ISO AI Exclusions: Understanding New Coverage GapsAI has become an insurance coverage issue. As businesses embed AI applications into their operations, they take on new liabilities, and insurers are responding. New ISO AI exclusions give carriers a way to restrict coverage for certain generative AI exposures, making it increasingly important for businesses to understand how their policies address AI-related risks.
Key Takeaways
- New ISO exclusions are changing how commercial policies address generative AI.
- AI exclusions can create unexpected coverage gaps.
- An AI exclusion does not necessarily mean that a business has no AI coverage.
- AI insurance is beginning to follow a path similar to cyber insurance.
- Businesses should prepare for AI risk conversations prior to renewal.
Learn more about AI liability insurance and generative AI risk.
Why Are Insurers Concerned About Generative AI?
Generative AI tools have impressive capabilities, but they are not flawless. AI-related liabilities do not fit into a single category, but they may include:
- Generative AI tools can fabricate information, which can result in liabilities when businesses use these tools to draft documents, generate reports or communicate with customers.
- Unauthorized AI agent actions. AI agents sometimes take actions outside of the rules designed to control them, resulting in data loss or other adverse events.
- Data leakage. Sensitive information fed into AI tools may be exposed through data breaches, prompt injection attacks and other incidents.
- IP allegations. Generative AI outputs may closely resemble the intellectual property used in training, leading to claims of infringement. There is also concern that AI outputs may not have the benefit of intellectual property protection.
- AI tools can produce biased outputs when the training data reflects existing biases. This can lead to problems when AI tools are used in sensitive decisions, such as employment-related decisions.
- Regulatory violations. Evolving regulations are creating a complex compliance landscape, and AI tools may run afoul of rules governing data privacy, employment practices and other domains.
- Bodily injury and property damage. When AI tools are used to control physical systems, errors can trigger physical damage.
What Is “Silent AI” Coverage?
Silent AI coverage occurs when insurance policies do not include terms related to generative AI, either to affirm or bar coverage. This can result in unclear coverage and may trigger insurance disputes.
A precedent exists in silent cyber coverage. Before the internet became a mainstay of business operations, insurance carriers had little reason to include language related to cyber losses in their policies. Then a wave of cyberattacks and data breaches triggered insurance losses. Some of these losses were covered under commercial general liability policies because these policies were silent on the matter, neither affirming nor barring coverage. However, this changed quickly as insurers added exclusions. Today, many cyber-related exposures are addressed through standalone cyber policies instead of standard commercial general liability insurance.
We are beginning to see a similar pattern with silent AI coverage. Before the rise of generative AI tools, insurers did not need to mention AI-related losses. Now that AI losses are becoming a greater threat, this silence is leading to coverage questions. Insurers are now moving to clarify coverage.
What’s Included in the New ISO Generative AI Exclusions?
As reported by the Intelligence Council, the Insurance Services Office (ISO) has rolled out three new generative AI exclusions. Insurance carriers can add these exclusions to the relevant insurance policies to clarify and restrict coverage for AI-related risks.
The ISO is an organization that develops standardized policy language. Insurance carriers can use ISO forms and endorsements to provide standardized insurance coverage. This means that the new ISO exclusions are not limited to a single carrier. Instead, they signify a wider trend in the insurance industry to clarify AI coverage.
- CG 40 47 applies to Coverage A (bodily injury and property damage liability) and Coverage B (personal and advertising injury) and removes coverage for claims arising out of generative AI.
- CG 40 48 applies to Coverage B only and removes coverage for claims arising out of generative AI.
- CG 35 08 applies to Products and Completed Operations coverage and removes coverage for bodily injury or property damage arising out of generative AI.
For business leaders, having a new AI exclusion added to a policy isn’t necessarily a problem. However, it can become an issue if the exclusion creates a coverage gap between the organization’s actual AI exposures and the insurance coverage in place.
What Could an AI Exclusion Mean in a Real-World Claim?
If a loss falls within an AI exclusion and the company has no other applicable coverage, the company may have to absorb defense costs, settlements, judgments and other expenses.
Consider the following scenarios:
- A company uses a generative AI tool to create marketing materials. A competitor then sues over allegations that one of the marketing pieces is defamatory against their business. Although commercial general liability insurance could typically provide coverage for a defamation claim, a generative AI exclusion means that coverage is not available, and the company has to organize and pay for its defense without the benefit of insurance.
- A piece of AI-controlled equipment causes significant property damage. Although malfunctions might otherwise be covered under the company’s policy, a generative AI exclusion bars coverage for this loss.
- An AI-enabled medical device causes injury to users, resulting in multiple lawsuits. Although the company has coverage for injuries caused by products, an AI exclusion could mean that these lawsuits are not covered.
In all cases, whether or not coverage exists will depend on the actual wording of the policy and the facts of the loss. However, these scenarios show how AI exclusions could bar coverage that might otherwise apply.
Does an AI Exclusion Mean a Business Has No AI Coverage?
An AI exclusion does not necessarily mean that a business has no AI coverage. The addition of an AI exclusion simply means that one policy bars or restricts coverage in a specific scenario. The policy may provide coverage for AI-related losses in other scenarios, and the business may have coverage for AI-related losses through other policies.
For example, a commercial general liability insurance policy that uses CG 40 48 may still offer coverage for AI-related property damage or bodily injury losses. Carriers may also use endorsements other than the three new ISO exclusions, and these endorsements may be more or less restrictive.
Furthermore, a company that does not have AI coverage through a general liability insurance policy may have coverage through an EPL, D&O, professional liability, tech E&O, cyber or standalone AI policy.
To determine whether coverage exists for a specific loss, you need to look at the company’s entire insurance program, not just a single clause in one policy.
Standalone AI Insurance Could Help Fill Coverage Gaps
A standalone AI policy is an emerging type of specialty coverage designed specifically to cover certain AI-related risks.
According to the Geneva Association, more than 90% of businesses want generative AI insurance coverage. As some insurance carriers reduce coverage in traditional policies with the addition of new exclusions, other carriers are developing new products to fill in the generative AI coverage gaps. This is similar to what we saw with the rise of cyber exposures, the emergence of cyber exclusions, and the development of standalone cyber insurance policies.
Explore Heffernan’s guide to AI liability insurance.
5 Questions to Ask Before Your Next Insurance Renewal
The AI insurance coverage landscape is evolving quickly. Assess your needs ahead of your next renewal by asking five questions.
- Where and how is our organization using generative or agentic AI?
- Which existing policies could potentially respond to those exposures?
- Have any AI-specific exclusions or endorsements been added?
- Do our AI vendors create contractual or insurance gaps?
- Would specialty AI coverage address exposures our current program doesn’t?
How to Prepare for AI Insurance Underwriting
As AI risks mount, insurance carriers offering AI coverage will be increasingly invested in strong underwriting. This is true whether you’re securing a standalone AI policy or another policy that provides coverage for some AI-related losses.
You can prepare for AI insurance underwriting by:
- Maintaining an AI inventory of all the AI tools you use and how exactly you use them.
- Establishing acceptable-use policies for all employees, so they know exactly how and when they can use AI and what their responsibilities are when using AI.
- Identifying approved tools for employees and prohibiting them from using unapproved tools that may create additional exposures.
- Assessing third-party AI vendors to determine what AI tools they use, what exposures these AI tools represent and who is liable for AI-related losses.
- Establishing data and privacy controls for AI tools to protect information that is fed into an AI program as well as information that AI programs may collect.
- Documenting AI governance thoroughly to show what controls are in place at all levels.
- Being prepared to explain use cases and controls to underwriters.
Don’t Wait Until a Claim to Find Out How Your Policy Treats AI
Companies that are adopting AI tools are also adopting a new collection of exposures. An insurance broker who is familiar with current developments in the AI liability landscape can help you navigate these exposures with confidence.