AI Insurance: Why Your Coverage Is Shrinking in 2026

The Wall Street Journal reported on October 17, 2026 that several major insurers are now voluntarily limiting their exposure to AI-related claims, fearing that a large-scale failure could generate claims running into tens of billions of dollars. For an SME that has connected a chatbot, an AI agent, or an automated writing tool to its operations, this has a direct consequence: the insurance policy meant to cover an error, a dispute, or a data leak may, without the company even knowing it, exclude AI from the scope of coverage.

At a glance

• The Wall Street Journal reports that insurers fear AI-related claims could reach "tens of billions of dollars," prompting some to cap their exposure.
• Since July 2025, the American body ISO (Insurance Services Office) has published six standard generative AI exclusion clauses, now filed in 49 US states: 4,078 filings recorded as of July 31, 2026, of which 2,369 are already in effect.
• These exclusions affect policies SMEs commonly rely on: professional liability, commercial package policies, excess coverage, and directors & officers (E&O) insurance.
• According to Swiss Re (Global RiskScan 2026 report, September 2026), 70% of professionals surveyed consider generative AI the most impactful technology for cyber risk, yet SME cyber insurance uptake remains low: 10-20% penetration, versus 60-70% for large corporations.
• There is currently no standard buy-back product equivalent to cyber insurance to offset an AI exclusion: coverage that is removed does not get automatically replaced elsewhere.

What the Wall Street Journal investigation reveals

According to the Wall Street Journal (October 17, 2026), several major US insurance names, including AIG, Great American, and WR Berkley, asked their regulators as early as November 2025 for approval to restrict their exposure to claims caused by AI agents and chatbots. Their concern: a single large-scale failure (an agent acting outside its intended scope, a chatbot giving thousands of customers the same flawed advice simultaneously) could generate tens of thousands of similar claims, far exceeding standard coverage limits.

This trend is not unique to the United States. Swiss Re, one of the world's largest reinsurers, published its Global RiskScan report in September 2026, identifying six AI-related loss scenarios that insurers still struggle to price correctly:

The clause quietly reshaping your policies

The most concrete mechanism affecting SMEs isn't a headline about AI, it's a line of fine print. Since July 2025, ISO, the American body that drafts the standard forms used across much of the commercial insurance market, has published six generative AI exclusion clauses. These clauses are optional: each insurer decides whether to add them to its policies. But adoption is accelerating sharply.

Of the 4,078 filings recorded, the vast majority target policy lines SMEs commonly carry: professional liability, commercial package policies, excess coverage, and directors & officers liability. In practice, a company that uses AI for an estimate, a piece of written content, or a diagnosis, even occasionally, could see a claim tied to that single use excluded from coverage, even though the rest of the case would normally have been covered.

Coverage limits haven't kept up with the risk

A second, separate problem: even when a policy remains valid, its coverage limits predate generative AI. Swiss Re puts the average cyber coverage limit for a large US company at around $120 million, and €90 million in Europe. Over the past five years, the Cyber Claims Database recorded an average of 10 losses per year exceeding that US benchmark, even before AI agents became widespread across businesses.

For an SME, the double bind is clear: it is less often insured against cyber and AI risk than large companies (10-20% penetration versus 60-70%), and when it is insured, the limits and clauses of its policy have not necessarily been revised to reflect the AI uses it has itself adopted over the past two years.

What an SME can check right now

None of this is a reason to pull back from AI: it's a reason to adjust coverage, not usage. Four simple checks to run with a broker or insurer:

1. Ask explicitly whether a generative AI exclusion clause appears in the policy. It doesn't always appear under that exact name; a broker can check the endorsements attached to the policy.
2. Review coverage under professional liability and commercial package policies, not just cyber insurance: these are the policy lines the new clauses target first.
3. Document the company's actual AI usage (which tools, for which tasks, with what human oversight): insurers increasingly ask for this information to price risk correctly.
4. Reassess coverage limits in light of new uses, especially if the company has deployed an AI agent with access to customer data, email, or payment methods.

FAQ

Can a generative AI exclusion clause apply retroactively?

No, an exclusion clause only applies once it is actually added to the policy, typically at renewal or through an endorsement. That's exactly why it's important to check a policy's exact wording at every renewal, not just at the time of initial subscription.

Does my standard cyber insurance automatically cover losses caused by an AI agent?

Not necessarily. According to Swiss Re, current cyber policies often cover AI by default, since a model falls within the general definition of a "computer system." But the new generative-AI-specific exclusion clauses are designed precisely to remove that implicit coverage for certain policy types, particularly professional liability.

Is there a dedicated insurance product for AI-related risks?

Not yet, in the form of a widely available standard product. Unlike the cyber insurance market, which has offered dedicated policies for several years, there is currently no general buy-back offer to offset an AI exclusion clause. The market is expected to evolve, but in the meantime an SME should check its existing policies rather than wait for a new product.

Is a European SME affected by these American clauses?

The ISO clauses documented here are American, but the trend they illustrate, a growing gap between real AI risk and existing insurance policies, also affects Europe. Swiss Re, based in Switzerland, puts the average European cyber coverage limit at €90 million, a ceiling also calculated before AI agents became widespread. It is safer to check your own policy with your local insurer than to assume it is unaffected.

In summary

Insurance is taking time to catch up with AI adoption in business: quiet exclusions in American policies, coverage limits calculated before autonomous agents became common, and cyber coverage that remains a minority practice among SMEs. Measured optimism remains justified: these adjustments mainly show that the insurance industry is taking AI risk seriously, which should eventually produce better-suited coverage products. In the meantime, the most useful vigilance for an SME is the simplest one: re-read your policies, ask your broker directly, and document your AI usage.

To learn more about AI risk governance for businesses, check out our other resources on AI for business or read our customer success stories.

Sources: Wall Street Journal (October 17, 2026, relayed via Techmeme); Swiss Re, Global RiskScan 2026 report and Cyber Claims Database analysis (published September 3, 2026); ISO regulatory filing data on generative AI exclusion clauses, compiled by specialized insurance press (July 2026).