or became expressly covered following a mid-term update to insurers. Importantly, the suspension of cover can only relate to a loss likely to have been caused by that breach, not other losses, so the cover would otherwise remain unaffected. 

​

As such, the warranty  can be a pragmatic solution and fairer than, say, a broad exclusion.   

​

Including specific warranties requiring the procedures / safeguards and approaches to AI disclosed by the Insured at inception to be substantially maintained during the policy period could be considered. 

​

New Products Are Already Emerging

​

On the flip side to exclusions, the market is responding positively through product innovation. Innovation should follow where the traditional products don’t provide a complete answer. This might be due to exclusions or simply new exposures that wouldn’t be covered otherwise (some examples were given above). 

​

Several specialist AI-focused solutions have already emerged with a number of stand-alone products and AI-specific extensions developed within technology-focused professional indemnity products. 

​

These products seek to address exposures such as:

​

• AI hallucinations;

• algorithmic errors;

• biased outputs;

• copyright issues;

• privacy concerns;

• in-built unconscious biases;

• inaccurate automated decisions; and

• AI-generated financial losses. 

 

It’s a Wrap

​

The market (like everyone) is struggling to keep up with the new exposures. 

​

What about the emerging risk of AI operating autonomously from humans, either because it has been empowered to do so, or unexpectedly (as we have seen it do in some recent notorious cases involving OpenAI)?  Or those situations in which the AI is merely used as a tool by humans but due to specific policy language its input is not otherwise covered?

​

In the short/medium term perhaps a “wrap” product could provide excess/DIC coverage for AI-caused losses where traditional products don’t provide cover. This would give the market time to develop specific dedicated products or amend existing ones for these exposures. 

​

Perhaps the most important opportunity will not be the products themselves but what they represent. AI products will create data. They will generate clear AI claims experience, underwriting information and actuarial insight. Over time, that information will help the market decide (probably using AI) where AI should be affirmatively covered, where exclusions are appropriate and how mainstream insurance products should evolve. This is the innovation that will drive the market development towards the US$4.8 billion of premium Deloitte estimate it will be worth by 2032.

​

The Coverage Question Does Not End With New Products

​

It’s a crowded product space already. If specialist AI products continue to emerge alongside traditional ones, some other familiar considerations arise.

​

• How they will all interlock

• Assessing gaps between products

• Conversely, assessing overlaps – Cyber has had to go through this process

• The risk of multiple products responding to different aspects of the same event causing aggregation risk

 

Readers of this Newsletter will know that these questions are not unique to AI. Similar issues frequently arise wherever multiple specialist products address related risks.

​

As with cyber before it, success may depend as much on how policies interact with each other as on the scope of individual covers themselves.

​

Time… and AI is Marching On

​

The question is no longer whether businesses will use AI. The evidence shows they already are. The more interesting question is how insurance products will evolve in response. They need to react more quickly than they did in respect of cyber.  

​

If you want a piece of that US$4.8bn or equally are worried about unexpected losses being covered under existing products, you need to put an internal taskforce on this now if you haven’t already done so. Get thinking about your products – there will be challenges but to the pioneers will eventually come the spoils.

​

​