Do you need AI agent liability insurance? What to know before you sign up

Standard insurers are writing AI out of their policies while a new crop of underwriters are rushing in to fill the coverage gap. Let's clarify your options.

Read full bio October 30, 2026, 11:01 am ET

akinbostanci/ E+ via Getty Images ZDNET’s key takeaways Insurance providers are asking regulators to allow AI-specific exclusions to policies. New insurance products are rushing in to fill the coverage gap. What to know about these AI-specific insurance policies before you sign. Convoluted multi-agent AI systems now have access to a company’s inboxes, login credentials, customer records, and payment systems. AI coworking tools have the run of your employees’ devices. IT is scrambling to keep track of all the AI vendors, each of which has different data-sharing policies that affect your compliance posture.

Also: Who owns AI risk at work? Business leaders can’t agree

All of that creates unpredictability that doesn’t appeal to every insurer’s risk palette. In fact, AIG, Great American, WR Berkley, and other major insurance companies are already working with US regulators to add AI exclusions to their policies. Moreover, 80% of state insurance commissioners have already acquiesced to their requests — especially in states like Florida, Connecticut, and Maryland.

Meanwhile, a small group of up-and-coming startups and specialized insurance providers are moving in the opposite direction. For example, a Y Combinator-backed startup called Klaimee raised a $5.5 million seed round in July to audit autonomous AI agents and back them with specific liability coverage. HSB, a Munich Re subsidiary based in Connecticut, has been selling AI liability insurance to small- to medium-sized businesses since March.

Yet there are troubling discrepancies between what providers advertise and what their policies cover. ZDNET spoke to risk management experts who help businesses navigate that difference to understand if any of these policies are actually worth getting.

Milad Morgan, founder of a SaaS insurance brokerage called Atlas Risk Partners, said that businesses often miss the nuance of what is actually being insured. ‘AI insurance’ can offer any of the following:

“Those triggers are not interchangeable,” Morgan explained to ZDNET. “Ask for the actual wording and work through a specific loss.”

Also: LLMjacking can run up your business’ AI bill fast – how to stop it

For example, Munich Re’s aiSure policy pays businesses when an AI vendor or system fails minimum performance expectations. Meanwhile, HSB is a Munich Re subsidiary offering separate policies that compensate for defense, settlement, and judgment costs related to bodily injury and property damage involving AI-controlled systems or devices. YC-backed insurance platform Klaimee takes a more custom approach, auditing autonomous agents on a case-by-case basis and issuing policies accordingly.

“Most buyers assume they’re getting all three,” added Brandon Pinzon, co-founder of the cyber-risk advisory firm Firetower Risk Solutions. But in reality, that’s almost never the case. With offensive AI systems increasing in velocity, volume, sophistication, and risk, Pinzon says that gaining clarity on what your insurer protects you against is critical.

Jane Veeder, a VP of Solutions at the cyber crisis response platform CYGNVS, shared how underwriters today don’t have enough historical data to thoroughly assess business risks associated with AI. “Traditional underwriting relies heavily on using past data to predict future losses,” she explained.

But with AI, the technology is changing so rapidly that it’s impossible for predictive models to keep pace. “Yesterday’s loss data may not be a reliable predictor of tomorrow’s exposure.” As a result, insurance underwriters depend heavily on “proxies” — indirect data sources like the type of workflows and decisions being automated, the level of human oversight, the quality of testing, and any controls put in place for when things go wrong.

Also: 5 reasons your company needs a chief AI officer

Steven Schwartz, who’s also a co-founder at Firetower Risk Solutions, seems to concur. “There is no actuarial loss history for agentic systems,” he said. Veeder and Schwartz each compared the current underwriting approach to insurance in the early days of cyber, when everyone was still figuring out the level of exposure organizations would face.

A recent IBM study estimates that only 24% of business AI projects include any security component, even though 82% of the C-suite leaders surveyed agreed that security is vital to AI implementation. Meanwhile, the AI insurance startup Testudo claims that AI litigation is up 137% from last year, according to its proprietary data.

Yet the few insurers offering dedicated AI coverage reveal a starting discrepancy. “I have not seen enough public, adjudicated standalone-AI claims to call these products claims-tested,” Mark Walters, who serves as managing director at Alliance Risk, told ZDNET. Like Veeder, he thinks there isn’t enough publicly available market data to say whether these policies are truly effective against real-world crises. Without enough data on claim settlement rates and enterprise liability exposure, confidence among industry professionals is limited.

But if confidence isn’t driving purchase decisions, what is? Walters and Pinzon both believe that it’s a mix of C-suite anxiety and new legal procurement clauses in B2B contracts.

“Enterprise security and legal teams are now writing AI-specific indemnity and insurance requirements into vendor contracts,” Pinzon explained. Consequently, vendors are discovering that their current insurance policies don’t indemnify them against all this new risk exposure.

Also: 90% of CFOs using AI report multiple business benefits

Apart from industry pressure and board-level panic, companies are also prodded into action by changing compliance requirements. ISO has endorsed three new generative-AI exclusion forms that make it easier for insurance providers to deny liability when AI systems cause harm.

Several insurance providers are now attaching these exclusion forms during policy renewal without properly informing customers of the resulting implications to liability. “Once silent coverage is explicitly removed, buyers go looking for affirmative coverage,” Pinzon explained.

Moreover, as Walters explained, most countries have not implemented a single AI-insurance approval regime at the federal level. In the US, claims adjudication is handled on a state-by-state basis. In the UK and the EU, GDPR and the AI Act cover consumer privacy, not enterprise indemnity.

If you’re considering AI liability coverage for your own organization, Veeder recommends starting with a full assessment of your current insurance policies to see where AI is covered, excluded, or unmentioned. Then run a thorough audit of your business systems and workflows to see the level of access AI has, what it’s authorized to do on your behalf, and whether human oversight is baked into the process.

Also: Who’s responsible for catching rogue AI agents? You are

“Dedicated coverage makes sense when its wording addresses an exposure that remains uninsured or inadequately insured,” Morgan advised. “For each action, identify who could lose money, how the loss could occur, and which existing policy might respond.” He advised against adding new policy names just for peace of mind.