For years, AI risk was insured by accident. Not because any underwriter had priced it, but because nobody had written it out. Insurers call this “silent AI” — coverage that existed purely because the policy did not mention artificial intelligence one way or the other.
That era is ending, and it is ending quietly. The change is not arriving as a letter announcing that your AI coverage has been removed. It is arriving as revised base forms, new endorsements, altered definitions, and extra questions on the renewal application — the parts of the packet nobody reads closely.
What changed in January 2026
The most concrete development: in January 2026, the Insurance Services Office introduced a generative AI exclusion for commercial general liability policies. ISO writes the standard forms that a large share of the US market builds on, so when an exclusion appears there, it propagates widely.
The exclusion removes CGL coverage for bodily injury, property damage, and personal or advertising injury arising out of or attributable to generative AI. Read that list again — personal and advertising injury covers things like defamation and copyright-adjacent claims, which is precisely the territory where generative AI creates novel exposure.
Separately, some carriers have gone considerably further on management liability, adding what practitioners describe as “absolute” AI exclusions — language purporting to eliminate coverage for claims arising out of any use, development, or deployment of artificial intelligence. In a business where nearly every software vendor now embeds AI features, an exclusion written that broadly is worth reading very carefully before you sign it.
The gap nobody notices until they claim
Here is the structural problem, and it is more dangerous than any single exclusion. AI incidents do not respect the boundaries insurers drew between policies.
One incident can plausibly implicate four different towers at once:
| Policy line | The part of the incident it addresses |
|---|---|
| Cyber | Data exposure or breach arising from the AI system |
| Technology E&O | Failure of the AI product or service you delivered to a client |
| Directors & Officers | Disclosure claims — what leadership said about AI capability or risk |
| Employment Practices | Discrimination claims where AI touched hiring or promotion decisions |
Each policy responds to a subset. None responds to the whole. And because carriers are adding AI exclusions independently across lines, the exclusions stack — producing gaps that exist in the spaces between policies rather than inside any one of them. You can hold four current, fully paid policies and still find the specific loss falls into a seam.
The dangerous exclusion is rarely the one you were told about. It is the one that arrived in a revised base form you renewed without comparing.
On how AI exclusions enter a policy
Why this hits smaller companies hardest
A large enterprise has a broker, a risk manager, and often outside coverage counsel reading every endorsement at renewal. A thirty-person firm has an owner who receives a renewal packet, sees a manageable premium, and signs it.
That asymmetry matters more than usual right now, because the changes are happening inside form language rather than in premium. Your premium can stay flat while your coverage narrows. If you are judging the renewal by price — which is the reasonable thing to do in any normal year — you will not notice.
There is a second trap specific to smaller businesses. Most have adopted AI without ever deciding to. Your CRM added an AI assistant. Your helpdesk added AI ticket summarisation. Your accounting software added anomaly detection. Nobody signed an “AI project” approval, but under a broadly drafted exclusion, those features may still be AI use — and the shadow AI your staff adopted independently counts too, whether or not you know about it.
What to ask before your next renewal
You do not need to become an insurance expert. You need to ask your broker a small number of specific questions and get the answers in writing.
- “Has an AI exclusion been added to any of my policies this year?” Ask about each line separately — cyber, general liability, E&O, D&O, EPLI. The answer will not be the same for all of them.
- “How does this policy define artificial intelligence?” This is the question that decides everything else. A definition covering any “machine learning or automated decision system” reaches vastly further than one naming generative AI, and may capture software you have run for years.
- “If an AI-related incident happened, which policy responds first?” If your broker cannot answer cleanly, that is the coverage gap, identified before a loss rather than after.
- “What changed in the base form since last year?” Exclusions frequently arrive through a revised standard form rather than a flagged endorsement. Ask for a comparison against the expiring policy.
- “Is affirmative AI coverage available, and what does it cost?” Some carriers now offer AI-specific coverage or endorsements that restore what a base form removed. Get the quote even if you decline it — the price tells you how the market rates your risk.
- “How should I answer the AI questions on the application?” Application answers are representations. Understating AI use to keep a quote attractive is how claims get denied for misrepresentation later. Answer accurately, and document what you told them.
Where security posture comes back into it
Underwriters have started asking how AI use is governed, not merely whether it exists. That makes the operational work — an inventory of AI tools in use, a written policy, named ownership, access controls — do double duty. It reduces real risk, and it is also increasingly the evidence that determines your terms.
This is the same documentation that compliance frameworks ask for, and the same governance gap we described in AI agent security. Companies that can produce a clear answer to “who owns your AI systems and what can they reach” are in a materially better position at renewal than companies that cannot.
Frequently asked questions
Does my current cyber policy cover an AI-related breach?
It depends entirely on your specific policy language, which is why the honest answer is that you need to check rather than assume. Historically many AI incidents fell under cyber coverage by default because nothing excluded them. That default is being removed unevenly across carriers and lines, so a policy that covered this last year may not this year.
We do not use AI. Does any of this apply to us?
Almost certainly yes, and this is the most common misconception. AI features are embedded in mainstream business software — CRM, email, helpdesk, accounting, security tooling. Under a broad definition, using that software is using AI. Very few companies can accurately say they have no AI exposure, and being wrong about it on an application is worse than having the exposure.
Will disclosing AI use raise our premium?
It may affect pricing or terms. It is still the right thing to do. Insurance applications are representations you are warranting as accurate, and a claim denied for misrepresentation is a far worse outcome than a higher premium. Disclose accurately, demonstrate governance, and let the underwriter price it.
Should we buy standalone AI insurance?
That is a question for your broker and, for meaningful exposure, coverage counsel — it depends on your actual risk profile and what your existing tower already does. What is worth doing regardless is finding out whether affirmative AI coverage is available to you and what it costs, so the decision is informed rather than default.
The practical summary
Pull your current policies. Find the AI definition in each, if there is one. Ask your broker the six questions above and keep the answers in writing. If you cannot say which policy responds to an AI-related loss, you have found the thing to fix — and you have found it in the cheap way rather than the expensive way.
Delana Technologies helps companies build the AI inventory, governance documentation and security evidence that underwriters and auditors now ask for, and provides digital forensics and expert testimony when an incident becomes a claim. Call 239.414.5126 or contact us.
Delana Technologies is a cybersecurity and technology consulting firm. We are not insurance brokers, agents or attorneys, and nothing here is insurance, legal or financial advice — coverage depends on the specific wording of your policies and your circumstances. Discuss your situation with your licensed broker and, where the exposure warrants it, coverage counsel.
Sources: Fenwick & West, “The End of ‘Silent AI’? Emerging AI Exclusions, Coverage Fragmentation, and Practical Implications for Policyholders”; Insurance Services Office generative AI exclusion for commercial general liability, introduced January 2026.