AI, Liability, and Insurability: What Businesses Need to Know

Artificial intelligence is moving rapidly from experimentation into everyday business operations. Companies use AI to write code, analyze information, support professional decisions, communicate with customers, and automate workflows. As adoption accelerates, so do questions about how AI-related exposures could affect liability, claims, and underwriting.

As we explored in How Emerging Technology is Changing Insurance, Liability, and Business Risk, AI changes exposures businesses already manage, including cybersecurity, privacy, professional liability, employment practices, and executive liability. There is no shortage of discussion about how AI could reshape claims and underwriting. There is, however, a shortage of significant AI-related losses to provide the claims experience for insurers to assess how these exposures may develop over time. How claims evolve as technology matures will be a critical factor in shaping the future market for AI coverage.

What cyber underwriters are asking about AI today

Cyber underwriters are asking high-level questions about AI governance and compliance. Even for large organizations, the focus is typically on who oversees AI, the involvement of senior management and the board, and whether clear roles and accountability are in place, rather than on specific applications or controls. The volume of AI applications and use cases has reached a point where underwriters can’t evaluate each one individually.

For now, insurers are assessing a dynamic exposure with little claims history to guide them. Many expect AI to influence future claims and underwriting, but those trends have yet to materialize.

What ransomware can tell us about AI risk

Before ransomware losses became widespread, cyber coverage was relatively inexpensive, and underwriting requirements were less extensive. As claims accumulated, insurers scrutinized cybersecurity practices more closely. Controls such as multifactor authentication, endpoint detection and response, backups, and employee training became a greater part of underwriting conversations.

AI is likely to follow a similar path. Insurers currently have limited claims history showing which AI applications generate significant losses or which controls consistently reduce them. As data accumulates, carriers will be better positioned to set underwriting requirements, create policy language, establish pricing, and allocate capacity. AI-related E&O, cyber, EPLI, media liability, and D&O claims are expected to become more prominent over the next three to five years, giving underwriters more to work with.

Loss trends will ultimately shape underwriting, as they did when ransomware reshaped the cyber market. While a single AI-related loss is unlikely to drive immediate market changes, a sufficiently large systemic event could accelerate shifts in underwriting, coverage terms, and available capacity.

That evolution is likely to bring greater underwriting scrutiny. Insurers may begin asking more detailed questions about how businesses use and oversee AI, and insurance buyers should be prepared to answer them. Among the most important questions will be how responsibility is assigned when AI contributes to a loss.

Who’s responsible when AI makes a mistake?

If claims experience shapes AI underwriting, a key question will be who bears responsibility when AI contributes to a loss. Outside technology providers complicate the answer.

Why outside AI tools do not necessarily transfer responsibility

Consider a hospital that uses an AI-enabled system to support patient care. If the technology contributes to an error, the hospital could still face the claim. Any liability on the part of the AI provider may ultimately depend on the contractual terms governing the relationship. The same issue applies to other professionals in law, finance, architecture, and engineering. Using an outside AI tool does not necessarily transfer responsibility for the professional decisions made with it.

How vendor contracts and visibility affect liability

Most companies using AI rely on third-party technology providers, which may themselves depend on other models, cloud platforms, and data providers. Contracts often determine how liability is allocated when a provider contributes to a loss, making vendor oversight an important part of managing AI risk. In many cases, contractual limitations restrict the extent to which companies can transfer risk to third-party providers and their downstream vendors.

Organizations may lack visibility into where information is processed, what systems an AI tool can access, or which vendors support the underlying service. That complicates investigating an incident, assigning responsibility, or pursuing recovery.

When evaluating AI vendors, areas to examine include:

• How contracts allocate liability when an AI provider contributes to a loss
• What cybersecurity and data protection requirements AI vendors must follow
• How quickly vendors must report security incidents and what audit rights purchasers retain
• What business continuity protections apply if an AI platform or supporting provider becomes unavailable

How shared AI providers can create systemic risk

These dependencies also create the potential for systemic risk. Many businesses may rely, directly or indirectly, on the same models, cloud infrastructure, or technology providers. A vulnerability, outage, or security incident affecting a widely used provider could impact numerous organizations simultaneously, interrupting operations, limiting access to critical information, disrupting customer service, or creating downstream financial and liability exposures.

Agentic AI raises new questions about oversight and accountability

Questions about responsibility become even more complex as AI moves from generating information to taking action. Agentic AI can execute tasks rather than simply recommend them.

An agent could execute a transaction, access sensitive data, modify systems, or interact with another organization's technology without direct human involvement. The potential consequences extend beyond inaccurate output. An error could result in financial loss, exposed information, operational disruption, or damage to a third party.

Recent incidents have highlighted these concerns. In August 2026, OpenAI disclosed that AI agents participating in internal cybersecurity testing circumvented controls and compromised parts of Hugging Face's systems beyond the scope of their assigned tasks, raising questions about autonomy, permissions, oversight, and safeguards as organizations grant AI systems greater authority to act. These applications are still developing, but they show how AI risk may evolve. As businesses give AI more authority to execute tasks and make decisions, questions about human oversight, accountability, and liability will likely become more prominent when automated actions cause harm.

Governance and risk management require a cross-functional approach

As organizations navigate the liability, accountability, and operational challenges, governance is critical part to managing AI risk.

One of the first steps is gaining visibility into where and how AI is used across the organization. Employees can adopt publicly available AI tools without going through procurement, IT, or security review, creating what is often referred to as "shadow AI." Without a clear understanding of what tools are being used, what data they can access, and how outputs are being applied, organizations may struggle to identify and manage risks.

Start by maintaining an inventory of AI applications, defining approved use cases, establishing a process for evaluating new tools, and training employees on appropriate use.

Who is responsible for AI governance decisions

Effective AI governance also extends beyond IT. Clearly define who is responsible for evaluating new AI applications, assessing risk, and approving higher-risk use cases. For example:

• Security teams can evaluate cybersecurity and data protection implications
• Legal, finance, and compliance teams can assess regulatory and contractual considerations
• Business leaders can establish accountability, decision-making authority, and risk tolerance

Systems that access sensitive information, influence significant decisions, or interact with other technologies may warrant added oversight and stronger controls.

Assess what systems AI tools can access, what data they can retrieve, and how they interact with third-party providers. This visibility can help identify potential cybersecurity, operational, and liability issues before they become larger problems.

While governance practices will continue to evolve alongside the technology, organizations that focus on visibility, accountability, employee training, vendor oversight, and security today may be better positioned as AI-related claims increase and underwriting expectations evolve.

How to prepare for AI underwriting scrutiny

AI may make familiar losses more sophisticated. Social engineering, impersonation, data compromise, professional errors, and technology failures could all take new forms as AI capabilities improve. As organizations give AI greater access to systems, data, and business processes, a compromised model or provider outage could affect many organizations at once, magnifying the impact of a single incident.

The AI claims landscape is still developing, but history suggests insurers will respond as loss patterns emerge, much as they did when ransomware incidents rose. As claims data accumulates, carriers may place greater emphasis on governance, vendor management, employee training, and controls surrounding AI use.

Organizations that establish those practices now may be better positioned to demonstrate their risk profile when discussing policy terms, pricing, and capacity. Improving visibility into AI use, defining governance responsibilities, evaluating third-party providers, and overseeing higher-risk applications can help address these risks before claims activity and insurer scrutiny increase.

Follow the Future of Risk series

The future of risk is constantly evolving. Explore our Future of Risk hub for the latest blogs and insights.