The Short Answer: Liability Follows Control, Not Code
When an AI agent—whether a customer-service chatbot, an autonomous contract negotiator, or a claims-adjusting algorithm—causes harm, the law does not treat the software as a person. Instead, liability attaches to the human or corporate actors who designed, deployed, or failed to supervise the system. This is not a novel legal fiction; it is the same principle that governs liability for employees, pets, and defective products. The operator of the AI agent is generally treated as the principal, and the AI agent as an instrumentality. If the AI agent acts within the scope of its programmed tasks, the operator is vicariously liable for the resulting harm. If the AI agent acts outside that scope—say, by executing a prompt injection attack or making an unauthorized purchase—the question becomes whether the operator was negligent in failing to anticipate and prevent that behavior. Courts and regulators are increasingly looking to existing tort law, contract law, and product liability doctrines, rather than creating a new "AI personhood" exception.
Also worth reading: What is AI legal broker liability insurance and how does it protect technology intermediaries? · What are the current benchmarks for agentic AI liability insurance in 2026? · What is the standalone AI liability insurance market and how does it work in 2026?
This means that "AI agent liability insurance" is not a magic shield. It is a specialized form of professional liability or cyber liability coverage that responds to claims arising from the use of AI agents. The insurance market has responded to this need with products like HSB's AI Liability Insurance for small businesses, launched in 2023, and Corgi's AI liability coverage, which targets law firms and other professional services. These policies typically cover third-party bodily injury, property damage, and personal injury caused by AI systems, as well as defense costs. However, they are not uniform. Some policies exclude "intentional acts" by the AI, which is a problematic concept because AI does not have intent. Others exclude "algorithmic bias" claims, which are precisely the claims that civil rights advocates are most concerned about. The result is a patchwork of coverage that requires careful reading and often negotiation.
The practical takeaway is that you cannot simply buy an AI liability policy and assume you are protected. You must understand the underlying legal exposure, which is determined by your role in the AI lifecycle. If you are a developer, you may be liable for design defects. If you are a deployer, you may be liable for negligent supervision. If you are a user, you may be liable for misuse. Each role carries different risks, and each requires different insurance endorsements. The rest of this article will break down the legal framework, the insurance products, and the steps you should take to protect yourself.
The Legal Framework: How Courts Assign Liability for AI Agents
The foundational principle in AI liability is that the law does not recognize AI as a legal actor. As the Duke Law School article "Legal Liability and Agentic AI" explains, courts will likely apply established doctrines like negligence, strict product liability, and breach of warranty. In a negligence claim, the plaintiff must show that the defendant owed a duty of care, breached that duty, and caused harm. With AI, the duty of care is often defined by industry standards, such as the NIST AI Risk Management Framework or the EU AI Act's requirements. A breach occurs when the developer or deployer fails to meet those standards—for example, by not testing for bias or not implementing human oversight. Causation is often the hardest element, especially when the AI agent's decision is opaque. However, courts have begun to accept "loss of chance" or "increased risk" theories in medical AI cases, which lowers the causation bar.
Strict product liability is another avenue, particularly for AI systems that are sold as products. Under Section 402A of the Restatement of Torts, a seller is liable for a defective product that causes harm, regardless of fault. But AI is not a physical product; it is software. Some courts have extended product liability to software, especially when it is embedded in a device like a car or a medical device. The key question is whether the AI's "defect" is a design defect or a failure to warn. Design defects are difficult to prove because they require showing that a safer alternative design existed. Failure to warn claims are more common, as plaintiffs argue that the developer did not disclose known limitations or risks. For example, if an AI agent hallucinates legal citations and a lawyer relies on it, the lawyer may have a claim against the developer for failure to warn about the hallucination risk.
Another emerging doctrine is "negligent entrustment," which applies when a party provides a dangerous instrument to someone who is likely to misuse it. If a company deploys an AI agent to interact with vulnerable populations—like the elderly or children—without adequate safeguards, a court might find negligent entrustment. This is analogous to giving a car to a drunk driver. The key is foreseeability. If the AI agent's behavior was reasonably foreseeable, the deployer is liable. If it was not, the deployer may escape liability, but the developer might be liable for not warning about the risk.
Finally, there is the question of "agency" in the legal sense. An AI agent is not a legal agent, but the law may treat it as such if the principal has authorized the AI to act on its behalf. This is the basis for vicarious liability. If an AI agent enters into a contract, the principal is bound by that contract, even if the AI exceeded its authority, as long as the third party reasonably believed the AI had authority. This is the same rule that applies to human agents. The result is that you cannot disclaim liability by saying "the AI did it." You are the principal, and you are responsible.
The Insurance Market: What AI Agent Liability Policies Actually Cover
The insurance industry has been slow to catch up with AI, but the last two years have seen a flurry of new products. HSB, a Munich Re company, introduced AI liability insurance for small businesses in 2023. This policy covers third-party bodily injury, property damage, and personal injury caused by AI systems, including chatbots, robots, and drones. It also covers defense costs, which can be substantial even if the claim is groundless. The policy is designed for businesses that use AI in their operations, not for AI developers. It is an add-on to a general liability policy, not a standalone product.
Corgi, a startup that focuses on law firms, launched AI liability insurance in 2024. This policy is tailored to the legal profession and covers claims arising from the use of AI in legal work, such as drafting documents, conducting research, or predicting case outcomes. It includes coverage for professional negligence, which is not typically covered by general liability policies. Corgi's product is notable because it addresses the specific risk of "AI hallucination" in legal contexts, where an AI generates a fake case citation. The policy also covers "algorithmic bias" claims, which is rare in the industry.
However, the market is still immature. A 2025 Bloomberg Law News article reported that many commercial general liability (CGL) policies now contain AI exclusions, which means that if you rely on a standard CGL policy, you may have no coverage for AI-related claims. These exclusions were introduced by insurers to avoid covering "cyber" risks that they did not price for. The result is a coverage gap that policyholders are only now discovering. For example, if an AI agent causes a data breach, the CGL policy may exclude it, and the cyber policy may exclude it because it was caused by an AI agent. This is the "silent AI" problem, analogous to the "silent cyber" problem that plagued the industry a few years ago.
To address this, insurers are beginning to offer AI-specific endorsements. For example, some cyber insurers now offer "AI liability" endorsements that cover claims arising from the use of AI, including defamation, copyright infringement, and privacy violations. These endorsements are often limited to "third-party" claims, not first-party losses. First-party losses, such as business interruption caused by an AI failure, are rarely covered. You may need a separate "AI business interruption" policy, which is still rare.
The cost of AI liability insurance varies widely. HSB's product is priced as a percentage of your general liability premium, typically 10-20% more. Corgi's product is priced based on the size of the law firm and the number of AI tools used, with premiums ranging from $1,000 to $10,000 per year. Larger enterprises with significant AI deployments may pay six-figure premiums. The market is still developing, so prices are not standardized. It is essential to shop around and compare policies, but also to read the fine print.
Practical Steps: How to Assess Your AI Liability Exposure and Buy the Right Coverage
The first step is to conduct an AI risk assessment. This involves identifying all AI agents in your organization, what they do, and what harm they could cause. For each AI agent, consider the following: (1) What data does it use, and is that data accurate and unbiased? (2) What decisions does it make, and are those decisions subject to human review? (3) What third parties could be harmed by its actions? (4) What is the likelihood and severity of that harm? This assessment will help you determine the types of coverage you need. For example, if your AI agent makes medical recommendations, you need professional liability coverage. If it handles customer data, you need cyber liability coverage. If it interacts with the public, you need general liability coverage.
Second, review your existing insurance policies for AI exclusions. Many CGL policies now have an exclusion for "AI systems" or "autonomous systems." If you find such an exclusion, you need to either negotiate its removal or purchase a separate AI liability policy. The same applies to cyber policies. Some cyber policies exclude "AI-related claims" because they are considered "professional services" or "technology errors." You should ask your broker to identify these exclusions and explain their impact.
Third, consider purchasing a standalone AI liability policy if your exposure is significant. As of 2026, there are only a handful of insurers offering these policies, including HSB, Corgi, and a few Lloyd's syndicates. When comparing policies, look for the following features: (1) Coverage for "algorithmic bias" claims, which are likely to increase as regulators enforce anti-discrimination laws. (2) Coverage for "defense costs" outside the limit of liability, which is critical because defense costs can exceed the settlement amount. (3) Coverage for "regulatory defense" and "fines and penalties" where legally insurable. (4) Coverage for "first-party" losses, such as business interruption or data restoration, which are often excluded. (5) A "duty to defend" clause, which means the insurer pays for your defense even if the claim is groundless.
Fourth, implement risk mitigation measures that will make you a better insurance risk. Insurers are more likely to offer coverage and lower premiums if you have a robust AI governance framework. This includes: (1) Human oversight of all high-risk AI decisions. (2) Regular testing for bias and errors. (3) A documented incident response plan. (4) Compliance with industry standards like ISO 42001 or the NIST AI RMF. (5) Training for employees who interact with AI agents. These measures not only reduce your risk but also demonstrate to insurers that you are a responsible policyholder.
Finally, work with a broker who specializes in AI liability. The market is complex and evolving, and a generalist broker may not be aware of the latest products or exclusions. A specialist broker can help you compare policies, negotiate terms, and ensure that you are not underinsured. They can also help you understand the legal landscape, which is changing rapidly as courts issue new rulings and regulators propose new rules.
Comparison of AI Liability Insurance Options (2026)
| Feature | HSB AI Liability | Corgi AI Liability | Traditional CGL + Cyber Endorsement |
|---|---|---|---|
| Target buyer | Small businesses using AI | Law firms and professional services | Any business with AI exposure |
| Coverage trigger | Third-party bodily injury, property damage, personal injury | Professional negligence, algorithmic bias, hallucination | Varies; often excludes AI unless endorsed |
| Defense costs | Included, but may be sub-limited | Included, outside limit | Usually included, but may be eroded by settlement |
| Algorithmic bias coverage | Not explicitly covered | Covered | Rarely covered |
| First-party losses | Not covered | Not covered | Not covered |
| Premium range | 10-20% of GL premium | $1,000-$10,000/year | Varies; endorsement may add 5-15% |
| Availability | Available in most states | Limited to certain states | Widely available, but with exclusions |
| Best for | Businesses with physical AI (drones, robots) | Law firms using AI for legal work | Businesses that want to fill gaps in existing policies |
Common Mistakes to Avoid When Buying AI Agent Liability Insurance
The most common mistake is assuming that your existing policies cover AI. As noted, many CGL policies now have AI exclusions, and even if they do not, they may not cover the specific types of claims that AI agents generate. For example, a CGL policy covers "bodily injury" and "property damage," but it does not cover "professional negligence" or "intellectual property infringement." If your AI agent provides advice that leads to a financial loss, you may have no coverage under a CGL policy. You need a professional liability policy or an AI-specific policy.
The second mistake is failing to disclose your AI use to your insurer. Insurance applications often ask about "autonomous systems" or "AI." If you do not disclose, the insurer may deny coverage later on the grounds of misrepresentation. This is a common issue in the cyber insurance market, where policyholders have been denied coverage for failing to disclose their use of AI. Be transparent about your AI use, even if it increases your premium.
The third mistake is relying on the insurer's definition of "AI." Many policies define AI narrowly, such as "a system that uses machine learning to make decisions." If your AI agent is a simple rule-based system, it may not be covered. Conversely, if your AI agent is a large language model that is constantly updated, it may fall outside the definition because it is not "autonomous" in the traditional sense. Read the definition carefully and ask your broker to clarify.
The fourth mistake is ignoring the "intentional acts" exclusion. Many policies exclude coverage for "intentional" acts by the AI. But AI does not have intent. If an AI agent makes a decision that is later deemed "intentional" because it was programmed to achieve a certain outcome, the insurer may deny coverage. This is a gray area that has not been tested in court. To avoid this, look for a policy that covers "negligent acts" and "errors and omissions" rather than "intentional acts."
The fifth mistake is not considering the "chain of liability." If you use a third-party AI vendor, you may have a claim against the vendor, but you also have a duty to defend yourself. Your insurance policy should cover your defense costs, even if you are not ultimately liable. Some policies have a "duty to defend" that is broader than the coverage. Make sure your policy includes this.
When to Act: Timing Your AI Liability Insurance Purchase
The best time to buy AI liability insurance is before you deploy an AI agent, not after. Once a claim occurs, it is too late to buy coverage. As of August 2026, the market is still relatively open, but insurers are becoming more cautious. A 2025 report from McKinsey noted that AI could break the insurance industry's two-decade growth stalemate, but it also warned that insurers are wary of the uncertainty. This means that premiums may rise as more claims are filed. If you are planning to deploy an AI agent in the next 12 months, you should start the insurance process now. This gives you time to assess your exposure, compare policies, and negotiate terms.
Another trigger is a change in your AI use. If you are expanding from a simple chatbot to an autonomous agent that can make purchases or sign contracts, you need to update your coverage. The same applies if you are entering a new jurisdiction, as some states have specific AI regulations that affect liability. For example, Colorado's AI Act, which takes effect in 2026, imposes duties on developers and deployers of high-risk AI systems. If you operate in Colorado, you may need additional coverage to comply with the law.
Finally, consider the "nuclear verdict" risk. A 2025 article in Insurance Business noted that "nuclear verdicts"—jury awards over $10 million—are increasing in AI-related cases. This is because plaintiffs often argue that AI is "unreasonably dangerous" and that the defendant acted with "reckless disregard." To protect against such verdicts, you need high limits of liability, typically $1 million or more. Some insurers offer "excess AI liability" policies that provide additional limits above your primary policy. These are especially important for companies with significant assets.
In summary, the time to act is now. The legal and insurance landscape is evolving, and the longer you wait, the more expensive and restrictive coverage will become. By taking proactive steps to assess your risk, review your policies, and purchase appropriate coverage, you can protect your business from the financial devastation of an AI-related claim.
The Future of AI Agent Liability Insurance
The future of AI agent liability insurance is likely to be shaped by regulation. The EU AI Act, which came into force in 2024, imposes strict liability on providers of high-risk AI systems. This means that if an AI system causes harm, the provider is liable regardless of fault. The Act also requires mandatory insurance for certain AI systems, similar to the auto insurance model. In the United States, there is no federal AI law, but several states have enacted their own. For example, California's AI Transparency Act requires disclosure of AI use, and New York's AI Bias Law prohibits algorithmic discrimination. These laws create new liability exposures that may not be covered by existing policies.
Another trend is the development of "AI legal services brokers" like lawr.io, which help clients navigate the complex intersection of AI and law. These brokers can provide guidance on liability, insurance, and compliance. They are particularly useful for small and medium-sized businesses that do not have in-house legal counsel. As AI becomes more pervasive, the demand for such services will grow.
Finally, the insurance industry itself is using AI to underwrite and price policies. This creates a feedback loop: AI is used to assess the risk of AI. This could lead to more accurate pricing, but it also raises concerns about algorithmic bias in insurance. Regulators are watching this closely, and we may see new rules governing the use of AI in insurance underwriting.
In conclusion, AI agent liability insurance is not a panacea, but it is an essential tool for managing the risks of AI. By understanding the legal framework, the insurance market, and the practical steps to protect yourself, you can make informed decisions that safeguard your business. The key is to be proactive, not reactive. The law is still developing, but the principles are clear: you are responsible for your AI agents, and you need insurance to cover that responsibility.