Where AI Coverage Still Fails

Plenty of AI programmes still treat insurance as someone else's renewal meeting. Product ships the assistant, security debates permissions, finance funds the pilot, legal reviews the vendor terms—and when an output goes wrong, a customer decision gets steered by an agent that looked confident and was wrong. The failure modes are familiar by now: a false claim in a sales deck, a privacy spill through a chatbot, a defamatory summary, a hallucinated contract clause.

The board's first instinct is often the old industrial one—existing liability cover, cyber cover, and errors-and-omissions cover will handle it. That instinct is ageing badly. In the 2026 renewal cycle, carriers and rating organisations have made generative AI an explicit exclusion surface on commercial general liability (CGL) forms, and other lines are following with absolute or expansive AI carve-outs. What shows up as technical language on a policy endorsement lands as a strategic hole on the profit-and-loss statement.

The AI coverage gap is the distance between the work you have automated and the losses your policies will still pay for. Strategy that ignores that distance is unfinished capital allocation.

Beyond The Broker Renewal

Insurance markets do what they always do when a loss class becomes visible and hard to price: they reclassify it. Verisk's Insurance Services Office (ISO) commercial general liability suite now includes optional generative AI exclusion endorsements, including the broad CG 40 47 form that can remove bodily injury, property damage, and personal and advertising injury arising out of generative AI. Narrower variants target advertising injury alone or products-completed operations. Exact wording and adoption vary by carrier and state, but the direction is clear enough for operators who need to decide what to ship.

Industry reporting through 2025 and 2026 has made the same point in plainer language. Carriers are excluding claims linked to generative outputs, misleading AI content, and regulatory failures tied to AI implementation. Some cyber and professional lines stay relatively flexible compared with traditional liability forms; others are tightening through security riders, unauthorized-tool exclusions, or absolute AI exclusions across directors and officers, errors and omissions, and fiduciary programmes. Market design will keep evolving. Operators still have to decide now which AI work may touch customers, money, identity, or public speech.

This sits next to arguments made in earlier memos. The AI Vendor's Warning Label is about shared responsibility with model providers. Who Is Accountable When AI Acts is about internal accountability. Evidence an AI Project Must Produce is about buyer procurement. Coverage-gap analysis asks a blunter question: who holds the uninsured tail when automated work fails in public.

Six Lines to Track

Operators need a simple table that forces one honest conversation across product, security, finance, legal, and the board. Full underwriting skill is optional; the six-line table is not.

Three Operator Mistakes

Mistake one: treating all AI as one peril. A research assistant summarizing public web pages carries a different risk from an agent that emails customers, changes customer relationship management fields, or drafts regulatory filings. Coverage doctrine has to follow the act. Model brand is the wrong axis for that decision.

Mistake two: confusing cyber cover with content and professional-services cover. A prompt-injection breach that exfiltrates data may look like cyber. A fluent falsehood that harms a customer may look like advertising injury, professional negligence, or media liability. When the commercial general liability form excludes generative AI and the errors and omissions form was written for human consultants, the claim can fall between chairs.

Mistake three: waiting for the perfect AI policy product. Specialist AI insurance will keep evolving. Some startups will fill gaps; large carriers will reprice and reword. That market development is useful plumbing. Strategy still requires a decision about which AI work is allowed while the market sorts itself out.

What A Serious Board Should Ask

Operational questions beat "do we use AI?" Start with the customer-facing workflows that can create a third-party claim this quarter, map which policy line is supposed to respond, and check whether generative AI exclusions already attached at the last renewal. Residual risk ownership matters when nobody owns the uninsured middle. So does evidence an underwriter could review tomorrow morning. Workflows should stay at draft level until that evidence exists.

The National Institute of Standards and Technology (NIST) AI Risk Management Framework is useful here as a reminder that measurement, monitoring, and governance support risk-transfer credibility. Treat it as an operating reference, separate from insurance advice. Underwriters and counterparties increasingly ask what security teams already track: system inventory, actor permissions, review records, logs, and revoke paths.

How this connects

Earlier memos argued for rules before tools, permissions before autonomy, accountability before executive theatre, and browser control points before credentialed agents roam free. The coverage gap is the financial twin of those operating controls. Clever agent workflows still leave a company exposed when residual loss has no policy home and no named owner.

Deep open strategy writing should keep connecting market plumbing to management choice. Insurance exclusions are market plumbing. Residual ownership is management choice. Put them on one page.

The Executive Move

This week, build a one-page AI coverage gap table for the five highest-blast-radius AI workflows and fill all six lines. If residual owner or exclusion surface is blank, demote that workflow from autonomous act to assisted draft until finance, legal, and the business owner can answer in the same meeting.

Keep the whole problem off the "next broker renewal" parking lot. A cheap software seat does not make a consumer chatbot trial free. The expensive part may be the uninsured claim, the customer make-good, or the board explanation that "we thought cyber covered it." Winning teams can say, without theatre, which AI acts are covered, which are retained, and which stay forbidden until residual owners and stop rules are real. Pilot-list length is a weak scoreboard.