The World’s Biggest Insurance Broker Just Picked a Fight Over AI
Key Takeaways
Generative AI exclusions are now available to any carrier that uses ISO forms, and Berkley has written an absolute AI exclusion into its management liability lines. But Marsh, Willis, Zurich and Coalition are publicly resisting broad exclusions. Whether you end up excluded may depend on who is negotiating for you.
Standalone AI cover is real. Armilla offers up to $25 million per organization, Mosaic up to $15 million through Munich Re’s aiSure, and Munich Re and AIUC up to $50 million. What nobody can offer is the scale the frontier labs want.
The form is not settled. Half the respondents to an Insurance Business poll expect AI insurance to become a major commercial line eventually. Others expect it to stay inside cyber, E&O and D&O.
The specialists mostly underwrite the model or the litigation record, and AIUC-1, an insurance-backed, SOC 2-style standard, certifies individual agents and now splits their controls between developers and deployers. Armilla has opened its underwriting to deployer governance evidence, produced with audit and advisory partners.
Deployers are where the losses land, and most are still answering questionnaires. That is the pre-SOC 2 era, and it is where independent assurance has to go next.
This month Marsh, the world’s biggest insurance broker, told leading insurers in a letter that it would steer clients to other markets if they imposed AI exclusions. Since I started this practice, I have argued two things. First, insurers, not legislators, would end up setting the practical rules for AI. Second, AI assurance would have to follow the path security took before SOC 2: from questionnaires and self-attestation to independent verification. Marsh’s letter is the insurance market having that argument in public. For anyone deploying AI, it raises a simple question: where are you covered?
Exclusions are everywhere on paper
ISO’s three generative AI endorsements (CG 40 47, CG 40 48 and CG 35 08) have been available since January 1, 2026. Carrier filings to adopt them have picked up speed through the year. Verisk is weighing further optional exclusions, including one for agentic AI. AIG told the Wall Street Journal it adopts the standardized forms automatically.
Berkley has gone furthest. Its absolute AI exclusion amends D&O, employment practices and fiduciary cover. It reaches claims tied to using, deploying or developing AI, and explicitly includes claims that an organization’s AI policies or training were inadequate.
Adoption in real placements is a different story. At the Council of Insurance Agents & Brokers’ forum this month, three executives pushed back:
Willis’s head of risk and broking for North America said exclusions haven’t become common in the placements he sees.
Zurich’s U.S. CEO said they are mostly being used by smaller carriers that take up ISO forms by default.
Coalition said brokers have threatened to take business elsewhere over them.
Marsh went further than any of them. In its letter to leading insurers, reviewed by the Wall Street Journal, Marsh Risk CEO Nick Studer wrote that excluding AI would set the industry back and increase coverage disputes.
My read: if Marsh is negotiating your program, the exclusion may come off. If you are a school district or a 40-person firm buying standard forms from a carrier that adopts whatever ISO publishes, it is far more likely to stay on.
Standalone capacity is thin at the top
Affirmative AI cover exists:
Armilla, a Canadian Lloyd’s coverholder, raised its standalone limits to $25 million in January and paired them with Chaucer’s cyber and tech E&O in February.
Mosaic offers Munich Re’s aiSure with up to $15 million in initial capacity.
Munich Re writes AI error cover with limits up to $50 million.
AIUC’s insurance reaches the same $50 million figure.
For a mid-market deployer, that is meaningful money. For the frontier labs, it is nowhere near enough. Testudo’s CEO George Lewin-Smith says the largest AI companies are willing to buy billions in coverage, and that cover at that scale “just doesn’t exist on planet Earth.”
Meanwhile, Aon estimates that more than 90% of potentially covered AI exposure still sits in silent coverage, which neither grants nor excludes it.
Standalone or bolted on: the form is still unsettled
Four structures are competing right now:
Pure standalone policies: Armilla and Testudo.
Standalone cover paired with cyber: Armilla and Chaucer’s Vanguard AI, with predefined rules deciding which policy responds.
Affirmative AI wording inside an existing line: Coalition has done this since 2024.
An endorsement added to small business policies through partner carriers: HSB.
The market hasn’t picked one. In an Insurance Business poll, half of respondents said AI insurance would eventually become a major commercial line, 22% expected that to happen quickly, and 14% expected AI risk to stay inside existing lines. Emergence’s U.S. CEO Keith Savino summed it up: “This is not a done deal yet.” No court has issued a bellwether coverage ruling either.
Even affirmative cover needs a careful read. EPIC’s Marc Kunney warned that some affirmative AI policies work as “cloaked exclusions”: they cover the AI perils they name and leave out the rest.
Testudo prices the courtroom, not the controls
Testudo writes standalone generative AI liability on Lloyd’s paper for U.S. companies that deploy generative AI. Its pricing comes from litigation: a database of real AI lawsuits fed into its own risk model. That is a smart way to price a risk with no claims history. It is not assurance. It tells you what courts are doing to deployers in general, not what this particular deployer actually does.
Testudo’s own market notes also make the deployer’s problem plain. AI vendor contracts commonly cap the vendor’s liability at a year of fees, so everything above that lands on the deployer.
Munich Re underwrites the algorithm. Armilla is reaching past it.
Munich Re’s aiSure works as a performance guarantee and responds when a model misses the performance thresholds it was insured against. The Journal describes much of the specialist market the same way: AI policies are frequently priced by running simulations to estimate error rates, which amounts to an audit of the technology.
That testing tells you how the model behaves under test. It does not tell you who can switch the model on, what it is connected to, who is watching it, or what happens when it does something it shouldn’t.
Armilla is the one to watch. Its underwriters review each AI system technically, but that is only part of the picture. Its underwriting also includes an assessment of the client’s AI risk posture, drawing on Armilla’s own incident, litigation and regulation data. On top of that, it takes customer-provided conformity assessments, monitoring, evaluations, audits and GRC maturity, produced with its partners’ tools and services. Those partners include AI governance advisors, audit firms and certification bodies, and Armilla names ISO 42001 as something clients can turn into risk transfer. Armilla has built the intake for deployer evidence. It depends on someone else to produce it.
The SOC 2 route exists. Its unit is the agent.
Someone is building the SOC 2 model. AIUC-1, from the Artificial Intelligence Underwriting Company, is a controls-and-audit standard designed to support both third-party audit and insurance underwriting. Here is how it works:
Accredited auditors, Schellman and Coalfire among them, review a company’s policy, operational and technical controls across six domains.
One of those domains is accountability, which covers incident response, logging and governance.
Certified agents are retested every quarter.
The Cloud Security Alliance now recognizes AIUC-1 in its STAR Registry. Certified companies include Cursor, Harvey, ElevenLabs, UiPath and KPMG.
MSCI’s CISO explained why his firm adopted it: existing governance frameworks don’t answer the question his auditors would ask, “does this agent actually do what the policy says, and can you prove it?”
Its October update moved toward deployers. Where the developer of an agent platform and the deployer running it on its own data and workflows are different organizations, AIUC-1 now says the deployer typically holds 40 of its 78 core controls, the developer 33 and the independent evaluator 5.
The SOC 2 moment has arrived, but its unit of assurance is the agent. What remains unresolved is how an organization shows that its broader AI deployment practices, across vendors, systems and staff, actually work.
ISO 42001 is the obvious candidate, and Armilla already counts it toward risk transfer. It helps. But it certifies a management process, and standards are written for risks someone has already thought of. Ask what it prescribes when a visitor walks into a school wearing AI-enabled smart glasses. Who is responsible, and what is the protocol? The standard doesn’t answer that. The school has to, and an underwriter has to be able to trust the answer.
Most deployers are still filling in questionnaires
On the deployer side, most underwriting is where security was before SOC 2. Founder Shield’s Jonathan Mitchell told Insurance Business this month that EPLI underwriters are starting to ask about AI, but the questions are basic. Is AI in use? Whose product is it? Who is responsible for overseeing it? Scrutiny is uneven in the small and mid-sized market, and he isn’t yet seeing underwriters ask to see the vendor contract. His advice to employers: “You should operate like it’s your liability.”
A questionnaire records what an organization says it does. It doesn’t test whether the organization does it. That is governance as a statement, not governance as a practice.
Algorithm-level cover breaks at deployment
This summer gave us the clearest example yet. OpenAI disclosed that agents running in one of its cyber-capability tests broke out of their test environment and into Hugging Face’s systems. Anthropic then found three cases of its own models leaving a test environment and intruding on real companies. It traced them to a misconfiguration at an outside evaluator.
Heidy Khlaaf of the AI Now Institute, a former OpenAI safety engineer, argued the real story was not the models. The agents had been handed offensive tools inside a poorly secured environment that nobody was monitoring.
The capability was known. What failed was containment, permissions, configuration and monitoring. Those are deployment controls. Testing the model alone can’t show whether an organization has them. AIUC-1 cited the incident in its October update, the same update that spelled out which controls belong to deployers.
Studer made the structural point this month: AI is going to be woven so tightly into the chain of causes behind a loss that it can’t be pulled out. Berkley’s exclusion wording points the same way, naming inadequate AI policies and training. The exclusions already point at governance. Most underwriting hasn’t caught up.
Insure the algorithm, and you are insuring something that will fail the way it is deployed. Put a model with strong test results inside an organization with weak cybersecurity, thin privacy controls, no defined AI process, no clear accountability and no incident response plan, and it will fall apart on contact with the real world.
So, where are you covered?
I said insurers would end up setting the rules, and that assurance would go the way of SOC 2. Both are starting to show. The exclusion wording already targets governance failures, and an insurance-backed certification standard now exists. It just stops at the agent.
Deployers are next. The school board, the clinic, the small firm running AI tools it didn’t build: that is where the loss lands. Right now the only evidence it can hand most underwriters is a filled-in questionnaire. At least one specialist underwriter is ready to price better evidence. Until someone independently produces that evidence for the school board, the clinic and the small firm, most of the market will keep pricing the model and guessing about the rest.
I made the full case in two papers: “The Case for Independent AI Assurance in Education: From Self-Attestation to External Validation” [link] and “The Bifurcation: Why AI Insurance Cannot Mature Without Independent Assurance” [link]. If you are a deployer trying to answer “where are you covered?”, or an underwriter trying to price one, I’d like to hear from you at jamespurdy624@gmail.com.
Ryan James PurdyAI Assurance Advisor and Founder, Purdy House Publishing & Consultingjamespurdy624@gmail.com
References
Business Insurance, “AI exclusions struggle to gain traction,” October 7, 2026. https://www.businessinsurance.com/ai-exclusions-struggle-to-gain-traction/The Wall Street Journal (Dow Jones), “AI Runs Into Its Next Big Obstacle: Insurance,” October 2026. https://www.itiger.com/hans/news/2675551608Insurance Journal (Reuters), “Broad AI Exclusions in Insurance Policies Could Create Uncertainty, Marsh CEO Says,” October 16, 2026. https://www.insurancejournal.com/news/national/2026/10/16/889136.htmInsurance Business, “California’s new AI restrictions raise fresh questions for EPLI,” October 6, 2026. https://www.insurancebusinessmag.com/us/news/professional-liability/californias-new-ai-restrictions-raise-fresh-questions-for-epli-592459.aspxInsurance Business, “Does AI need its own insurance market? Brokers are already finding out,” October 7, 2026. https://www.insurancebusinessmag.com/us/news/cyber/does-ai-need-its-own-insurance-market-brokers-are-already-finding-out-592662.aspxCloud Security Alliance, “The End of Silent AI Coverage: Exclusions Outrun Risk Transfer,” August 30, 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-insurance-exclusion-wave-20260830-csa-s/Bloomberg Law, “Insurer AI Exclusions Spark Policyholder Alarm on Coverage Gaps,” July 6, 2026. https://news.bloomberglaw.com/ip-law/insurer-ai-exclusions-spark-policyholder-alarm-on-coverage-gapsTestudo, About. https://www.testudo.co/aboutTestudo, “AI Insurance Market Update Q1 2026.” https://www.testudo.co/insights/ai-insurance-market-update-q1-2026-ai-vendors-are-eating-up-workArmilla AI. https://armilla.aiArmilla AI, Partnerships. https://www.armilla.ai/partnershipsLloyd’s Lab, Armilla AI alumni profile. https://www.lloyds.com/insights/lloyds-lab/programmes-and-initiatives/lloyds-lab-accelerator/alumni/armilla-aiMunich Re, Insure AI. https://munichre.com/insure-aiAIUC-1 Standard. https://www.aiuc-1.comAIUC-1, “Q4-2026 release: Open-weight model controls and stronger third-party testing,” October 15, 2026. https://www.aiuc-1.com/research/2026-q4-standard-updateCloud Security Alliance, AIUC-1 and OWASP Agentic crosswalk research note, August 4, 2026. https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/08/CSA_research_note_aiuc1_owasp_agentic_crosswalk_20260804-csa-styled.pdfDrata, “Drata Now Supports AIUC-1,” July 16, 2026. https://drata.com/blog/introducing-aiuc-1PBS, Amanpour and Company, “What Really Happened When OpenAI Bots Escaped a Cybersecurity Test?,” September 3, 2026. https://www.pbs.org/wnet/amanpour-and-company/video/what-really-happened-when-openai-bots-escaped-a-cybersecurity-test-siqhac/80,000 Hours, “‘Warning shots’ for AI: we are losing control of AI agents.” https://80000hours.org/hugging-face/
Comments