Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI liability exclusions can remove claims from a policy even when artificial intelligence was only one part of the event. The answer depends on the exact endorsement, the policy line, and how the claim is characterized. ISO’s CG 40 47 01 26 endorsement, for example, excludes bodily injury, property damage, and personal and advertising injury arising out of generative artificial intelligence. A commercial general liability (CGL) exclusion does not automatically decide whether cyber, technology errors and omissions (E&O), professional liability, or management liability insurance responds. Businesses should map each AI use, read every applicable form and endorsement, and obtain a written coverage position for realistic scenarios before relying on insurance.
What is an AI liability exclusion?
An AI liability exclusion is policy wording that removes some losses, claims, or defense obligations connected with an insured’s use, development, supply, or output of artificial intelligence. It may appear in a CGL, cyber, technology E&O, professional liability, product liability, or management liability policy, or in a separate endorsement.
The wording—not the policy label—controls. Two similar businesses can receive different results because insurers use different forms, optional endorsements, definitions, retentions, sublimits, and exclusions. ISO forms are optional, and the London market’s LMA has warned that actual coverage depends on the wording used and the circumstances of the claim.
Recommended Free Tools
Under ISO CG 40 47 01 26, “generative artificial intelligence” is a machine-based learning system trained on data that can create text, images, audio, video, or code. The endorsement states that insurance does not apply to “bodily injury” or “property damage” arising out of generative artificial intelligence, and separately excludes “personal and advertising injury” arising out of generative artificial intelligence.
#1 Best Overall
The form reproduced in current market materials is identified as edition 2026.1. Gallagher Re reports that new ISO generative-AI exclusions became available from January 2026. A renewal may therefore contain materially different language from an earlier policy even if the declarations page looks similar.
Does business insurance cover mistakes made by AI?
Sometimes, but no single policy answers every AI claim. Coverage turns on the loss, the policy trigger, the definition of AI, and any exclusion or write-back. A CGL policy may address a qualifying third-party bodily-injury, property-damage, or personal-and-advertising-injury claim, while a cyber or technology E&O policy may address a different part of the same event.
Commonly disputed exposures include:
- Hallucinated or inaccurate outputs and incorrect advice.
- Professional-service errors or a failure of an AI-enabled service to perform as promised.
- Financial loss that does not involve bodily injury or property damage.
- Copyright, trademark, trade-secret, or other intellectual-property allegations.
- Discrimination, bias, or an automated decision that harms an applicant, customer, employee, or borrower.
- Privacy violations, data leakage, security incidents, and misuse of training data.
- Business interruption after an AI system, vendor, or model becomes unavailable.
Gallagher Re identifies these as harms commonly outside ordinary CGL coverage, while noting that policy treatment varies. A claim involving a vendor, an automated decision, or AI-generated content is covered only if the policy’s trigger and definitions reach those facts.
What does the ISO generative-AI exclusion remove?
For policies using CG 40 47 01 26, the exclusion removes two broad groups of injury allegations when they arise out of generative AI:
- Bodily injury and property damage. This can affect a physical injury or physical-damage claim linked to an AI-generated instruction, design, recommendation, or control system.
- Personal and advertising injury. This category can include allegations tied to advertising or personal-injury offenses when the claim arises out of generative AI.
The phrase “arising out of” is important. It can be broader than a requirement that AI be the sole or immediate cause. The insurer will examine the endorsement’s wording, the underlying allegations, the causal connection asserted by the claimant, and other provisions in the policy.
The exclusion does not by itself describe every possible AI loss. It does not answer whether a separate cyber, technology E&O, professional liability, or management liability policy responds, nor does it establish whether defense costs are available while coverage is disputed. Those questions require the complete policy and endorsements.
Which insurance policies should a business compare?
Review the policies together because one line may exclude an exposure that another line covers, partially covers, or excludes for a different reason.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Policy line | Questions to ask |
|---|---|
| Commercial general liability | Does an AI exclusion apply to bodily injury, property damage, personal injury, advertising injury, products, or completed operations? How broad is “arising out of”? Does the exclusion reach an AI-enabled product or service supplied by a vendor? |
| Cyber | Does the policy cover a compromised AI system, privacy liability, incident response, data restoration, and resulting business interruption? Is an AI system treated as a covered computer system? Is there a cyber exclusion or a write-back? |
| Technology E&O or professional liability | Does it cover negligent AI-enabled services, inaccurate output, failure to perform, contractual liability, and defense costs? Are model, vendor, professional-service, or intellectual-property exclusions present? |
| Management liability or D&O | Could securities, governance, or disclosure claims connected with AI be excluded? Are systemic or widespread events restricted? What does the actual form say about defense and allocation? |
| Specialist AI policy or endorsement | Which AI failures, regulatory-fine exposures, intellectual-property claims, bodily injuries, or third-party liabilities are affirmatively covered? What are the sublimits, aggregation rules, exclusions, licensing status, and territorial limits? |
Do not assume that a cyber policy covers every AI problem. A model producing discriminatory recommendations may be an errors-and-omissions or professional-liability issue rather than a security incident. Conversely, a stolen prompt library or leaked training dataset may trigger privacy and cyber provisions without creating a covered professional-services error.
How do policy triggers change the outcome?
Start with what the claimant is alleging and what loss is requested, then test each policy’s trigger. The same underlying event can generate several claims with different coverage paths.
Bodily injury or property damage
A physical injury or damage allegation normally points first to CGL, products liability, or completed operations. An AI exclusion such as CG 40 47 01 26 may remove that coverage if the injury or damage arises out of generative AI. A separate product or technology policy might still respond, but only if its insuring agreement reaches the event and no competing exclusion applies.
Economic or professional loss
A customer’s financial loss from incorrect AI advice, an automated pricing decision, or a failed AI-enabled service may fall outside CGL because it is neither bodily injury nor property damage. Technology E&O or professional liability may be the relevant line, subject to the definition of professional services, the policy’s claims-made requirements, contractual-liability wording, and any AI, model, or performance exclusion.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Privacy, security, and data claims
A compromised model, exposed personal data, or misuse of confidential prompts may implicate cyber coverage. Check whether the policy covers the system involved, the data at issue, notification and response costs, regulatory proceedings, third-party liability, and business interruption. A cyber policy can contain its own exclusions for contractual promises, intellectual property, infrastructure failure, or certain automated systems.
Rank #3
Advertising and intellectual property
AI-generated marketing copy, images, audio, or video can lead to advertising-injury or intellectual-property allegations. The CGL personal-and-advertising-injury grant may be removed by an AI exclusion, while an E&O or specialist policy may treat IP differently. Copyright, trademark, trade-secret, and license issues must be checked separately; none is automatically covered merely because the content was generated by software.
Governance, securities, and discrimination
Shareholder, securities, or governance allegations connected with AI may implicate D&O or management liability. A customer, employee, or regulator alleging discriminatory automated decisions may instead trigger employment practices, professional liability, regulatory, or specialized coverage. Definitions and exclusions vary, so the business should not infer coverage from the existence of an AI governance program.
How should a business review its policies for AI exclusions?
Use the following process at every placement and renewal, especially when a model, vendor, or use case changes.
- Inventory every AI use. Include customer communications, chatbots, marketing, contracts, software development, hiring, credit, underwriting, professional advice, quality control, and internal operations. Record experimental and shadow uses, not only approved tools.
- Map the technology and data flow. Record the model or vendor, prompts and data supplied, where processing occurs, outputs retained, downstream systems, and who can access the information.
- Document human control. Identify the reviewer who approves an output, the required checks, escalation path, override authority, and evidence that testing occurred before deployment.
- Collect the complete insurance set. Obtain the declarations, base forms, schedules, endorsements, definitions, amendments, and renewal versions. A broker summary or a policy name is not a substitute for the wording.
- Search the documents systematically. Look for “artificial intelligence,” “generative artificial intelligence,” “automated decision,” “machine learning,” “arising out of,” “vendor,” “intellectual property,” “privacy,” “cyber,” “professional services,” and “systemic.” Also search for exclusions that do not use the word AI but could reach an AI event.
- Compare the coverage mechanics. For each policy, record the trigger, defense and indemnity treatment, first-party and third-party scope, retention, sublimit, aggregate, territorial limit, retroactive date, claims-made reporting rule, and treatment of regulatory fines.
- Ask for written scenario answers. Send the broker or insurer concrete examples and request a written position, including any assumptions about causation and allocation.
Keep the inventory and control evidence with the underwriting file. Regulators emphasize accuracy, fairness, nondiscrimination, governance, and human oversight; those controls also help an insurer understand the risk and assess whether a claim falls within a defined grant of coverage.
Which scenarios should be tested with the broker or insurer?
Generic questions such as “Is AI covered?” produce little useful information. Ask about the facts your business could actually face:
- Chatbot misinformation: A chatbot gives a customer incorrect instructions and the customer suffers a financial loss. Which policy responds, and are defense costs advanced?
- AI-generated advertising infringement: A generated image or text allegedly copies a competitor’s protected work. Is advertising injury excluded, and is any IP defense available elsewhere?
- Model discrimination: An automated hiring, credit, pricing, or underwriting recommendation produces disparate outcomes. Which policy addresses the allegation, investigation, defense, settlement, or regulatory proceeding?
- Leaked training data: A vendor or employee uploads personal or confidential information to a model and the data is exposed. Does cyber coverage apply to the model, vendor, notification, and interruption costs?
- AI-enabled product injury: A product that relies on an AI recommendation causes physical injury or property damage. Does the CGL or products coverage contain the generative-AI exclusion, and is there another affirmative grant?
- Vendor-wide model failure: A model update causes the same incorrect output for many customers. Are systemic-event, aggregation, vendor, or widespread-loss limitations triggered?
Request the answer in writing and preserve the question, assumptions, and policy version. A verbal assurance may not resolve a later dispute over the endorsement’s exact language.
Do regulatory rules create coverage for an AI claim?
No. Regulatory guidance can influence underwriting and governance, but it does not replace an insuring agreement.
The Washington Office of the Insurance Commissioner says insurer AI-supported decisions must comply with applicable insurance laws, including unfair-trade-practice and unfair-discrimination requirements. The National Association of Insurance Commissioners (NAIC) likewise emphasizes fairness, accuracy, and human oversight, noting that AI systems can generate information that sounds accurate but is incorrect and that insurers remain responsible for insurance laws, regulations, standards, and consumer-protection rules when they use AI.
These principles are useful questions for a policyholder’s own controls and for an insurer’s underwriting review. They do not themselves provide defense, indemnity, incident response, or reimbursement for an insured’s AI-related loss.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is separate AI liability insurance necessary?
Not for every business. Separate insurance or an AI endorsement becomes worth investigating when ordinary policies leave a material gap, an AI system makes consequential decisions, the business provides AI-enabled professional services, contractual requirements demand affirmative coverage, or a vendor-wide failure could create a large aggregated loss.
Evaluate a specialist product by its actual grants rather than its name. Confirm whether it covers defined AI failure, regulatory-fine exposure where legally insurable, intellectual-property allegations, bodily injury, third-party liability, first-party interruption, defense costs, and incident response. Check sublimits, aggregate erosion, exclusions, vendor and model treatment, systemic-event language, territorial scope, claims-made dates, and whether the product is licensed and available in the relevant jurisdiction.
Free tools Windows power users keep installed
One-click scans. No signup required.
There is no authoritative market-wide percentage of business policies carrying AI exclusions and no reliable AI-liability claims-frequency figure established here. Availability and terms are still developing, so a broker-led coverage review should identify the gap before a business purchases a separate product.
What are the most common review mistakes?
- Relying on the declarations page: The endorsement and definitions often contain the decisive language.
- Treating CGL as an all-purpose policy: Economic loss, professional errors, privacy incidents, and IP claims may require different coverage.
- Assuming “cyber” means every technology loss: A cyber trigger may require a security event or covered computer system and may exclude professional performance or IP disputes.
- Ignoring vendors: A claim can involve a model provider, data supplier, integrator, or automated-decision platform. Contractual indemnity does not guarantee insurance.
- Overlooking aggregation: One model update can produce many similar claims and exhaust an aggregate or systemic-event sublimit.
- Failing to preserve evidence: Prompts, outputs, approvals, model versions, testing records, and incident logs can affect both liability and coverage analysis.
- Assuming a renewal is unchanged: New ISO AI exclusions have been available from January 2026, so compare each renewal endorsement with the prior version.
What should a written coverage position contain?
A useful response should identify the policy and endorsement version, quote the relevant insuring agreement and exclusion, state the assumed facts, explain the trigger, and distinguish defense from indemnity. It should also address first-party and third-party loss, retentions, sublimits, aggregates, territorial limits, reporting duties, vendor involvement, and any reservation of rights.
Ask the insurer or broker to explain what facts would change the answer. That makes the review actionable: the business can alter a human-approval step, restrict data sent to a model, require a vendor contract, or purchase an endorsement based on a defined gap rather than a generic promise that “AI is covered.”
Frequently Asked Questions
Can an insurer deny a claim just because AI was involved?
Involvement alone is not the legal test. The insurer must apply the policy’s insuring agreement, definitions, exclusions, causation language, and claim facts; an exclusion may apply only if its wording reaches the alleged loss.
Are AI exclusions usually added at the start of a policy or at renewal?
They can appear in the original policy package, by endorsement during the term where permitted, or at renewal. Compare every new endorsement and edition with the expiring policy instead of assuming the change follows a fixed schedule.
Does a vendor’s insurance protect my business from an AI claim?
Not automatically. A vendor’s policy, indemnity, or contract may have different limits, exclusions, and claims-made dates, and it may not cover your defense or losses. Treat vendor protection as a separate recovery source and confirm your own policy response.
What evidence helps establish that an AI use was controlled?
Keep model and vendor records, data-flow descriptions, testing results, approval logs, output versions, incident reports, and escalation decisions. These records help demonstrate human oversight and let the insurer evaluate which system and policy trigger are involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
