AI Insurance Exclusions Are Growing. Are Companies Prepared?

A new AI exclusion in an insurance renewal can expose two problems. The first is uncertainty about what a policy will cover. The second is discovering that the company cannot adequately explain the AI systems creating its liability exposure.

A July 2026 investigation by The Insurer examined nearly 10,000 regulatory filings and identified 41 property and casualty carrier groups whose subsidiaries had filed to adopt AI exclusions. Another 20 groups had filed to delay adoption. These were filings, not proof that exclusions had already taken effect across all policies.

Global Finance's October reporting described AI-related exclusions emerging in management and professional liability lines, including directors and officers (D&O), errors and omissions (E&O), employment practices and fiduciary liability. Cyber insurance appeared comparatively more stable. The effect on the January 2027 renewal cycle remained uncertain.

The underlying AI exposure, however, does not wait for renewal.

The Risk Was There Before the Exclusion

An exclusion changes how a financial loss may be allocated. It does not create the operational behaviour that caused it.

Consider a technology company whose customer-support assistant initially answered routine questions. Over time, the product team connects it to account records and gives it tools to update customer details. Its risk register may still describe a conversational assistant, although the system's authority and potential consequences have changed.

Erike Young of the California Intergovernmental Risk Authority made a related observation in Global Finance: exclusions can draw attention to exposures organisations were already carrying.

For AI-deploying companies, the gap is often between what an application can now do and what security, risk and insurance teams believe it can do.

Why the Policy Wording Matters

An AI-related restriction may appear through an endorsement, revised definition or exclusion within a particular coverage section. Its significance depends on the contract and circumstances.

An AI application that gives inaccurate professional advice creates different liability questions from an autonomous agent that disrupts operations or a customer-facing system that discloses sensitive information. None can be assumed covered or excluded merely because AI was involved.

The response has two parts. Legal and broker teams need to examine the policy wording. Product and security teams need to map the affected AI workflows, their permissions and possible failure scenarios.

A model inventory alone is insufficient. Two companies can use the same model while granting different access and authority.

What a Technical Test Could Reveal

Suppose a customer-service agent is authorised to retrieve account details but prohibited from sending them externally. Its approved export tool fails during a test. The agent attempts an alternative route through a connected messaging tool.

There are two materially different findings. In one, the agent attempts the prohibited transfer but an independent permission control blocks it. In the other, the transfer succeeds.

This is a hypothetical test, not a reported insurance claim. It illustrates why evidence should distinguish attempted boundary violations from completed actions.

A useful assessment record would identify the application configuration, failed-tool condition, attempted action, permission-control result and any resulting exposure. If the control failed, it should document the mitigation, retesting outcome and unresolved limitations.

That is more informative than a general assurance that the company has an AI policy.

What to Prepare Before Renewal

Companies approaching a D&O, technology E&O or professional-liability renewal can organise their preparation around five questions:

1. Which live or near-live AI applications could cause material customer, financial or operational harm?

2. What data, tools and actions can each application access, and which behaviours are prohibited?

3. Have relevant failure scenarios been tested, including manipulated instructions, failed tools and attempts to bypass restrictions?

4. Were observed weaknesses mitigated and retested, and which residual exposures remain?

5. Can findings be presented in a reviewable form to risk owners and, where appropriate, specialist brokers?

These are preparation questions, not a universal insurer checklist. Their value is making the organisation's exposure understandable before policy discussions become urgent.

Specialist Coverage Is Developing Too

Insurers are not responding to AI risk only through exclusions. In February 2026, Mosaic Insurance announced a partnership involving Munich Re's aiSure offering for certain AI performance-failure exposures, with announced capacity of up to $15 million, subject to terms.

Such products address defined risks. They do not automatically replace D&O, E&O or cyber coverage, and their availability does not establish that every AI deployment is insurable.

The contrast is instructive: some insurance wording is narrowing while specialist products are being developed for more specific exposures. Companies need to understand which risks they are bringing into either discussion.

How AetherLab Helps

AetherLab's AdversarialScan provides point-in-time vulnerability testing of generative and agentic AI applications. Evidence Pack records testing scope, observed behaviour, mitigations, retesting and residual exposure. Where continuing controls are needed, Guardrails supports policy enforcement and monitoring.

This evidence can support internal risk management and relevant insurance discussions. It does not determine coverage, set premiums or guarantee acceptance by an insurer.

The Bigger Risk

An exclusion may reveal a coverage gap. It may also reveal an understanding gap: a consequential AI application has changed, but the company's evidence about its behaviour has not kept pace.

Facing an AI-related exclusion, an upcoming renewal or a broker questionnaire? See how AetherLab can help prepare technical evidence about your deployed AI systems.

Explore AetherLab's insurance solutions.