Business Law Guidance on AI Risk and Insurance Coverage
Updated: 8 hours ago
Artificial intelligence is now embedded in day-to-day business operations. Companies rely on AI tools for document review, forecasting, customer interactions, analytics, marketing, and internal decision-making. What many business owners do not realize is that their insurance coverage may not align with how these tools are actually being used. Business Law Guidance on AI Risk requires companies to review both contractual risk allocation and the insurance policies that may respond when an AI-related loss occurs.
In practice, this misalignment often comes to light only after a problem arises. A claim is submitted, expectations are high, and the response from the insurer is more limited than anticipated. At that point, the issue is no longer theoretical.
Todd B. Nurick is a Pennsylvania and New York business attorney and Fractional and Outside General Counsel. Through the Law Office of Todd B. Nurick, he advises companies on contracts, artificial intelligence, technology, governance, compliance, insurance-related risk allocation, and other business risks arising from emerging technologies.
Business Law Guidance on AI Risk
Insurance policies are written around defined categories of risk. Artificial intelligence does not always fit neatly within those categories, particularly when policies were drafted before AI became a routine business tool.
AI-related losses can implicate multiple coverage areas, including cyber insurance, professional liability/errors and omissions coverage, commercial general liability, and directors and officers insurance. Coverage analysis ordinarily turns on the particular claim, insuring agreement, definitions, exclusions, endorsements, causation, and other policy language.
Cyber Insurance Is Not a Catch-All
Many businesses assume that if AI is involved in a data issue, cyber insurance will apply. That assumption is not always correct.
Cyber policies are typically designed around unauthorized access, security breaches, or defined privacy events. If an AI system mishandles data due to improper configuration, flawed training data, employee misuse, or reliance on automated output rather than a traditional breach, coverage may be contested.
The insurance market is also beginning to address AI expressly. In 2026, ISO/Verisk generative-AI exclusion endorsements became available for commercial general liability policies, including forms that can exclude certain bodily injury, property damage, and personal and advertising injury arising from generative AI. Whether any such exclusion applies depends on the actual policy and endorsements issued by the carrier, so businesses should review renewal documents rather than assume AI-related losses are covered or excluded.
Professional Liability Coverage Has Its Own Limits
Companies that rely on AI for analysis, recommendations, or client-facing work often expect professional liability or errors and omissions coverage to apply if something goes wrong.
Professional liability and errors and omissions coverage varies materially by policy. Definitions of covered professional services, technology-related exclusions, third-party-vendor provisions, causation requirements, and endorsements can all affect whether an AI-related claim is covered. Businesses should therefore review the actual policy language rather than assume that the presence of an AI tool either creates or eliminates coverage.
From a business law perspective, this is where business law guidance on AI risk becomes essential. The question is not just whether a loss occurred, but how the policy defines responsibility and causation.
Directors and Officers Exposure Is Increasing
AI risk can also become a governance issue when directors and executives make decisions about deployment, oversight, internal controls, compliance, or responses to known problems involving AI systems.
D&O coverage may become relevant when claims are directed at directors or officers for alleged failures of oversight or decision-making, but coverage depends on the nature of the claim and the particular policy language, including exclusions and other limitations.
Vendor Contracts Can Create a False Sense of Security
Another common assumption is that an AI vendor will bear the risk if something goes wrong. In practice, many AI vendor agreements aggressively limit liability, disclaim responsibility for outputs, and shift risk back to the customer.
When vendor protections are thin and insurance coverage is uncertain, businesses can find themselves exposed on multiple fronts. This is a recurring issue in contract reviews and transactions involving AI-driven tools.
Practical Business Law Guidance on AI Risk for Companies
Managing AI-related insurance risk does not require abandoning technology. It does require intentional planning.
From a business law standpoint, companies should consider:
Identifying where AI is actually used across the organization
Reviewing insurance policies with AI use specifically in mind
Coordinating legal, insurance, and technology discussions
Evaluating vendor contracts for risk-shifting provisions
Updating internal policies governing AI use
Documenting oversight and decision-making processes
These steps are about alignment, not alarm.
Final Thoughts
AI is evolving faster than insurance policy language. That gap is where unexpected exposure tends to surface. Businesses that assume coverage exists without confirming how policies apply to AI use may be taking on risk they did not intend.
About Todd B. Nurick
Todd B. Nurick is a Pennsylvania and New York business attorney and Fractional and Outside General Counsel. Through the Law Office of Todd B. Nurick, he advises companies on contracts, technology, artificial intelligence, corporate governance, compliance, insurance-related risk allocation, and other legal issues affecting business operations.
Sources
National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0) https://www.nist.gov/itl/ai-risk-management-framework
National Association of Insurance Commissioners, Artificial Intelligence – Insurance Topics https://content.naic.org/insurance-topics/artificial-intelligence
Federal Trade Commission, Artificial Intelligence Resources and Enforcement https://www.ftc.gov/industry/technology/artificial-intelligence
Federal Trade Commission, AI Companies: Uphold Your Privacy and Confidentiality Commitments https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/01/ai-companies-uphold-your-privacy-confidentiality-commitments
Insurance Journal, Insurer Interest in AI Coverage Exclusions Growing as Risk Expands https://www.insurancejournal.com/magazines/mag-features/2026/08/17/881424.htm
Gallagher, ISO Introduces Generative AI Exclusion in Commercial General Liability Policies https://www.ajg.com/news-and-insights/iso-introduces-generative-ai-exclusion-in-commercial-general-liability-policies/
NIST expressly treats AI governance, mapping, measurement and management as organizational risk-management functions, while the NAIC continues to track AI developments in insurance.
This article is for general informational purposes only and does not constitute legal advice. Insurance coverage and legal issues involving artificial intelligence, technology, contracts, corporate governance, and risk allocation depend upon the particular facts, policy language, jurisdiction, and applicable law. Reading this article does not create an attorney-client relationship.
This article is for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Businesses should obtain legal advice concerning their particular circumstances.
