Generative AI Liability Insurance: What Business Owners Need to Know in 2026
Generative AI liability is the fastest-moving coverage gap in commercial insurance right now. Most business owners have no idea it affects them. If your company uses an AI chatbot, generates marketing copy with AI, or relies on AI tools to draft documents, your general liability policy may now carry an exclusion. It did not exist a year ago. This guide explains what changed, how the new exclusions work, where the exposure lives, and what it costs to close the gap.
What is generative AI liability insurance?
Generative AI liability insurance covers third-party claims that arise from the outputs of AI systems a business deploys. Think of a chatbot that gives a customer wrong information. Or marketing copy that copies protected work. Or an AI tool that exposes confidential data. These are the harms the coverage targets.
It is aimed at businesses that use AI, not businesses that build it. A six-person marketing agency using an AI writing tool is the target buyer. The software company that made the tool has its own, different coverage needs.
What changed in 2026?
For years, standard policies were silent on AI. A general liability policy did not affirm AI coverage, and it did not exclude it either. That ambiguity sometimes worked in the business owner’s favor when a claim came in.
That changed at the start of 2026. Verisk, through its ISO unit, publishes the standard forms most carriers use. It released three optional endorsements that let a carrier carve generative AI out of a general liability policy. The Big “I” (Independent Insurance Agents and Brokers of America) summarized the rollout and the legal pressure behind it.
These exclusions are optional, and adoption is still uneven. But it is moving quickly. Several of the largest commercial carriers filed to adopt the standard language or their own versions during the first months of 2026, and state regulators approved more than 80% of those filings. Some carriers wrote broader, proprietary AI exclusions of their own. The pattern is the same one the industry followed with “silent cyber” a few years ago: a fast-growing exposure gets pulled out of the standard policy and pushed toward specialty coverage.
What are the three AI exclusion forms?
The three ISO endorsements differ in scope. That matters, because no two policies will treat AI the same way. They share one definition of generative AI: a system trained on data that can create content or responses, including text, images, audio, video, or code. Here is what each one removes:
| Form | Coverage part affected | What it removes | Scope |
|---|---|---|---|
| CG 40 47 | Coverage A and Coverage B | Bodily injury, property damage, and personal and advertising injury arising out of generative AI | Broadest |
| CG 40 48 | Coverage B only | Personal and advertising injury arising out of generative AI | Narrower |
| CG 35 08 | Products and completed operations | Bodily injury and property damage arising out of generative AI | Targeted |
All three trigger on losses “arising out of” generative AI. That phrase is broad. Courts often read it to require only a causal connection, not proof that AI was the main cause. The exact reach depends on the state and the facts.
Some carriers have gone further than the standard forms. A few have filed their own absolute AI exclusions that reach directors and officers, errors and omissions, and fiduciary coverage, with language covering any use, deployment, or development of AI. The takeaway is the same: the only way to know your exact position is to read your endorsement schedule.
How is this different from cyber or tech E&O?
This is where most businesses get tripped up. The AI exposure does not sit neatly in one policy. A March 2026 Gallagher Re report produced with MIT and Testudo, “Smart Systems, Blind Spots,” mapped AI exposures against the major policy lines and found meaningful gaps in each.
The table below shows how a typical program responds, and where the gaps fall. Treat it as a starting map, not a coverage opinion on your specific policy:
| Policy line | What it is built for | The AI gap |
|---|---|---|
| General liability (CGL) | Bodily injury, property damage, and certain advertising offenses like defamation | Never covered pure financial loss from a bad AI answer; now faces the new generative AI exclusions |
| Cyber | Data breaches, network intrusions, ransomware, privacy events | Generally responds to AI as an attack vector, not to AI as a source of liability (a hallucinated output, defamation, or IP claim) |
| Technology E&O | Errors in technology products and services a company sells | Built for the vendors that build AI tools, not the businesses that merely deploy them |
| Professional liability | Negligence in delivering a professional service | Insurers may argue reliance on AI output was not a covered professional service, or that judgment was not exercised |
| Management liability (D&O) | Wrongful acts by directors and officers | Some carriers now exclude claims tied to AI governance or AI disclosures |
The result is a set of gaps that a purpose-built AI policy is meant to fill. A law firm overview from Ward and Smith walks through how each policy line may or may not respond in more detail.
What does generative AI liability insurance cover?
Standalone generative AI liability policies are generally built around third-party harm from AI outputs. Common coverage areas include:
- Financial loss to a third party from errors, misstatements, or inaccurate information produced by AI
- Intellectual property infringement and defamation tied to AI-generated content
- Unauthorized disclosure of protected information through AI outputs
Carriers generally write these policies on a claims-made basis and include defense costs. Coverage terms vary widely because the products are new, so the specimen form matters.
What does it not cover?
These policies are not a cure-all. They generally do not replace your cyber policy for a data breach, your professional liability policy for a service error, or your management liability policy for a governance claim. They complement an existing program rather than stand in for it. Coverage for first-party losses, regulatory fines, and bodily injury varies by product, and many forms limit or exclude it.
Who needs it?
The clearest candidates are businesses that put AI in front of customers or use it to produce work product. A marketing or advertising firm using AI to generate client content. A professional services firm using AI to draft or summarize. Any business running a customer-facing chatbot. The more a third party sees or relies on your AI output, the more this exposure applies.
Doesn’t the AI vendor’s contract protect me?
This is the assumption that catches the most businesses, so it is worth answering directly. The short version: usually not enough.
Two things work against you. First, courts and regulators generally treat the business deploying the AI as responsible for its outputs, not the company that built the tool. Second, the vendor’s contract is usually written to protect the vendor. The Gallagher Re report found that standard AI vendor terms typically cap the vendor’s liability at twelve months of fees and offer no performance warranties. So if your chatbot causes a six-figure problem, the vendor’s contractual exposure may be a fraction of that, and the rest lands on you.
That does not mean the vendor contract is irrelevant. The indemnification language, the warranty terms, and the liability cap all matter, and a good contract review is worth doing. But “the vendor will cover it” is not a substitute for knowing how your own insurance responds.
Is it required?
No law requires generative AI liability insurance today. But contracts increasingly do indirect work here. Enterprise customers and partners now ask vendors about AI risk controls, and a coverage gap can surface during a contract review. The practical driver is not a mandate. It is the gap between how broadly businesses use AI and how little the standard policy now covers.
What does generative AI liability insurance cost?
Pricing is still settling because the products are new, and the market is small. A few reference points from industry reporting help set expectations. Actual pricing depends on your business, your AI use, and the carrier:
- The pressure behind the whole shift is litigation. According to the Gallagher Re report covered by Captive.com, generative AI-related lawsuits in the U.S. grew 978% from 2020 to 2025, with cumulative filings passing 700. The leading claim categories were patent infringement (about 11.9% of cases), copyright infringement (about 11.2%), and privacy-related personal injury (about 10.2%).
- Specialty insurer HSB, part of Munich Re, announced an AI liability product aimed at small and mid-sized businesses. That signals a market moving toward coverage for smaller operations, not only large enterprises.
- Industry analysts project the AI insurance market will reach several billion dollars by the early 2030s, which tells you carriers expect this to become a standard coverage line rather than a niche.
This is specialty coverage, so you generally reach it through specialty markets rather than a checkbox on a basic policy. An independent agency can help determine what is actually available for a business your size.
What do underwriters want to see?
Because this coverage is new and the loss data is thin, carriers underwrite it on controls rather than history. The pattern mirrors how cyber insurance matured: insurers started asking what safeguards a business has in place before they would offer good terms. For AI, the controls underwriters increasingly ask about include:
- A written AI use policy that defines where and how the business uses AI
- Human review of AI outputs before they reach a customer or go into work product
- Records or logs showing that a person checked an output before the business acted on it
- Limits on using AI for high-stakes decisions without a named person validating the result
There is a practical upside here. Even setting aside insurance, these controls reduce the chance of the claim in the first place. And businesses that can show real AI governance often get broader terms, sometimes including a carve-back that restores coverage for supervised AI use while keeping it excluded for unsupervised or fully automated use. The documentation is what makes the difference, so it is worth putting in place before a renewal, not after a claim.
A real case that shows the stakes
One Canadian decision comes up constantly because it shows the underlying problem cleanly. A customer used an airline’s website chatbot, which told him he could apply for a bereavement discount retroactively. That was wrong. The airline argued it should not be responsible for what the chatbot said. A tribunal disagreed and held the airline responsible. It was a chatbot liability case, not an insurance coverage case. The decision did not establish that the chatbot used generative AI. But the principle travels. When a business gives customers automated information and that information is wrong, the business can still be the one that pays.
What should a business do now?
Two steps. First, look. Pull your general liability policy and check the endorsement schedule on the declarations page for any AI exclusion. Then review your professional liability, cyber, and management liability coverage too. Second, talk to your agent about whether an affirmative AI coverage option fits how your business actually uses AI. The worst outcome is simple: you assume you are covered, get a demand letter, and learn the carrier added the exclusion at your last renewal.
Frequently asked questions
Does my general liability policy still cover AI claims?
Maybe. If your policy does not carry one of the new AI exclusions, certain AI-related claims may still fit your existing coverage. If the carrier has added an exclusion, it has a basis to deny. The only reliable answer is the wording on your actual policy and its endorsement schedule.
Can I just rely on the AI vendor’s insurance?
Not safely. Courts generally treat the business deploying the AI as responsible for its outputs, and vendor contracts often cap the vendor’s liability. “The bot did it” is not a defense by itself, though your contract with the vendor may still matter.
Is this the same as cyber insurance?
No. Cyber insurance generally responds to breaches and network events. It typically does not cover a hallucinated AI output that causes financial loss, defamation, or IP infringement. Those are different exposures that may need different coverage.
My business only uses AI internally. Do I still have exposure?
Internal-only use carries less third-party exposure, but the line blurs fast. If an internal AI output ever reaches a customer, a contract, or published content, the exposure follows it. A coverage review is the way to know.
Are these AI exclusions on every policy now?
No. Adoption is uneven as of 2026. Some carriers have adopted the standard language, some have written their own, and some have not added anything yet. This is exactly why checking your specific endorsement schedule matters.
Will having an AI use policy help with coverage?
Often, yes. Carriers underwrite this exposure on controls, so a written AI policy, human review of outputs, and records of that review can lead to broader terms, sometimes a carve-back that keeps supervised AI use covered. The same controls also reduce the odds of a claim in the first place, so the work pays off either way.
Talk to an independent agency
Western Pacific Insurance is an independent agency based in Henderson, Nevada. We help business owners across Nevada, Arizona, Utah, and California review their AI exposure. We help them see where it shows up in their coverage and what options exist to close the gap. If you use AI in your business, get a quote or a coverage review here.
