Insurers Are Done Covering AI by Accident. Now They Want Proof.

2026-09-22

Regulators have approved the large majority of insurer requests this year to add explicit AI exclusions to their policies -- by one industry tracking count, more than four in five filings. Chubb, Travelers, and Berkshire Hathaway are among the carriers now writing directors-and-officers and general liability coverage with AI carved out by name. The Insurance Services Office, whose standard forms much of the US market builds on, published its own generative-AI exclusion endorsements with a January 2026 edition date, giving any carrier a ready-made way to strip AI-related claims out of a commercial general liability policy.

None of this means insurers have decided AI risk doesn't exist. It means they've decided it was never priced in the first place.

For the past several years, most companies carried what the industry now calls "silent AI" coverage: general liability and D&O policies written before anyone thought to mention AI, and which therefore didn't exclude it either. A claim tied to an AI system's output -- a fabricated allegation about a company, a hallucinated regulatory violation, a defamatory answer served up to a customer or investor doing diligence -- would likely have been treated like any other advertising-injury or personal-injury claim. Coverage by omission, not by design. Insurers are closing that gap the way they closed the "silent cyber" gap a decade ago: not by refusing to touch the risk, but by naming it explicitly and forcing a separate conversation about who pays for it.

That conversation has taken a specific shape. Underwriters and coverage counsel tracking the shift describe the question at renewal moving from "do you have an AI policy" to, plainly, "show us the evidence." Carriers are writing AI coverage back in -- through affirmative endorsements, through standalone AI-liability products -- but only for buyers who can document their governance: what systems they use, what safeguards sit around them, and increasingly, what those systems have actually said or done. An unquantified risk is uninsurable. A documented one is a priced one.

That distinction matters most for the kind of claim that never touches a company's own systems at all: reputational harm inflicted by an AI system nobody at the company built, trained, or operates. When a general-purpose AI system tells a customer, investor, or journalist something false and damaging about a company -- an invented lawsuit, a fabricated regulatory action, a defamatory characterization pulled from a stale or discredited source -- the resulting loss is real, but the record of what triggered it usually isn't. Nobody subpoenas an AI system's logs the way a prosecutor subpoenas a person's; the company on the receiving end typically has nothing but a memory of what the screen said, and a growing pile of lost deals or customer complaints that arrived after the fact.

That's the gap insurers are now explicitly declining to absorb, and it's also the gap that's hardest for a company to fill after the fact. An AI system's answer to a given question can shift within days, sometimes hours, as it draws on newer or different material. By the time a claim is filed, a deal falls through, or a regulator starts asking questions, the output that caused the damage may no longer be reproducible on demand. Reconstructing it credibly -- what was said, when, and where it came from -- is a different exercise than reconstructing a defamatory article or broadcast, which at least sits on a server somewhere with a timestamp attached.

The practical result is that proof is becoming a prerequisite for two separate things at once: recovering under a policy, and establishing that a loss happened at all. A company that can produce a contemporaneous, verifiable record of what an AI system said about it -- sealed at the time, not reconstructed months later -- is in a materially different position with an insurer, a regulator, or opposing counsel than one asking everyone to take its word for it.

Insurers spent 2026 deciding that AI risk needs to be named, priced, and proven before it's covered. The same standard is quietly becoming the price of admission for making a reputational claim stick anywhere else -- in a courtroom, a boardroom, or a negotiation over what a damaged relationship is actually worth.