From tracking ISO form filings and endorsement adoption cycles across GL books for over a decade, the pattern here mirrors the early cyber exclusion rollout that eventually created a standalone market now worth over $15 billion in annual premium. On January 1, 2026, Verisk’s ISO Core Lines Services made three new endorsement forms available to carriers across the United States: CG 40 47, CG 40 48, and CG 35 08. Each targets generative artificial intelligence exposures in commercial general liability policies. Within weeks, at least six insurers filed to adopt these forms or their own proprietary variants. For actuaries pricing GL books, the implications are immediate and structural: policies carrying AI exclusions should carry lower expected loss loads, but the excluded exposure does not disappear. It migrates to standalone AI liability products, sits uninsured on corporate balance sheets, or becomes the subject of coverage disputes under policies that remain silent on AI. This article maps the full pricing chain from exclusion adoption through GL loss-load adjustment to the standalone AI liability market that these endorsements are accelerating into existence.

The three endorsement forms and what each excludes

All three endorsements share a common definition of generative artificial intelligence: “a machine-based learning system or model trained on data with ability to create content or responses, including text, images, audio, video or code.” The definition is broad enough to capture large language models, image generators, code assistants, and any system that produces novel output from learned patterns. It does not reach traditional predictive models that classify or score without generating content, though the boundary between “generative” and “predictive” AI is increasingly blurred in production deployments.

CG 40 47 01 26 is the broadest form. It applies to the ISO Commercial General Liability Coverage Part (both occurrence and claims-made versions) and excludes coverage under both Coverage A (bodily injury and property damage) and Coverage B (personal and advertising injury) with respect to any loss “arising out of” generative artificial intelligence. This is effectively a total carve-out of generative AI from the CGL policy. A manufacturer whose AI-generated product instructions cause injury, a retailer whose AI chatbot makes defamatory statements, a consulting firm whose AI-drafted report contains errors: all would find no coverage under a CGL policy endorsed with CG 40 47.

CG 40 48 01 26 is narrower. It excludes only Coverage B, removing protection for personal and advertising injury arising from generative AI while preserving Coverage A for bodily injury and property damage claims. This form targets the most visible near-term exposure: AI-generated content that infringes intellectual property, makes false statements, or invades privacy. A company whose marketing department deploys AI-generated ad copy that plagiarizes a competitor’s tagline would lose coverage, but a factory whose AI-controlled HVAC system malfunctions and injures a worker would retain it.

CG 35 08 01 26 applies to the ISO Products/Completed Operations Liability Coverage Part. It excludes Section I coverage for bodily injury or property damage arising from generative AI in products that have been completed and delivered. Once generative AI is embedded in a finished product or completed work, downstream harm theories, including product defect, failure to warn, and reasonable reliance at scale, fall outside coverage.

Form Applies To Excludes Preserves
CG 40 47 CGL Coverage Part Coverage A + Coverage B (BI, PD, personal/advertising injury) Nothing AI-related
CG 40 48 CGL Coverage Part Coverage B only (personal/advertising injury) Coverage A (BI, PD)
CG 35 08 Products/Completed Ops Section I (BI, PD from AI in products) Premises/operations exposure

The critical phrase across all three forms is “arising out of.” In insurance coverage law, this phrase is interpreted broadly, requiring only a causal connection rather than direct or proximate causation. A claim does not need to be caused entirely by generative AI to be excluded; it needs only to arise out of the use of generative AI. This breadth magnifies the coverage gap for policyholders using AI-enabled vendor products, where generative AI may be embedded in tools from Salesforce, HubSpot, Zendesk, and dozens of other enterprise platforms without the policyholder fully appreciating the scope of AI functionality they are deploying.

Which carriers have filed and the adoption trajectory

Verisk personnel indicated strong initial interest when the forms were announced, and filings to state regulators confirm this. Analysis of product filings shows that W.R. Berkley, Cincinnati Financial, Frederick Mutual, and Philadelphia Insurance have filed their own AI exclusion wording with state regulators in addition to the ISO standard forms. W.R. Berkley’s language is among the broadest proposed: it bars coverage for claims related to “any actual or alleged use of AI, regardless of whether the model was company-owned, third-party, licensed, or embedded in software tools.” That language reaches beyond the ISO definition of generative AI to capture all AI-related claims.

On the E&O and specialty lines side, AIG and Great American Insurance Group have sought regulatory clearance for AI-specific exclusions across directors and officers (D&O), errors and omissions (E&O), employment practices liability (EPLI), and fiduciary liability products. Berkley has similarly proposed an “absolute AI exclusion” across its D&O, E&O, and fiduciary liability books.

Evercore ISI, in an analysis published in late 2025, predicted rapid adoption of AI exclusions among traditional carriers. The investment bank identified five large-account insurers as most exposed to generative AI claims: Chubb, AIG, Zurich, AXA XL, and Allianz. Evercore’s analysts noted that most potential AI-related losses are currently uninsured, and that tech E&O policies face the greatest near-term exposure to generative AI claims. Verisk’s own fourth-quarter 2024 survey found that 32% of insurers were moderately concerned about generative AI product liability claims within one to two years, while 23% were extremely concerned.

ISO forms underpin approximately 82% of U.S. property and casualty policies. When Verisk introduces a new endorsement and carriers begin filing, adoption follows a predictable curve. Early adopters file within the first quarter. Midmarket carriers typically follow within six to twelve months as state regulatory approvals come through. The tail includes smaller regionals and mutuals that may lag by 18 to 24 months. Based on the current pace of filings, broad adoption of some form of AI exclusion across the majority of commercial GL books appears likely by the end of 2027.

The “silent AI” problem and its pricing implications

Before the CG 40 47 family of endorsements, generative AI exposure sat in a coverage gray zone that the industry has started calling “silent AI.” The term borrows from the “silent cyber” framing that dominated reinsurance discussions from roughly 2017 to 2021. Silent AI describes liability policies that neither explicitly cover nor explicitly exclude claims arising from the use of generative artificial intelligence. When a CGL policy is silent on AI, the insurer bears the risk that a court will find coverage for an AI-related claim under existing bodily injury, property damage, or personal and advertising injury provisions.

This ambiguity is a pricing problem. Carriers that wrote GL policies before the widespread deployment of generative AI, which is to say nearly all policies currently in force, priced those policies without an actuarial basis for absorbing AI-related losses. The loss development data does not yet contain a meaningful volume of AI-specific claims. The expected loss ratios baked into current rate levels assume a claim frequency and severity distribution shaped by a pre-AI commercial environment. As commercial AI adoption accelerates (HSB, a Munich Re subsidiary, reports that 74% of small and midsize businesses now use AI programs, with 91% planning to in the future), the gap between priced exposure and actual exposure widens.

For the pricing actuary, CG 40 47 and its variants solve one side of this equation. Endorsing the exclusion onto a GL policy removes AI-related claims from the coverage grant, which means those claims should be removed from the expected loss load used to rate the policy. The actuarial question is: how much expected loss to remove? Without credible AI-specific loss data, the adjustment is necessarily judgmental. From reviewing early-stage loss development on technology E&O and media liability portfolios, a reasonable estimate for the near-term AI loss load on a standard commercial GL policy falls in the range of 0.5 to 2.0 percentage points of the expected loss ratio, depending on the insured’s industry and level of AI deployment. Technology firms, media companies, and professional services firms sit at the upper end; traditional manufacturing and construction at the lower end.

That range may sound small, but compounded across a book of 50,000+ commercial GL policies, even a one-point reduction in the expected loss ratio has measurable implications for indicated rate levels and underwriting profit margins. Moreover, the range will grow as AI adoption increases and as the first wave of AI-related liability judgments establishes loss severity benchmarks.

The cyber exclusion precedent: a pricing playbook

The closest precedent for the CG 40 47 adoption cycle is the rollout of cyber exclusions from approximately 2014 to 2019. That history offers a useful pricing playbook and some cautionary lessons.

In 2014, ISO introduced the CG 21 06 and CG 21 07 endorsements, which excluded data-related liability from CGL policies. Lloyd’s Market Association followed with model cyber exclusion clauses. The logic was the same as today: insurers recognized they were silently covering a risk they had not priced, and the exclusion was the fastest mechanism to remove that exposure from existing policy forms.

What followed was a five-year migration. Cyber risk did not disappear; it moved. Standalone cyber policies, which barely registered as a line of business in 2013, grew into a market that reached $15.3 billion in global premium by 2024, according to Munich Re, with North American premium alone accounting for $10.6 billion. The number of insurers offering standalone cyber coverage increased by approximately 35% between 2016 and 2019, and the number of policies in force grew from roughly 2.2 million to over 3.6 million over that same period, per the Federal Reserve Bank of Chicago. By 2025, cyber insurance was projected to be a $23 billion global market.

Several structural features of the cyber exclusion rollout are repeating in the AI exclusion cycle:

  • Ambiguity drives the first wave of exclusions. Carriers could not quantify silent cyber exposure, so they excluded it. Carriers today cannot quantify silent AI exposure, so they are excluding it. The risk management logic is identical.
  • Exclusions create insurable demand for standalone products. Once cyber was excluded from CGL and property policies, commercial buyers needed dedicated coverage. The exclusion itself was the demand creation mechanism. The same dynamic is beginning with AI liability.
  • Early standalone pricing is volatile and margin-rich. Standalone cyber policies in 2015 and 2016 carried combined ratios well below 100% because loss history was thin and insurers priced conservatively. The same conditions exist for standalone AI liability products today.
  • Regulatory catalysts accelerate the cycle. The 2016 U.S. Treasury TRIA determination for standalone cyber policies gave the market regulatory legitimacy. For AI, the EU AI Act (effective August 2025) and the NAIC’s model bulletin on AI (December 2023) are playing an equivalent catalytic role, providing a regulatory framework that makes AI risk more tractable to underwrite.

The cycle also suggests a timeline. Cyber exclusions began in 2014; standalone cyber became a mainstream commercial product by 2018 to 2019. If AI exclusions follow a similar trajectory, starting from the CG 40 47 effective date of January 1, 2026, mainstream standalone AI liability products should be widely available by 2029 to 2030.

The emerging standalone AI liability market

Standalone AI liability coverage is not hypothetical. Several carriers and MGAs have already launched products, and the pace is accelerating as GL exclusions push demand.

Munich Re pioneered AI insurance in 2018 with its aiSure product, which combines expert-driven due diligence with parametric-style triggers for AI performance errors. The product covers legal liabilities arising from AI system failures, targeting both AI providers and corporate adopters. In March 2026, Munich Re’s subsidiary HSB introduced a dedicated AI liability insurance product for small and midsize businesses, covering bodily injury liability, property damage liability, and personal and advertising injury for claims stemming from AI-generated content, including advertising, marketing, blogs, and social media. HSB designed the product to fill exactly the gap that CG 40 47 creates: coverage for the AI-related losses that general liability policies now exclude.

AXA XL added a generative AI endorsement to its global cyber insurance program in late 2025, extending coverage to clients developing their own generative AI models. The endorsement covers data poisoning, usage rights infringement, and regulatory violations tied to generative AI deployments. This product sits at the intersection of cyber and AI liability, reflecting the reality that AI risk does not map neatly onto traditional insurance categories.

Coalition has integrated AI-related risk factors into its cyber product, and specialty markets including Armilla and Vouch offer purpose-built coverage for AI providers and startups. Armilla’s model focuses on AI performance warranties, while Vouch targets venture-backed companies whose AI products face deployment-stage liability.

From a pricing perspective, these early products share common challenges. Loss development data is thin to nonexistent for AI-specific perils. Frequency assumptions rely heavily on scenario analysis and expert judgment rather than actuarial triangles. Severity assumptions draw on analogies to technology E&O, media liability, and product liability, but generative AI introduces loss mechanisms that do not map cleanly onto any of those lines: hallucination-driven advice errors, deepfake defamation, automated discrimination at scale, and cascading failures when a single model update affects thousands of downstream users simultaneously.

The carriers that moved early into standalone AI liability are, in effect, writing first-mover premium at margins that compensate for uncertainty. As the loss data matures and as more carriers enter the market, combined ratios will compress toward equilibrium. But the actuaries pricing these products today are working with judgment-based frequency and severity assumptions that may prove conservative or optimistic by wide margins. This is the same position cyber actuaries occupied in 2015, and the parallel is not lost on the reinsurance market, where treaties covering AI liability are starting to appear in renewal discussions.

GL pricing adjustments: what the actuary should model

For actuaries responsible for GL rate indications, the CG 40 47 adoption cycle introduces several modeling considerations.

Loss load bifurcation. Once a book splits between policies with and without AI exclusions, the actuary needs separate expected loss assumptions for each segment. Policies with exclusions should carry a lower loss load, reflecting the removal of AI-related claims. Policies without exclusions should carry a higher load, potentially increasing over time as AI deployment grows and as the loss data begins to reflect AI-driven claim patterns. This bifurcation should be reflected in both the indicated rate level and the loss ratio selections used in the rate review.

Trend factor recalibration. Historical loss development triangles for GL do not isolate AI-related claims. As AI-related losses begin to emerge in the data, they will appear as an acceleration in loss development factors and potentially as an upward shift in frequency and severity trends. Actuaries should consider whether to build an explicit AI trend adjustment into their selections or to adjust the expected loss ratio directly. The former approach is more transparent and more defensible in rate filings.

Classification refinement. The current GL classification system does not distinguish between AI-heavy and AI-light insureds within the same SIC or NAICS code. A marketing firm that generates 80% of its content with AI tools and a marketing firm that uses no AI occupy the same rating class. As AI exclusions bifurcate the book, carriers may find that classification relativities need updating to reflect AI adoption intensity as a rating variable, subject to regulatory approval.

Vendor-embedded AI exposure. The most insidious pricing risk is vendor-embedded AI. Enterprise software from Salesforce, Microsoft, Google, HubSpot, and dozens of other vendors now includes generative AI features, often activated by default. An insured may not know it is “using” generative AI in the sense that triggers the exclusion. This creates adverse selection: sophisticated buyers who understand the exclusion will seek AI coverage elsewhere or self-insure; less sophisticated buyers may not realize they are exposed until a claim is denied. The pricing actuary needs to consider the selection dynamics that the exclusion creates within the rated book.

Excess and umbrella layer repricing. GL exclusions in the primary layer have implications for excess and umbrella carriers. If the primary policy excludes AI, and the excess or umbrella policy follows form, the excluded exposure passes through the entire tower. If the excess or umbrella policy does not follow form, it may silently retain AI exposure that the primary carrier has shed. This creates a potential for loss development in excess layers that the primary exclusion was designed to prevent. From reviewing several excess and umbrella wordings, the follow-form question on AI exclusions is not yet consistently resolved across the market.

The regulatory approval landscape

ISO endorsement filings are subject to state regulatory review. The pace of approval varies by state and by the nature of the filing. In states that use a file-and-use system, carriers can begin attaching the endorsement immediately upon filing, subject to later regulatory review. In prior-approval states, the endorsement cannot be used until the regulator grants approval.

As of April 2026, the ISO GL multistate filing that includes CG 40 47, CG 40 48, and CG 35 08 has been approved or is pending in the majority of states. No state has publicly rejected the AI exclusion endorsements outright, though several state regulators have requested additional information on the scope of the “arising out of” language and its potential impact on commercial policyholders.

Regulatory scrutiny is likely to intensify if AI exclusions proliferate without corresponding affirmative coverage options becoming widely available. The NAIC’s December 2023 model bulletin on AI already established a framework for insurer use of AI, and several states have adopted or adapted it. Colorado’s AI Act, with a compliance deadline of June 30, 2026, adds a state-level regulatory overlay that could interact with AI exclusion endorsements in unexpected ways. If a carrier is required by state law to avoid algorithmic discrimination but simultaneously excludes AI-related losses from its GL coverage, the regulatory tension is self-evident.

The NAIC’s broader interest in AI governance, including the 12-state AI evaluation pilot and the proposed third-party AI vendor registry, suggests that regulators may eventually push for standardized affirmative AI coverage options to accompany the exclusion endorsements. This would mirror the regulatory evolution in cyber, where state data breach notification laws and the NYDFS Cybersecurity Regulation helped shape the contours of standalone cyber coverage.

Reinsurance implications and treaty considerations

The AI exclusion cycle has implications beyond direct carrier pricing. Reinsurers that provide quota share, excess of loss, or clash cover on GL portfolios need to understand how AI exclusions change the risk profile of the ceded book.

A quota share treaty on a GL portfolio that has endorsed CG 40 47 across a substantial portion of its book is, in effect, reinsuring a portfolio that has shed its AI exposure. The reinsurer should see improved loss experience on the ceded book, but the reinsurer should also recognize that the excluded AI exposure may resurface in other forms: in standalone AI liability products, in tech E&O, or in coverage disputes on policies that remain silent on AI.

For excess of loss treaties, the question is whether AI-related losses concentrate in ways that could trigger clash or accumulation events. A single widely deployed AI model that generates defective output, such as a legal research LLM that hallucinates case citations across thousands of law firm clients, could generate correlated claims across multiple insureds simultaneously. Whether those claims fall within or outside the reinsured portfolio depends on the endorsement status of each underlying policy.

From discussions with reinsurance intermediaries, treaty wordings for 2026 and 2027 renewals are beginning to address AI-specific accumulation risk explicitly. Several reinsurers have proposed AI sublimits or AI-specific aggregate deductibles within GL treaties, paralleling the cyber sublimits that became standard treaty features around 2018 to 2019.

The pricing gap that creates a market

The core thesis is structural: CG 40 47 and its variants are not just risk management tools for individual carriers. Collectively, they represent a market-level repricing event that separates AI liability from the commercial GL cost of insurance. Patterns we have seen in previous exclusion cycles suggest a sequence that proceeds in roughly four phases.

Phase 1: Exclusion adoption (2026). ISO forms are available. Early adopters file. Sophisticated policyholders notice the exclusion and begin shopping for affirmative coverage. Less sophisticated policyholders remain unaware. Market penetration of the exclusion is uneven.

Phase 2: Coverage disputes and awareness (2026 to 2027). The first AI-related CGL claims hit policies endorsed with CG 40 47. Denials generate media coverage and broker activity. Policyholders who did not realize their GL policies excluded AI demand solutions. Standalone AI liability products gain distribution momentum.

Phase 3: Market consolidation (2028 to 2029). AI exclusions become standard across the majority of GL books. Standalone AI liability products mature from bespoke manuscript forms into semi-standardized products. Reinsurers develop dedicated AI liability treaty capacity. Loss data begins to accumulate, enabling actuarial pricing to move from judgment to experience.

Phase 4: Equilibrium (2030+). AI liability coverage is a recognized standalone line of business, priced on its own loss data, with its own classification system and its own regulatory framework. GL policies universally exclude AI, and the standalone market absorbs the demand. The cycle mirrors the cyber trajectory with an estimated four- to five-year lag.

The actuaries who will shape this market are the ones working the problem right now: building frequency and severity assumptions from scenario analysis, calibrating trend factors against an exposure base that is growing faster than the loss data, and designing classification systems for a risk that does not yet have its own line on the Annual Statement. This article is one element of a broader coverage of these developments. For actuarial analysis of the four affirmative coverage product architectures (Munich Re aiSure, Coalition, Armilla, and Vouch) and pricing inputs when loss history is thin, see our companion piece on the Verisk Gen AI Exclusion and P&C Liability Split.

Why this matters for actuaries

The CG 40 47 endorsement cycle is one of those inflection points where form-level changes in policy wording cascade through the entire actuarial workflow. Rate indications, trend selections, classification relativities, reinsurance treaty structures, and reserve assumptions all need to account for the bifurcation between AI-excluded and AI-silent GL policies.

For pricing actuaries, the immediate task is quantifying the loss load differential. For reserving actuaries, the task is anticipating how AI-related claims will develop in the historical data and whether separate development patterns are needed for AI-excluded versus non-excluded segments. For enterprise risk management actuaries, the question is how correlated AI exposure concentrates across lines and whether the exclusion in GL simply migrates the aggregation risk to tech E&O, D&O, or cyber.

The actuaries best positioned to handle this transition are those who remember the cyber exclusion cycle and can apply its lessons without assuming that AI will follow the same trajectory in every detail. The risk characteristics differ: cyber losses tend to be high frequency, moderate severity, and correlated through shared technical infrastructure. AI losses, when they emerge at scale, may be low frequency, high severity, and correlated through shared model architectures. A single foundation model error that propagates across thousands of commercial deployments produces a correlation structure that looks more like catastrophe risk than like traditional liability risk.

From an ASOP compliance perspective, ASOP No. 12 (Risk Classification) and ASOP No. 29 (Expense Provisions in Property/Casualty Insurance Ratemaking) both have direct bearing on how actuaries document AI-related pricing assumptions. ASOP No. 56 (Modeling) applies to any scenario-based AI loss modeling. Actuaries filing rate indications that reflect AI exclusion adjustments should document the basis for the adjustment, the data or judgment used, and the sensitivity of the indication to changes in AI adoption assumptions.

This continues a trend we have been tracking across multiple dimensions: the insurance industry does not absorb new technology risk by ignoring it. It absorbs new technology risk by first excluding it, then studying it, then pricing it as a standalone product. The AI exclusion cycle has entered its first phase. The pricing gap between excluded and covered AI liability is the market signal that standalone AI insurance is no longer optional.