The Shift the Market Is Misreading

The insurance industry is not making a statement about whether AI is safe. It is making a statement about whether AI loss is measurable. The Capgemini Research Institute's World Property and Casualty Insurance Report 2026 found that 42% of insurers track no AI metrics at all, that 60% of the industry remains in the exploration or proof of concept stage, and that only 10% are successfully scaling AI (Capgemini, May 2026). An industry that cannot measure its own AI outcomes cannot model anyone else's AI losses. Underwriters facing an exposure they cannot price have two options, and pricing it is not one of them.

The loss data they do hold is moving in one direction. The Q2 2026 AI Disputes Monitor recorded 42 new AI-related lawsuits filed between April and June, a 35% quarterly increase, putting the year on pace to more than double the previous year's filings (J.S. Held, July 2026). The organizations that would be defending those claims are largely undefended on paper. IBM and the Ponemon Institute found that 68% of breached organizations had no policy governing AI use at all (IBM, 2026). That is the shift. Carriers repriced AI risk in a single quarter while buyers were still selecting frameworks, and the instrument they used answers to no compliance calendar.

What Underwriting Scrutiny Actually Requires

Three mechanics separate an insurance exclusion from a regulatory obligation, and none of them behave the way a compliance function expects.

• The exclusion attaches to the presence of AI, not to its causal role. The standard endorsements turn on whether a claim arises out of generative artificial intelligence, language that courts have historically read broadly. A defamation claim over AI-assisted marketing copy, an infringement claim over a generated image, a product claim where an AI recommendation sat somewhere in the chain of events: each can fall outside coverage without AI being the proximate cause (Fenwick, June 2026). Rising claim volume is what makes that breadth consequential rather than theoretical, and second-quarter filings ran 35% above the quarter before (J.S. Held, July 2026). The test is not whether AI caused the loss. It is whether AI was in the room.

• The trigger is a renewal date, not a compliance deadline. AI risk is now a distinct underwriting category, which means closer scrutiny at renewal for any organization that uses AI directly or through its vendors (Lathrop GPM, May 2026). Most organizations will arrive at that conversation empty-handed. Beyond the 68% with no AI policy, five of the six governance controls IBM measured in consecutive years lost adoption rather than gaining it, and only 19% of organizations reported their governance and security teams working together (IBM, 2026). A regulator opens with a notice and a response window. An underwriter opens with a quote.

• Carriers are excluding what they cannot yet measure, which makes measurement the way back in. The Capgemini finding explains the retrenchment better than any theory about AI danger: an industry with no AI metrics of its own has no loss frequency, no severity curve, and no correlation data (Capgemini, May 2026). Cyber insurance traveled this exact arc, from silent exposure to explicit exclusion to affirmative endorsements to control-based underwriting, where documented evidence of specific controls determined both price and eligibility (Fenwick, June 2026). AI is moving through the same sequence on a compressed timeline because the playbook already exists. The endpoint is not exclusion. It is evidence.

Why the Coverage Gap Creates Compounding Risk

The cost of arriving at renewal without documented AI controls is not a higher premium. It compounds across coverage, capital, and board exposure, for three reasons.

• The gap opens between policies rather than inside any one of them. General liability carriers exclude, technology errors and omissions carriers follow with their own language, and cyber carriers attach sublimits, and the narrowing is frequently accomplished through revised forms and underwriting practice rather than visible new exclusions, producing what counsel have described as quiet coverage erosion (Fenwick, June 2026). An AI claim can land in the space between forms with no policy designed to answer it. Meanwhile the frequency of qualifying events is climbing: Gartner projects that by 2028, 25% of enterprise generative AI applications will experience at least five minor security incidents per year, and that by 2029, 15% will experience at least one major incident annually, up from 3% in 2025 (Gartner, April 2026). Incident frequency is rising while the forms that would respond are narrowing. Those two lines cross inside the next two renewal cycles.

• An uninsured AI loss does not stay an operational problem. It becomes a governance one. The narrowing now reaches management liability, and exclusions drafted around the use, deployment, or development of AI carve out precisely the decisions a board is accountable for (Lathrop GPM, May 2026). Regulatory exposure compounds the same way. Gartner projects that through 2027, manual AI compliance processes will expose 75% of regulated organizations to fines exceeding 5% of global revenue (Gartner, March 2026). A penalty at that scale is an operational event when a policy responds to it. With no policy behind it, it is a disclosure event.

• The math on documenting AI governance is not close, and it is now measurable on both sides. IBM and the Ponemon Institute put the global average breach cost at 4.99 million dollars in 2026, a 12% year-over-year increase. Breaches involving shadow AI averaged 5.39 million dollars, one in five of them produced a regulatory fine, and 92% of organizations that suffered an AI-related breach lacked adequate access controls on their AI systems and data (IBM, 2026). Building and evidencing an AI control inventory is a professional services engagement measured in tens of thousands of dollars and delivered in weeks. What it stands against is a mid-seven-figure loss a general liability policy may now decline, a penalty no policy covers, and a premium an underwriter sets from whatever the organization can document. Across two renewal cycles, the organizations holding evidence will pay less for more coverage than the organizations holding intentions. The math is not close.

How Regulated Buyers Should Assess Their Actual Exposure

Five questions separate the organizations that will negotiate their AI endorsements from the organizations that will discover them in a denial letter.

1. Can the organization produce a current inventory of every AI system, model, and third-party AI service in use, including generative features embedded in software it already licensed?

2. Has someone pulled the endorsement schedule on every general liability, technology errors and omissions, cyber, and management liability policy and confirmed whether AI exclusion language is attached?

3. Does the organization know which of its AI use cases fall inside the definition of generative artificial intelligence used in the standard endorsements, and which sit outside it?

4. Can the organization present documented evidence of access controls, human review, and monitoring for its highest-consequence AI workflows, at the level of detail an underwriter would test rather than the level a policy document asserts?

5. Is there a named owner accountable for the insurance consequences of AI deployment decisions, with visibility into renewal dates and authority to negotiate endorsement language before it binds?

An organization that cannot answer most of these does not have an AI risk position. It has an AI risk assumption, which is the one thing underwriters have stopped pricing.

Bottom Line for Regulated Buyers

The insurance market repriced AI risk in a single quarter, using an instrument that requires no legislature and no enforcement action, and it did so because 42% of insurers track no AI metrics of their own and therefore cannot model anyone else's (Capgemini, May 2026). The organizations that will hold usable AI coverage in 2027 are not the ones that mapped themselves to the most frameworks. They are the ones that built an evidence base for how AI is governed in their environment before an underwriter asked to see it. Cost is what organizations pay to document how they govern AI. Value is what that documentation protects across every renewal, every claim, and every board conversation that follows. For regulated buyers, the ratio is not close.

Works Cited

• "Cost of a Data Breach Report 2026." IBM, 2026, ibm.com/reports/data-breach.

• "Gartner Predicts 25% of All Enterprise GenAI Applications Will Experience At Least Five Minor Security Incidents Per Year By 2028." Gartner, 9 Apr. 2026, gartner.com/en/newsroom/press-releases/2026-04-09-gartner-predicts-25-percent-of-all-enterprise-gen-ai-applications-will-experience-at-least-five-minor-security-incidents-per-year-by-2028.

• "Gartner Predicts AI Applications Will Drive 50% of Cybersecurity Incident Response Efforts by 2028." Gartner, 17 Mar. 2026, gartner.com/en/newsroom/press-releases/2026-03-17-gartner-predicts-ai-applications-will-drive-50-percent-of-cybersecurity-incident-response-efforts-by-2028.

• "Insurer Interest in AI Exclusions Growing as Risk Becomes Omnipresent." Claims Journal, 20 Jul. 2026, claimsjournal.com/news/national/2026/07/20/338950.htm.

• J.S. Held. "Copyright Cases Dominate as Regulatory and Product Liability Challenges Emerge in the Q2 2026 J.S. Held AI Disputes Monitor." PR Newswire, 15 Jul. 2026, prnewswire.com/news-releases/copyright-cases-dominate-as-regulatory-and-product-liability-challenges-emerge-in-the-q2-2026-js-held-ai-disputes-monitor-302825770.html.

• "The AI Coverage Gap: What New Insurance Exclusions Mean for Your Business." Lathrop GPM, 4 May 2026, lathropgpm.com/insights/the-ai-coverage-gap-what-new-insurance-exclusions-mean-for-your-business/.

• "The End of 'Silent AI'? Emerging AI Exclusions, Coverage Fragmentation, and Practical Implications for Policyholders." Fenwick, 15 Jun. 2026,