Two things happened in the last three weeks, and they are the same test arriving from two directions.
On October 19, the UK's Financial Conduct Authority published its review of how financial firms use AI. One sentence in it belongs in every boardroom that buys its models: "Firms can outsource AI services, but remain responsible for them." The paper names what the FCA found — a firm that deployed AI tools before it had governance arrangements; firms that took vendors' assurances without challenging or testing them; firms with no plan for the day their chosen model became unavailable; senior managers who handed AI development entirely to technical teams. The paper creates no new requirements. It describes what supervisors will look for under the rules firms already have.
On November 6, The Governance Memo reported the other direction. Insurers are writing AI out of directors' and officers' cover. Global Finance counts more than 60 carrier groups that have filed to adopt an AI exclusion, and on October 15 the head of the world's largest broker used an earnings call to ask insurers not to rush broad ones. The wording to read sits in D&O. A 2025 draft from W. R. Berkley excludes claims arising from the insured's "statements, disclosures, or representations" about AI — the claim most likely to reach a director personally: that the company said something about its AI governance that was not true. AI-related securities class actions already run at 15 to 16 a year. Where cover stays, it gets priced, and the underwriter wants evidence.
What it means for carriers
First, the D&O exposure is not the AI failure. It is the AI story. Every carrier has spent two years telling one — in earnings calls, board papers, vendor decks, the strategy slide that says governance is handled. The Berkley draft does not exclude the model misbehaving. It excludes the statement being wrong: a narrower exclusion with a wider reach, because the statement is the one thing every firm has already made, and the evidence for it is the one thing most firms have not kept.
Second, the FCA findings are a checklist written in reverse. Deployed before governance existed. Vendor assurances accepted untested. No exit plan for the most-used model. Senior managers who delegated the whole thing to technical teams. Each one is a sentence a plaintiff's lawyer can quote back, and a question an underwriter can ask at renewal. The regulator invented no new standard. It wrote down what supervision looks like under the old ones — and the D&O market is pricing the gap between the story and the file.
Third, carriers sit on both sides of this, which is exactly why it matters. You buy D&O and you underwrite it. The broker's October plea — slow down on broad exclusions — is distribution telling you that a blunt exclusion strands buyers, including the buyers of your own paper. The disciplined answer is the one this series keeps returning to: decide line by line, in or out or priced, with a named owner who can say why. A broad exclusion is a position. So is affirmative cover with an evidence requirement. Silence that a claimant, a broker, and eventually a court will read as coverage is not.
From the operator's chair
One: read your own D&O wording before your next renewal, as a buyer and as an underwriter. Specifically: are claims arising from what the company said about AI covered, excluded, or priced? If you sell this cover, decide the position line by line now — your insureds' renewals are about to ask you the same question your renewal is asking you.
Two: build the evidence file the underwriter — and the supervisor — will ask for, from the FCA findings backwards. An inventory of AI uses with a named owner each. A record of the human check that actually happened, with the evidence it left behind. A note of where you challenged a vendor's assurance instead of accepting it. An exit plan for your most-used model. If the file does not exist, the governance story is a statement, and statements are now the claim.
Three: stop signing AI statements you cannot evidence. Every board paper, filing, and customer letter now has an AI drafter somewhere upstream of the signature. The signature is the control.
The market just told you, twice in three weeks, what it will grade. The supervisor grades whether the governance is real. The insurer grades whether the statement about it was true. Build the file that passes both, and the renewal stops being about exclusions and becomes about price — the negotiation you can win.
— Krishna