AI Liability Insurance Buyer's Guide
Underwritten In brief: the short version

Coverage by Silence, in brief

The 4-minute version of Coverage by Silence.

Written by

Joel R. Singh

Section

Underwritten

Published

2026-10-17

A costly gap in your insurance could hide in what your policy does not say about artificial intelligence (AI). For a long time, a policy's silence worked in the buyer's favor. That is changing.

The Un-named Peril

Picture a warehouse full of frozen goods, ruined by a kind of failure nobody had a name for when the policy was signed. The claim still gets paid. The policy is written on an "all-risks" basis, which means it covers physical loss or damage from any cause that is not plainly excluded.[1]

An all-risks policy does not list what it covers. It lists what it will not pay for, such as war, wear and tear, or harm you cause on purpose. Everything else is covered by default. The exclusion is the exception that has to be written down.[2]

A single boundary line divides the diagram. The wide left side is everything a policy does not mention, which is covered for that reason alone. The narrow right side holds the short printed list of named exclusions: war, wear and tear, deliberate acts. A tile carrying an artificial intelligence icon sits on the line, part way across, and its label has already landed on the excluded side. The endorsement is what moves it. Nothing about the risk itself changed.
On an all-risks policy the covered area is defined by subtraction, so anything nobody thought to name falls inside it. An exclusion endorsement does not change the risk. It moves one cause across the line. Diagram by iSinghLabs.

When a new kind of risk shows up, the policy says nothing about it, and under an all-risks form that silence means yes. An insurer cannot exclude what it cannot yet imagine.

When the Wording Is Unclear

The law added a second layer of protection. Under a rule called contra proferentem, unclear wording is read against the party who wrote it.[3] Courts in various jurisdictions have long leaned this way because an insurance policy is a contract of adhesion.[4] One side writes the whole contract and hands it over.[5] The buyer can take it or leave it. When a clause could fairly be read two ways, courts tended to pick the reading that kept the buyer covered.

The Market Has Done This Before

Every unnamed risk that pays a claim is a loss the insurer did not price. One odd claim is a rounding error. A whole category of loss growing under thousands of policies is a threat to the balance sheet.

That is what happened with "silent cyber." Older property and liability policies said little about computers or networks. When a cyber event caused a loss those policies normally cover, such as damaged equipment or a shutdown, buyers argued that the policy did not exclude it. Insurers ended up paying cyber losses on policies that had charged no cyber premium.[6] Worse, one piece of malware can spread across the internet in hours and hit thousands of businesses at once.[7]

Lloyd's of London, the centuries-old marketplace that sets the tone for specialty insurance,[10] acted in July 2019.[8] It required every policy to state plainly whether cyber was in or out. The rule began on January 1, 2020 for property and was phased in for liability lines through 2021.[9] In practice, a great deal of the cover that silence had given was now openly excluded. Buyers had to purchase a separate cyber policy or go without.

Four icons in a row mark the same four steps for two markets: a sealed policy for an unnamed risk, an alarm bell for losses, a document with a clause struck out for the new wording, and a switch branching in two for two separate products. Above the row, the cyber track runs the whole way and is complete, with Lloyd's 2019 intervention marked at step three. Below the row, the artificial intelligence track is solid through step two, starting inside errors and omissions and general liability, carries a marker at step three reading you are here, and is dashed beyond it because step four has not happened yet. Step three is the renewal.
Cyber had run all four steps by 2021. AI is somewhere in step three now, which is the step where a renewal can change what you own without the risk changing at all. Diagram by iSinghLabs.

Now It Is Happening to AI

For a few years, AI has lived inside ordinary business insurance the way cyber once did. Say a model gives a client bad advice, a tool produces something that infringes a copyright, or an automated system makes an unfair decision. Those claims land in errors and omissions (E&O), general liability, or directors and officers cover. None of those policies named AI, so the old argument worked again: the policy does not exclude it, so it covers it.

That window is closing. In the United States, a great deal of standard policy wording comes from ISO, whose forms are shared across carriers, so one drafting change can reshape thousands of policies at once.[11] Two ISO endorsements, CG 40 47 and CG 35 08, took effect on January 1, 2026. They exclude injury and damage tied to generative AI on general liability policies.[12] Each carrier chooses whether to adopt them. Insurers are also adding their own AI definitions and exclusions. Some will offer AI cover on purpose to win business. Still, the free ride is ending on dates printed on the forms, and some have already passed.

What This Means for You

Silence no longer means you are covered for AI. The real terms now live in the endorsements attached to your policy, and the job of reading them has moved to you. Read them before a loss, while you still have choices.

Works Cited

  1. 1Saxe Doernberger & Vita, P.C., Whose Burden Is It Anyway https://www.sdvlaw.com/publications/whose-burden-is-it-anyway-all-risk-vs-covered-peril-policies/
  2. 2HUB International, All Risks Insurance (glossary) https://www.hubinternational.com/insurance-glossary/a/all-risks-insurance/
  3. 3Cornell Law School Legal Information Institute, Contra Proferentem (Wex) https://www.law.cornell.edu/wex/contra_proferentem
  4. 4Property Insurance Coverage Law Blog, Insurance Policies Are Adhesion Contracts and Not Bargained For https://www.propertyinsurancecoveragelaw.com/blog/insurance-policies-are-adhesion-contracts-and-not-bargained-for/
  5. 5UpCounsel, Contract of Adhesion https://www.upcounsel.com/contracts-of-adhesion
  6. 6Guy Carpenter, Silent Cyber Explained https://www.guycarp.com/insights/2018/11/silent-cyber-explained.html
  7. 7Munich Re, Silent Cyber https://www.munichre.com/en/insights/cyber/silent-cyber-risks.sitemap.html
  8. 8Lloyd's of London, Market Bulletin Y5277, updating Y5258 (July 2019) https://assets.lloyds.com/assets/y5277-update-providing-clarity-for-lloyds-customers-on-coverage-for-cyber-exposures/1/Y5277%20Update%20%20Providing%20clarity%20for%20Lloyds%20customers%20on%20coverage%20for%20cyber%20exposures.pdf
  9. 9Kennedys Law, Non-affirmative cyber risk https://kennedyslaw.com/thought-leadership/article/non-affirmative-cyber-risk-phase-2-classes-of-business/
  10. 10Lloyd's of London, History of Lloyd's https://www.lloyds.com/about-lloyds/history
  11. 11Verisk / ISO, ISO's Policy Forms https://www.verisk.com/4a2314/siteassets/media/downloads/iso/isos-policy-forms.pdf
  12. 12Arthur J. Gallagher & Co., ISO Introduces Generative AI Exclusion in Commercial General Liability Policies https://www.ajg.com/news-and-insights/iso-introduces-generative-ai-exclusion-in-commercial-general-liability-policies/
HOME