On October 15, the Wall Street Journal reported that Verisk's Insurance Services Office has introduced optional exclusions for generative AI this year and is now weighing additional optional exclusions for other AI-related exposures — including agentic AI. AIG and Chubb are among the insurers that already have the option to use the existing exclusions. AIG's spokesman said the company automatically adopts the standardized forms, which he called "common practice across the industry." This month, Marsh's CEO Nick Studer wrote to leading insurers calling the exclusions a "backward step" that would "increase coverage uncertainty and increase disputes" — and said Marsh would recommend clients seek cover elsewhere if a carrier imposes them.
This is the governance moment the industry has been circling for two years, and it arrived in the form of a wording fight. It matters for carriers for three reasons.
First, the exclusion instinct doesn't manage risk; it relocates it. Nobody knows how to price rogue-agent liability yet — agents hacking websites, submitting fake murder tips, chatbots accused of encouraging suicide. When you can't price it, the temptation is to exclude it. But exclusion doesn't make the loss disappear. It moves it into coverage litigation, which is the most expensive place in insurance to discover what you meant. Marsh is right on the mechanics: blanket exclusions buy uncertainty, not safety. A dispute over whether an AI-caused loss was "arising out of" a model is just silent risk with lawyers.
Second, the excluded risk isn't your real exposure — the silent risk is. Aon's figures in the Journal piece are the number that should haunt every CRO: more than 90% of AI risks currently covered by insurance fall into the "silent" category — neither affirmatively covered nor excluded. That's the portfolio you're actually carrying today. Every enterprise policyholder deploying AI into customer service, claims, underwriting, fraud detection, factory floors. You've written them; you just haven't named the peril. A Rand report this year flagged the "emerging mismatch between rapid enterprise adoption of AI and the fragmented market for insuring (or not insuring) AI use." The mismatch is yours. A loss will do your silent-AI inventory for you, at the worst possible price, if you don't do it first.
More than 90% of AI risks currently covered by insurance fall into the "silent" category — neither affirmatively covered nor excluded.
Third, the exclusion fight is also the growth fight, and right now the growth side is winning the imagination. Munich Re writes AI model-error coverage to $50 million limits. The Artificial Intelligence Underwriting Company — backed by Lloyd's, co-founded by a former Anthropic employee — exists specifically to fill the gap the incumbents are excluding their way out of. Testudo's CEO says the biggest AI companies are willing to buy billions in coverage and can afford it; coverage at that scale, he says, "just doesn't exist on planet Earth." And Aon describes AI data centers as the insurance market's "biggest ever opportunity." Read that again: the industry is simultaneously calling AI risk the biggest opportunity it's ever seen and defaulting to exclusions. Somebody else will keep the difference.
What would I do about it, from the operator's chair?
Inventory your silent AI exposure now, by line. Pull the book and ask where the insured's use of AI can cause bodily injury, property damage, copyright infringement, unauthorized data disclosure, hallucinated error, or regulatory penalty. Don't wait for the ISO exclusion to force the conversation; the exclusion answers a wording question. You need an underwriting answer first: which of these do you want, at what price, with what conditions.
Stop letting a forms committee set your underwriting policy by default. AIG auto-adopts Verisk forms as "common practice." That's an efficient process for an unexamined decision. When the exclusion becomes optional-but-default, the default becomes the decision — and Verisk is making it, not your underwriters. Decide affirmatively, peril by peril, line by line. If you exclude, exclude deliberately, with a named peril you chose not to write and a price you weren't paid. Defaults are not strategy.
Make safety a policy condition, not a hope. The Journal notes something most carriers haven't absorbed: AI-risk policies are often underwritten on the basis of simulation testing of error likelihood — a de facto audit of the underlying technology. The industry's best AI underwriting already works like engineering review. Formalize it: red-teaming results, agent permissioning, kill-switch architecture, data provenance — as coverage conditions, not marketing language. Insurance has always policed risk by attaching conditions to capital. AI is no different; it just needs conditions written by people who understand the machine, not people who fear it.
Treat exclusion as the last resort, not the first instinct. Exclusions have a legitimate use: they draw a boundary you priced honestly. But an industry-wide optional exclusion for the defining technology of the decade is not boundary-drawing. It's an admission that underwriting hasn't caught up, signed at scale. The carriers that figure out affirmative AI coverage with real conditions get a specialty growth line. The rest get the dispute line.
The Wall Street Journal framed this as AI's insurance problem. From the carrier's chair, it's the other way around. AI is the fastest-growing exposure in your portfolio, and the question isn't whether you write it — you're already writing it, silently, in 90% of the book. The question is whether you underwrite it on purpose or discover it in court.
— Krishna