From reviewing state DOI filing databases across a dozen major jurisdictions, the pattern is unmistakable: the same carriers that are deploying AI most aggressively in their own operations are simultaneously filing to exclude AI damages from the policies they sell. Since Verisk’s ISO CG 40 47 and CG 40 48 endorsements took effect on January 1, 2026, a coordinated wave of carrier filings has reshaped the commercial general liability landscape. Chubb, Travelers, Berkshire Hathaway, AIG, W.R. Berkley, and Great American have all sought regulatory clearance for AI-specific exclusions across CGL, D&O, and E&O policies. State regulators have approved more than 80% of those applications, with Florida, Connecticut, and Maryland processing approvals at the fastest pace. The result is a widening “silent AI” coverage gap that most commercial policyholders have not yet noticed, and a standalone AI liability market that Deloitte projects will reach $4.7 billion in annual global premiums by 2032.

This article maps the full exclusion landscape: the mechanics of each ISO endorsement, the carrier filing wave and its regulatory reception, the coverage gap these exclusions create, the standalone market now racing to fill it, and the actuarial pricing challenges inherent in a peril class with almost no historical loss data.

ISO Endorsement Mechanics: CG 40 47, CG 40 48, and CG 35 08

All three endorsements share a common definition of generative artificial intelligence: “a machine-based learning system or model trained on data with the ability to create content or responses, including but not limited to text, images, audio, video or code.” The definition captures large language models, image generators, code assistants, and any system that produces novel output from learned patterns. It does not reach traditional predictive models that classify or score without generating content, though the production boundary between “generative” and “predictive” AI is increasingly blurred as vendors embed generative features into previously predictive tools.

CG 40 47 01 26 is the broadest form. It applies to the ISO Commercial General Liability Coverage Part (both occurrence and claims-made versions) and excludes coverage under both Coverage A (bodily injury and property damage) and Coverage B (personal and advertising injury) for any loss “arising out of” generative artificial intelligence. This is a total carve-out. A manufacturer whose AI-generated product instructions cause injury, a retailer whose AI chatbot defames a competitor, a consulting firm whose AI-drafted report contains material errors: none would find coverage under a CGL policy endorsed with CG 40 47.

CG 40 48 01 26 is narrower. It excludes only Coverage B, removing protection for personal and advertising injury arising from generative AI while preserving Coverage A for bodily injury and property damage. This form targets the most visible near-term exposure: AI-generated content that infringes intellectual property, makes false statements, or invades privacy. A company whose marketing team deploys AI-generated copy that plagiarizes a competitor’s tagline loses coverage, but a factory whose AI-controlled equipment malfunctions and injures a worker retains it.

CG 35 08 01 26 applies to the ISO Products/Completed Operations Liability Coverage Part. It excludes Section I coverage for bodily injury or property damage arising from generative AI in products that have been completed and delivered. Once generative AI is embedded in a finished product, downstream harm theories including product defect, failure to warn, and reasonable reliance at scale fall outside coverage.

Form Applies To Excludes Preserves
CG 40 47 CGL Coverage Part Coverage A + Coverage B (BI, PD, personal/advertising injury) Nothing AI-related
CG 40 48 CGL Coverage Part Coverage B only (personal/advertising injury) Coverage A (BI, PD)
CG 35 08 Products/Completed Ops Section I (BI, PD from AI in products) Premises/operations exposure

The critical phrase across all three forms is “arising out of.” In insurance coverage law, this phrase is interpreted broadly, requiring only a causal connection rather than direct or proximate causation. A claim does not need to be caused entirely by generative AI to fall within the exclusion; it needs only to arise out of the use of generative AI. This breadth magnifies the coverage gap for policyholders using AI-enabled vendor products where generative AI may be embedded in tools from Salesforce, HubSpot, Zendesk, and dozens of other enterprise platforms without the policyholder fully understanding the AI functionality they are deploying.

The Carrier Filing Wave: Who Filed and Where

The carrier response to the ISO endorsements has been fast and broad. Analysis of state DOI filing databases and industry reporting reveals two distinct tracks: carriers adopting the ISO standard forms directly, and carriers filing proprietary AI exclusion language that often goes further than the ISO wording.

Berkshire Hathaway and Travelers began submitting AI exclusion applications to state regulators in fall 2025, before the ISO endorsements officially took effect. By early 2026, both carriers had secured approvals and began attaching AI exclusions to commercial renewals. Chubb followed with filings that won regulatory approval across multiple jurisdictions by spring 2026. The Information reported in April 2026 that all three carriers had won approval to add AI exclusion clauses to their standard commercial liability policies.

AIG, W.R. Berkley, and Great American Insurance Group filed their own AI exclusion requests with US regulators in November 2025. Berkley’s language is among the broadest in the market. Its Form PC 51380, titled “Artificial Intelligence Absolute Exclusion,” bars coverage for “any claim based upon, arising out of, or attributable to” AI use, deployment, or development, regardless of whether the model was company-owned, third-party, licensed, or embedded in software tools. That language reaches beyond the ISO definition of generative AI to capture all AI-related claims across D&O, E&O, and fiduciary liability products. Great American updated its Washington state commercial umbrella and excess forms to exclude liability stemming from generative AI. Berkley Insurance filed comparable exclusions in Connecticut for private company management liability and crime.

Evercore ISI, in a late-2025 analysis, identified five large-account insurers as most exposed to generative AI claims: Chubb, AIG, Zurich, AXA XL, and Allianz. The investment bank predicted rapid adoption across the industry and noted that tech E&O policies face the greatest near-term AI claims exposure. Verisk’s own fourth-quarter 2024 survey found that 32% of insurers were moderately concerned about generative AI product liability claims within one to two years, while 23% were extremely concerned.

ISO forms underpin approximately 82% of US property and casualty policies. When Verisk introduces a new endorsement and carriers begin filing, adoption follows a predictable curve. Early adopters file within the first quarter. Midmarket carriers follow within six to twelve months as state approvals come through. The tail includes smaller regionals and mutuals that may lag by 18 to 24 months. Based on the current pace, broad adoption of some form of AI exclusion across the majority of commercial GL books appears likely by the end of 2027.

The 80% Approval Rate and What Regulators Are Signaling

State insurance regulators have approved more than 80% of AI exclusion applications filed by carriers, according to The Information’s April 2026 reporting. Florida, Connecticut, and Maryland have processed approvals at the fastest pace, with provisions already in effect for policies renewing in Q1 and Q2 2026.

The approval rate signals something important about regulatory posture: state regulators are, for now, willing to let carriers shed AI risk from standard commercial books. This willingness contrasts with the more cautious approach regulators have taken on other emerging-risk exclusions. When carriers began filing cyber exclusions in the mid-2010s, several states initially pushed back, requesting actuarial justification for the coverage reduction and asking carriers to demonstrate that alternative coverage options existed for policyholders. The relative ease of AI exclusion approvals suggests that regulators view generative AI liability as sufficiently uncertain that allowing carriers to carve it out, rather than requiring them to price and retain it, is the pragmatic path.

That said, regulatory scrutiny is likely to intensify as the exclusion wave widens. The NAIC’s December 2023 model bulletin on AI, now adopted in approximately 24 states including Delaware, Maryland, Massachusetts, New Jersey, North Carolina, Pennsylvania, and Vermont, establishes guidelines for responsible insurer use of AI. The NAIC’s March 2026 AI Issue Brief reaffirmed the state-based oversight framework and explicitly opposed federal preemption that would undermine consumer protections. The Colorado AI Act, with its June 30, 2026 compliance deadline and penalties up to $20,000 per violation, adds a state-level regulatory overlay that interacts with AI exclusion endorsements in ways no jurisdiction has yet tested.

The 12-state NAIC AI evaluation pilot, running from January through September 2026 with Colorado, Maryland, Louisiana, Virginia, Connecticut, Pennsylvania, Wisconsin, Florida, Rhode Island, Iowa, Vermont, and California participating, may produce findings that shift regulatory posture. If the pilot reveals that AI exclusions are leaving a critical mass of commercial policyholders without coverage options, regulators may push for standardized affirmative AI coverage requirements to accompany the exclusion endorsements. This would mirror the regulatory evolution in cyber, where state data breach notification laws helped shape the standalone market.

The Silent AI Coverage Gap

Before the CG 40 47 family of endorsements, generative AI exposure sat in a coverage gray zone the industry has started calling “silent AI.” The term borrows from the “silent cyber” framing that dominated reinsurance discussions from 2017 to 2021. Silent AI describes liability policies that neither explicitly cover nor explicitly exclude claims arising from generative AI. When a CGL policy is silent on AI, the insurer bears the risk that a court will find coverage for an AI-related claim under existing bodily injury, property damage, or personal and advertising injury provisions.

The shift from silent coverage to explicit exclusion has happened quietly at the policyholder level. AI exclusion endorsements are attached at renewal as standard policy modifications. An organization whose broker did not specifically flag the new language may be entirely unaware that coverage changed. Swept AI’s analysis of the CGL exclusion landscape found that many SME owners believe their existing GL or Business Owners Policy covers AI-related mishaps because nothing previously excluded it. The disclosure gap is compounded by the complexity of modern AI deployment: enterprise software from Microsoft, Google, Salesforce, and dozens of other vendors now includes generative AI features, often activated by default. A policyholder may not realize it is “using” generative AI within the meaning of the exclusion.

The timeline of the shift underscores how quickly the ground moved. Beginning in January 2025, transitional exclusions appeared and AI disclosure questionnaires became standard at commercial renewal. By January 2026, affirmative AI warranties were required for continued coverage, or absolute exclusions applied. As one legal commentator noted, “silence had largely disappeared from renewal documentation” by spring 2026.

HSB, a Munich Re subsidiary, reports that 74% of small and midsize businesses now use AI programs, with 91% planning to in the future. Those adoption rates set against the exclusion wave create a mathematical certainty: a large and growing number of commercial policyholders are deploying AI while their CGL policies now exclude AI-related damages. The coverage gap will not become visible until the first denied claims reach litigation, at which point the market correction will already be underway.

Standalone AI Liability: Who Is Filling the Gap

The exclusion wave has created insurable demand for dedicated AI liability products, and a growing cohort of carriers, MGAs, and insurtechs is racing to fill it. The competitive landscape now includes at least four distinct product models.

Corgi closed a $160 million Series B on May 6, 2026, led by TCV, at a $1.3 billion valuation, making it Y Combinator’s latest unicorn. The company is a licensed insurance carrier that writes policies on its own paper, covering six AI risk categories: model hallucination, algorithmic bias, training data disputes, adversarial attacks, synthetic media liability, and autonomous system failures. Total funding stands at $268 million, and the company reached $40 million in annual recurring revenue within its first year of operations. Corgi’s modular Tech E&O integration approach lets customers select which AI risk categories to include and at what limits through a self-service dashboard.

Munich Re pioneered AI insurance with its aiSure product, which combines expert-driven due diligence with performance-based triggers for AI system errors. In March 2026, Munich Re’s subsidiary HSB introduced a dedicated AI liability product for small and midsize businesses, covering bodily injury, property damage, and personal and advertising injury from AI-generated content. HSB designed the product to fill exactly the gap that CG 40 47 creates.

Armilla, backed by Lloyd’s syndicates Chaucer and Axis Capital, sells purpose-built AI liability insurance covering hallucinations, model drift, and regulatory breaches with limits up to $25 million. The product uses independent audit scoring to calibrate pricing.

Testudo launched in January 2026 with a claims-made product targeting mid-to-large enterprises deploying generative AI. Initial limits reached $8.5 million, and subsequent backing from Atrium and QBE increased available capacity to $9.25 million per insured as of March 2026. The product operates through Lloyd’s Lab.

Coverage limits across the standalone market range from $2 million to $50 million, with annual premiums ranging from a few hundred dollars for micro-policies to several hundred thousand dollars for enterprise coverage. Notably, only a handful of standalone AI liability products are actively binding coverage, and most operate outside standard admitted channels in the E&S market. The market is still nascent, but the demand catalyst is structural and growing with every carrier that files an AI exclusion.

The $4.7 Billion Market Projection

Deloitte projects that insurers could generate approximately $4.7 billion in annual global premiums from AI-related insurance products by 2032, representing a compounded annual growth rate of roughly 80%. The projection mirrors the trajectory of the cyber insurance market, which grew from negligible premium volume in the early 2000s to $15.3 billion in global premium by 2024, according to Munich Re, with North American premium alone accounting for $10.6 billion.

The structural dynamics driving this projection are clear. Standard admitted carriers are using the ISO endorsements to strip AI liability from commercial renewals, forcing demand into the E&S market and standalone products. As AI adoption accelerates across industries and as the first wave of AI liability litigation establishes loss severity benchmarks, the standalone market absorbs the displaced demand. Gartner projected in April 2026 that more than 2,000 legal claims linked to AI incidents will be filed worldwide by the end of 2026. Generative AI-related lawsuits in the US grew 978% from 2021 to 2025, with cumulative filings exceeding 700 cases and year-over-year filing increases accelerating to 137% between 2024 and 2025.

Those litigation trends reinforce the demand thesis. Every denied CGL claim for AI-related damages becomes a data point that validates the need for standalone coverage. Every lawsuit naming an AI system as a proximate cause of harm makes the coverage gap more visible to corporate risk managers. The exclusion itself is the demand creation mechanism, precisely as it was in the cyber insurance origin story.

Actuarial Pricing Challenges: Rating a Peril With No Loss Triangles

The core challenge for any actuary pricing AI liability in 2026 is the absence of credible loss data. Generative AI in its current commercial form is roughly three years old. Enterprise deployment is younger. The claim reporting cycle has not produced enough development to construct reliable paid or incurred loss triangles. This is not a data quality problem that better collection will resolve in the near term; it is a structural absence that forces the pricing actuary to rely on a combination of surrogate data, expert elicitation, and scenario modeling.

Frequency estimation without precedent. AI failure modes do not map cleanly onto existing casualty exposure bases. A hallucination-driven advice error, a deepfake defamation incident, automated discrimination at scale, and a cascading agentic AI failure are each distinct perils with distinct frequency distributions. The AI Lawsuit Tracker documented over 700 cumulative generative AI lawsuits through 2025, but the claim universe is dominated by copyright and IP disputes; the bodily injury, property damage, and personal injury categories that CGL policies cover have produced far fewer data points. Frequency assumptions for standalone AI liability products today rely heavily on expert judgment and scenario analysis rather than actuarial experience.

Severity benchmarks from adjacent lines. Without AI-specific severity data, pricing actuaries are drawing analogies to technology E&O, media liability, and product liability. But generative AI introduces loss mechanisms that do not map cleanly onto any of those lines. A single widely deployed model that hallucinates across thousands of downstream users simultaneously creates correlated severity that product liability triangles do not contemplate. The Nippon Life Insurance Company of America lawsuit filed against OpenAI in March 2026, seeking approximately $300,000 in compensatory damages and $10 million in punitive damages, provides one early severity data point, but the range of potential outcomes is enormous.

Accumulation and aggregation risk. The AI ecosystem’s reliance on a small number of foundation model providers means a critical flaw in one widely adopted model could trigger claims across thousands of unrelated policyholders simultaneously. This concentration risk is structurally different from traditional casualty accumulation, where correlated claims typically require a shared physical event. An AI model update that introduces systematic bias or generates defective output can propagate instantly across industries and borders. Reinsurers providing quota share or excess of loss cover on AI liability portfolios need to model this aggregation risk explicitly.

Model drift and the pricing lag. AI model performance can degrade over time as the data distributions in production diverge from training data. A drift event that begins affecting decisions in January 2026 would start to appear in Q2 paid and incurred data, reflected in a rate filing developed in Q4 for effective dates in mid-2027. The minimum cycle from “drift begins” to “rate corrected” is roughly eighteen months. For a peril class already thin on data, this pricing lag compounds the uncertainty.

Exposure base design. Traditional casualty exposure bases like payroll, revenue, and unit count translate poorly to AI risk. The emerging market is testing several alternatives: inference volume (total model calls per policy period), deployment surface (customer-facing versus internal-only), model capability tier (larger models produce more consequential outputs), regulated industry factors (healthcare, financial services, and legal deployments carry incremental exposure), and governance attestation (scaling pricing based on the insured’s model inventory, adversarial testing, and human oversight practices). None of these has sufficient loss data to validate actuarially, so early rating plans are effectively hypotheses waiting for experience to confirm or reject.

The Cyber Exclusion Precedent: A Pricing Playbook

The closest precedent for the CG 40 47 adoption cycle is the rollout of cyber exclusions from 2014 to 2019. In 2014, ISO introduced CG 21 06 and CG 21 07, excluding data-related liability from CGL policies. Lloyd’s Market Association followed with model cyber exclusion clauses. The logic was identical: insurers recognized they were silently covering a risk they had not priced, and the exclusion was the fastest mechanism to remove that exposure from existing forms.

What followed was a five-year migration. Standalone cyber policies grew from negligible volume into a market reaching $15.3 billion in global premium by 2024. The number of policies in force grew from roughly 2.2 million to over 3.6 million between 2016 and 2019, per the Federal Reserve Bank of Chicago. Several structural features of that cycle are repeating now:

  • Ambiguity drives the first wave of exclusions. Carriers could not quantify silent cyber exposure, so they excluded it. Carriers today cannot quantify silent AI exposure, so they are excluding it. The risk management logic is identical.
  • Exclusions create insurable demand for standalone products. Once cyber was excluded from CGL and property policies, commercial buyers needed dedicated coverage. The exclusion itself was the demand creation mechanism. The same dynamic is unfolding with AI liability.
  • Early standalone pricing is volatile and margin-rich. Standalone cyber policies in 2015 and 2016 carried combined ratios well below 100% because loss history was thin and insurers priced conservatively. The same conditions exist for standalone AI liability products today.
  • Regulatory catalysts accelerate the cycle. State breach notification laws gave the cyber market regulatory legitimacy. For AI, the EU AI Act (effective August 2025), the Colorado AI Act (June 2026 compliance deadline), and the NAIC model bulletin on AI (December 2023) are playing equivalent catalytic roles.

If AI exclusions follow a similar four-to-five-year trajectory starting from the CG 40 47 effective date, mainstream standalone AI liability products should be widely available by 2029 to 2030. The cyber market’s painful repricing cycle between 2020 and 2022, when premiums spiked over 30% annually as ransomware losses overwhelmed initial assumptions, offers a cautionary note: early conservative pricing may prove insufficient when the first systemic AI loss event materializes.

The Actuarial Irony: Carriers Using AI While Excluding AI Risk

Patterns we have tracked across carrier earnings calls, patent filings, and technology investment disclosures reveal a striking asymmetry. The same carriers filing AI exclusions are simultaneously investing billions in AI-driven underwriting, claims processing, and customer service. Travelers has committed $1.5 billion in technology spending with AI as a core pillar. AIG has deployed agentic AI across its underwriting operations. Chubb has mandated AI-powered claims workflows globally. Progressive’s telematics program, built on machine learning models, now covers 21 million policyholders.

This is not hypocrisy; it is rational risk management. Carriers are net consumers of AI in their own operations and net excluders of AI risk in the policies they sell. The asymmetry reflects a simple actuarial judgment: the expected loss from AI deployments by policyholders across heterogeneous industries, use cases, and governance maturity levels is unquantifiable with current data, while the expected productivity gain from controlled AI deployments within the carrier’s own operations is measurable and positive. The carrier can manage its own AI risk through internal governance, model validation, and vendor oversight. It cannot manage the AI risk of its entire insured population, so it excludes it.

But this asymmetry creates a second-order problem. If carriers exclude AI damages from the policies they sell while deploying AI in the underwriting decisions that determine coverage terms, the regulatory tension is self-evident. A carrier that uses an AI model to price a policy that excludes AI liability is, in effect, deploying the same technology it has declared uninsurable. As state regulators and the NAIC deepen their AI governance frameworks, this tension will become harder to sustain.

GL Book Pricing Adjustments: What the Actuary Should Model

For actuaries responsible for GL rate indications, the CG 40 47 adoption cycle introduces several modeling considerations that will shape rate filings through 2027 and beyond.

Loss load bifurcation. Once a GL book splits between policies with and without AI exclusions, the actuary needs separate expected loss assumptions for each segment. Policies with exclusions should carry a lower loss load reflecting the removal of AI-related claims. Policies without exclusions should carry a higher load, potentially increasing over time as commercial AI deployment grows. From reviewing early-stage loss development on technology E&O and media liability portfolios, a reasonable estimate for the near-term AI loss load on a standard commercial GL policy falls in the range of 0.5 to 2.0 percentage points of the expected loss ratio, depending on the insured’s industry and level of AI deployment.

Classification refinement. The current GL classification system does not distinguish between AI-heavy and AI-light insureds within the same SIC or NAICS code. A marketing firm generating 80% of its content with AI tools and a marketing firm using no AI occupy the same rating class. As AI exclusions bifurcate the book, carriers may find that classification relativities need updating to reflect AI adoption intensity as a rating variable, subject to regulatory approval.

Adverse selection dynamics. Sophisticated buyers who understand the exclusion will seek AI coverage elsewhere or self-insure. Less sophisticated buyers may not realize they are exposed until a claim is denied. The exclusion creates adverse selection within the GL book that the pricing actuary needs to anticipate and model.

Excess and umbrella layer implications. GL exclusions in the primary layer have cascading effects. If the primary policy excludes AI and the excess or umbrella follows form, the excluded exposure passes through the entire tower. If the excess does not follow form, it silently retains AI exposure the primary carrier has shed. From reviewing several excess and umbrella wordings, the follow-form question on AI exclusions is not yet consistently resolved across the market.

Why This Matters for Actuaries

The CGL AI exclusion wave is not a niche endorsement cycle. It is a market-level repricing event that separates AI liability from the commercial GL cost of insurance, creating a new line of business in the process. For pricing actuaries working GL books, the immediate task is modeling the loss load bifurcation between excluded and non-excluded policies. For reserving actuaries, the challenge is monitoring for AI-related claims that emerge under policies written before the exclusion took effect, where silent AI exposure remains on the books. For actuaries building standalone AI liability products, the challenge is constructing rating plans and reserve methodologies from first principles, with scenario judgment substituting for the loss triangles that do not yet exist.

Gartner anticipates that by 2030, P&C insurers will require organizations to demonstrate strong AI risk controls before granting explicit AI liability coverage, a dynamic the firm expects to drive a 60% increase in corporate investment in AI governance and security measures. That forecast suggests a future where actuarial pricing for AI liability is linked to governance attestation as tightly as cyber pricing is now linked to security posture.

The irony at the center of this cycle bears repeating: the industry most actively deploying AI is simultaneously declaring AI risk uninsurable under its standard forms. That tension will resolve, as it did with cyber, through the development of a standalone market with its own loss data, classification system, and regulatory framework. The carriers and actuaries who build that market from its current nascent state will define the pricing architecture for what Deloitte projects will be a $4.7 billion annual premium line by 2032.

Further Reading

Sources