Insurance When AI Agents Are the Decision-Makers - The National Law Review

The rising use of AI agents across healthcare will inevitably produce claims when those agents make the wrong call. The question that lands on the risk manager’s desk is which policy responds. Until recently, policyholders could reasonably assume that AI risks were folded into their existing insurance program. The market is moving quickly to change that, and insureds now need to confirm rather than assume.

The Quick Death of Silent AI Coverage

When a new threat vector emerges, existing standard forms often cover it. General liability policies broadly insure “occurrences.” D&O policies broadly insure “wrongful acts.” Those broad grants pick up new and unforeseen risks in the absence of a specific exclusion. That is how “silent cyber” coverage arose — cyber losses were covered because nothing excluded them. The industry eventually responded with the interlocking network of cyber exclusions and dedicated cyber products in place today. The same pattern is now repeating with AI on a much faster timeline.

AI is the vector, but the underlying injuries are not new. An AI transcription tool malfunctions, and the wrong dosage is ordered. An AI agent misreads a chart, and the wrong diagnosis is recommended. These are ordinary healthcare claims that do not change in substance because AI was involved, and absent a specific exclusion they should remain covered.

Insurers are working quickly to foreclose that argument. In January 2026, the Insurance Services Office, Inc. (ISO) published generative-AI endorsements for commercial general liability policies. CG 40 47 excludes bodily injury, property damage, and personal and advertising injury arising out of generative AI under both Coverage A and Coverage B. CG 40 48 excludes only Coverage B. CG 35 08 applies the exclusion to the products and completed operations coverage part. Many leading insurers have filed to adopt these forms.

The trend extends well beyond CGL. Berkley has introduced an “absolute” AI exclusion denying coverage for any claim “arising out of, or attributable to” “any actual or alleged use, deployment, or development of Artificial Intelligence by any person or entity[.]” Philadelphia Insurance has drafted an exclusion to its Integrated Technology E&O and Cyber Risk Coverage Form carving out content created for a third party using “generative artificial intelligence” in the performance of services. Hamilton Select Insurance Co. has a professional liability endorsement excluding claims “based upon, arising out of, or in any way involving any actual or alleged use of generative artificial intelligence by the insured.”

These forms are the leading edge rather than the whole of it, and as such endorsements proliferate alongside AI adoption, unwary insureds may find previously covered risks excluded at the next renewal. Breadth cuts both ways, however. Definitions written sweepingly enough to capture predictive text and long-standing clinical software invite the argument that the exclusion is ambiguous — and ambiguity is construed against the insurer.

An Example

An AI-powered scribe hallucinates a critical note from a patient consult. The physician does not catch it, and the patient is fatally misdiagnosed. Which policies respond?

- Professional liability

This is the obvious first answer. These policies cover professional services rendered by the insured. If the physician read the AI-generated note and simply missed the hallucination, this is an ordinary malpractice claim and the professional liability policy should respond. But what if the human element drops out, and the hallucinated transcription auto-populates a prescription order or triggers autonomous triage in the emergency department? If direct human error is taken out of the equation, is it still a covered professional liability claim? Knowing the precise language of your policy is critical. An AI exclusion should not be discovered for the first time after a claim is made.

- CGL

Your CGL policy excludes professional services, so expect little help here. With the rise of the AI exclusions discussed above, these claims are now barred on two fronts.

- Cyber

Cyber policies are built for security and privacy events — a data breach or a failure of network security — not isolated system failures like an AI hallucination. But cyber wordings vary far more than CGL forms. One policy may restrict these claims while a broader coverage grant responds, even if the insurer believes it was never intended for that kind of loss.

- Your vendor’s E&O

Your AI vendor may also be on the hook. This is worth exploring immediately after any AI-related claim, since an E&O policy issued to an AI vendor presumably does not exclude losses caused by AI. Access is harder than tapping your own program, though, and recovery may be capped by limitation-of-liability provisions in your contract.

What a Risk Manager Can Do Today

- Determine precisely where and how your organization uses AI — and where your vendors and clients use it.

- Pull the endorsement schedules for your general liability, professional liability, cyber, and D&O policies and identify any AI-specific definitions, exclusions, or sublimits.

- Watch for AI-related questions on insurance applications. Failing to describe your organization’s AI usage accurately could hand the insurer a rescission argument when a serious claim arrives.

- Get an affirmative answer from your insurer. Does it accept “silent” AI coverage, or is it pushing coverage into specific AI grants and endorsements?

AI risk grows every day, and the insurance market’s response will keep shifting as insurers work to price these new threat vectors. Putting your head in the sand and hoping for the best is not a solution. Risk managers should take affirmative steps to understand the scope of their AI coverage and align their program with their organization’s expanding use of AI.