AI Insurance Coverage: Why Are Insurers and Brokers Divided?

Three major insurance brokers are challenging broad exclusions for artificial intelligence. Their argument is not that AI introduces no new risks. It is that removing coverage whenever AI contributes to a loss could leave businesses uninsured for activities their existing policies were intended to protect.

Marsh has opposed broad or absolute AI exclusions. Aon has questioned blanket restrictions, while WTW has warned that excessive exclusions could undermine the value of cyber insurance.

The disagreement reflects a difficult market question: how can insurers distinguish unfamiliar AI exposures from established business risks that increasingly involve AI?

For technology companies deploying consequential AI, the answer depends partly on something more specific than whether they use artificial intelligence. It depends on what their systems can actually do.

Why the Brokers Are Pushing Back

In reporting published by The Insurer on 5 October 2026, Marsh Risk president and CEO Nick Studer warned that broad AI exclusions could create gaps in clients' insurance programmes.

Marsh indicated that it would not support broad or absolute wording that removed meaningful protection simply because AI was involved. Where insurers insisted on such restrictions, it would recommend considering alternative terms or markets.

Aon's Tracy-Lee Kus made a related argument in 8 October reporting: AI is becoming embedded in so many business activities that blanket exclusions are increasingly difficult to justify.

WTW's Andrew Hill approached the issue from the buyer's perspective. If cyber policies accumulate too many restrictions, customers may question whether the coverage remains worth purchasing.

Hill also acknowledged legitimate concerns about systemic AI exposure and the potential for AI to make cyberattacks easier. The brokers are not arguing that every AI-related risk must be covered.

Their common objection is to exclusions that fail to distinguish between materially different exposures.

Not Every AI Deployment Creates the Same Risk

Consider three technology companies using generative AI.

The first uses an assistant to draft professional communications. Its principal concerns may involve inaccurate statements, confidentiality and human review.

The second operates a customer-facing agent connected to sensitive records. It must consider manipulated instructions, inappropriate disclosure and failures to escalate consequential requests.

The third gives an autonomous agent permission to modify production infrastructure. An incorrect action could interrupt services or damage operational systems.

All three use AI, but the systems have different authority, failure scenarios and potential consequences.

A broadly worded exclusion may not reflect those distinctions. It could restrict coverage for familiar professional or operational exposures without adequately differentiating them from new forms of autonomous risk.

More specific insurance wording can help. But companies also need to explain what their AI applications are authorised to do and how their safeguards have been tested.

Insurers Have Legitimate Reasons to Be Cautious

Insurers must evaluate risks that can change rapidly and, in some cases, lack substantial historical loss data.

An AI application may gain new capabilities after a model update, integration or permission change. A system previously limited to recommendations may begin executing actions.

There is also the possibility of correlated losses. Multiple companies may depend on the same model provider or shared AI infrastructure. A common failure could affect many insured organisations simultaneously.

Testing one company's application can help identify vulnerabilities within that deployment. It cannot resolve every risk associated with shared infrastructure or portfolio-wide accumulation.

The dispute is therefore not simply between brokers protecting clients and insurers resisting AI. Both sides are trying to manage uncertainty, but from different commercial positions.

Marsh Re Identifies Another Potential Gap

The disagreement also extends to reinsurance.

Primary insurers issue policies to businesses. Reinsurers provide protection to insurers against specified portions of their exposure. Their contractual terms do not always match.

According to October reporting, Marsh Re president and CEO Dean Klisura argued that reinsurance treatment of routine AI applications should more closely reflect primary coverage.

If a primary insurer covers an established category of loss involving AI but its reinsurance applies a broader exclusion, the insurer may retain more risk than expected.

That mismatch does not automatically change the policyholder's contractual rights. It may, however, affect the insurer's willingness to offer particular terms, limits or coverage.

This is a separate challenge from assessing an individual company's AI controls, but it helps explain why the exclusion debate is commercially significant.

Where Technical Evidence Becomes Useful

Consider a hypothetical customer-service AI application connected to financial account information.

During adversarial testing, an attacker-controlled instruction attempts to make the assistant disclose another customer's records. In one test, the assistant attempts the disclosure but an independent control blocks it. In another, the information reaches the requester.

Those are different technical findings. The first shows a particular control working under the tested conditions, while also revealing an attempted boundary violation. The second identifies a completed disclosure requiring investigation and mitigation.

A reviewable assessment would document the application's permissions, scenarios tested, observed outcomes, corrective actions, retesting and unresolved exposure.

Such evidence cannot determine whether an insurance exclusion applies. But it can help a technology company describe its actual deployment rather than relying on a general statement that it uses AI responsibly.

AetherLab's AdversarialScan and Evidence Pack support this distinction through point-in-time behavioural assessment and documentation of findings, mitigations and residual risk. Neither replaces underwriting judgement.

What AI-Deploying Companies Should Prepare

When reviewing coverage or discussing AI exposure with a specialist broker, companies should be able to explain:

1. Which consequential AI applications are deployed and what each is authorised to do.

2. Which failure scenarios could create material customer, operational or professional liability.

3. How relevant safeguards have been tested, including attempted and completed violations.

4. What vulnerabilities were found, remediated and retested.

5. Which risks remain, including dependencies on external AI providers.

These are practical preparation questions, not requirements attributed to Marsh, Aon or WTW.

The Bigger Issue Behind Broad Exclusions

The brokers' challenge exposes a weakness in treating AI as a single insurance exposure.

An inaccurate professional communication, a manipulated customer-service agent and an autonomous infrastructure failure may all involve AI. They do not necessarily require the same controls or warrant identical insurance treatment.

Insurers need to understand which risks they can responsibly assume. Brokers need to preserve meaningful protection for clients. Companies deploying AI need to explain the exposures created by their actual systems.

The insurance market is debating how much AI risk it should cover. Businesses need to be able to explain precisely what risk they are asking it to cover.

For companies deploying consequential AI, independent testing can help identify behavioural vulnerabilities, evaluate safeguards and document residual risks before insurance and broker reviews.

Explore AetherLab's AdversarialScan to build a clearer technical picture of your AI exposure.