Key takeaways
In 2023 I wrote a piece for Carrier Management asking whether insurance is the hero AI needs. My answer was yes. Regulations and standards matter, but insurance is what lets people take risks they understand. Nothing big gets built without it.
Three years later, the market is having that conversation out loud. Everyone from brokers to reinsurers to the Financial Times is talking about "AI insurance." Can you buy it? Who's selling it? Is my existing policy already covering it? Should it?
Those are good questions, and I don't think all of them have settled answers yet. But underneath every one of them is a question that does have an answer: what does an insurer need to see before it can confidently stand behind your AI?
That question is about governance.
AI insurance is in transition. Most AI risk is still covered silently inside existing policies, some insurers are adding exclusions, and a small specialist market is writing AI coverage explicitly. Here's a quick level-set, because the details matter.
Today, most AI risk is covered "silently." Existing policies neither explicitly include nor exclude it. Aon's 2026 report, AI Risk is Outpacing Insurance, examines how silent AI is creating hidden insurance gaps as adoption accelerates, and puts the share of insured AI risk sitting in silent cover at more than 90%.
Some insurers are making those boundaries explicit. ISO's general liability exclusions for AI took effect in January 2026, including CG 40 47, CG 40 48 and CG 35 08 for commercial general liability policies. Others are moving the other way and writing AI in. Around 10 markets now offer standalone AI liability cover, and household names are asking for more limit than the market can yet provide. Most AI liability underwriters currently have between $5 million and $25 million of available limit, against requests for tens or hundreds of millions.
Meanwhile, governance hasn't kept pace with adoption. Gallagher's latest AI Adoption and Risk Survey of more than 1,200 businesses found that 43% have yet to introduce a formal AI risk management framework, and only 44% have conducted AI impact assessments.
There's a growing assumption in the market that AI needs its own explicit coverage, either as a standalone product or affirmatively written into existing policies. On many levels, that makes sense to me. Explicit coverage gives buyers clarity about what's protected. It forces risk to be identified and priced. And it creates a path to the larger limits that big enterprises are asking for.
But I'm not convinced it's the only answer, and I'm not sure it's the right destination for every kind of AI risk. AI is increasingly woven into how companies underwrite, service customers, hire, write code and run operations. A mistake made with AI is still a mistake in underwriting, or in customer service, or in hiring. Existing lines of coverage were built to respond to exactly those kinds of losses. Experienced underwriters see it that way too. Zurich North America's head of professional liability and cyber told Business Insurance that in most cases, amending policy language to address AI exposures is unnecessary, though some insurers have issued endorsements to make their intent clearer.
So I can see a future where some AI risk gets carved out and insured explicitly, and a future where most of it stays inside the policies companies already buy. Probably some of both.
Underwriters assess AI risk by looking at the controls around it, because loss history is still thin. Think about the challenge for anyone pricing AI risk today, explicitly or not. The technology changes every few months. The same model can be harmless in one use case and highly consequential in another.
So what does an underwriter do when the actuarial data isn't there yet? They look at the controls. The market is already building around that idea. Aon recently launched an AI Risk Diagnostic that assesses AI governance maturity and risk exposure as the professional liability market moves away from silent AI assumptions.
You want coverage for your AI, right? You want a meaningful limit at a reasonable price, right? Then think about the questions you'd expect a thoughtful underwriter to ask:
None of those questions are exotic, and none of them depend on what the policy is called. They're the basics of good AI governance. A company that can answer them with evidence, from a system of record rather than a scramble through email and spreadsheets, is a much easier risk to understand. And a risk that's easier to understand is a risk that's easier to insure, in a standalone AI policy or in the E&O policy it renews every year.
Insurers will offer more AI coverage when they can see, across many insureds, that AI risk is being managed consistently. That capacity gap I mentioned is the part of this story I find most interesting.
Big companies want large AI limits, and the market isn't there yet. Some of that is simply a young market. But capacity follows confidence, regardless of the policy form. Carriers and reinsurers will put more limit behind AI when they can see that risks are being identified, controlled and monitored in consistent ways.
Proportionality matters here too. Not every internal chatbot carries material exposure, and not every back-office automation deserves the same scrutiny as an underwriting model or a customer-facing agent. Good governance helps you figure out which systems matter most, which is exactly the conversation you want to be ready to have with your broker.
If you're a risk leader trying to get ahead of this, a few practical moves:
I've said for a long time that good AI needs great governance. The insurance market is making that concrete. Insurers are asking questions, experimenting with products, and working out how to stand behind a technology that can make our lives genuinely better. Whether that ends with explicit AI coverage, smarter use of the policies we already have, or a mix of both, we'll see.
The companies that can show their work will get the coverage, the capacity and the terms, whatever form they take. That's an opportunity worth getting ready for.
Insurance is still the hero AI needs... and governance is how we help it show up.
What is AI insurance? AI insurance refers to coverage for losses caused by AI systems, such as harmful or inaccurate outputs, model errors, or decisions that lead to liability. Today it shows up in three forms: standalone AI liability policies, AI coverage added to existing cyber or liability policies, and "silent" coverage inside policies that don't mention AI at all.
What is silent AI coverage? Silent AI coverage means an existing policy, such as general liability or E&O, neither explicitly covers nor excludes AI-related losses. Aon estimates more than 90% of insured AI risk currently sits in silent cover.
Do businesses need standalone AI insurance? It depends on the business and how it uses AI. Explicit AI coverage offers clarity and a path to larger limits, while existing policies may already respond to many AI-related losses. Review renewals with your broker for new AI exclusions or endorsements, and focus on the AI systems with material exposure.
What do insurers look for when underwriting AI risk? Because AI loss history is limited, underwriters look closely at governance: whether a company has an inventory of its AI, clear accountability for high-impact systems, independent testing before deployment, ongoing performance monitoring, and records that show what happened and who decided what.
How does AI governance affect insurance coverage? Evidence of strong AI governance makes AI risk easier for insurers to understand and price, whether that risk is covered by a standalone AI policy or an existing line like E&O or D&O. Companies that can demonstrate their governance are better positioned for coverage, capacity and terms.
Anthony Habayeb is co-founder and CEO of Monitaur, an AI governance software company he started in 2019. Before Monitaur, he was a strategic consultant at Accenture and held executive roles at Yahoo, Monster and Gannett.
