Insurance now has an authority problem, and it arrived faster than the coverage language.
Last week the Wall Street Journal reported Verisk is weighing additional optional exclusions for AI-related exposures, including agentic AI, and that AIG and Chubb are among the insurers with the option to use existing Verisk exclusions on AI if they choose. Marsh's head of insurance brokerage, Nick Studer, fired back in a letter to leading insurers: excluding AI risks would be a "backward step" that "will increase coverage uncertainty and increase disputes." Marsh says it will steer clients elsewhere if AI exclusions land — while conceding the industry must cooperate on "genuinely novel exposures around agentic AI and autonomous decision-making."
A few days later, Coverager put the operating question in plain terms. RealPage paused new activations of its EliseAI integrations, alleging that EliseAI's new Apollo assistant — which reassigns apartment tours, adjusts settings, drafts messages — exceeded the scope of the API agreement it had signed. JPMorgan's Jamie Dimon drew a harder line: the bank is blocking external AI agents from accessing retail accounts to move money or pay bills, calling it "just too risky." And Travelers' executives framed the three questions insurers must answer when an AI assistant enters the sale: is it authorized to act for the consumer, does the consumer confirm the accuracy of the information, and does the customer understand the coverage? A September Seaworthy Insurance survey of 1,028 high-earning Americans found 74% would let an AI assistant research insurance options, 66% would let it gather real quotes, and 12% would let it complete the purchase. Coverager notes the echo: in 2007, a decade after Progressive introduced online purchasing, about 12% of online-insured users had actually bought auto online. Today's willingness equals the last shift's early adoption. On the supply side, Harbor just emerged from stealth with $10 million to measure, mitigate, and insure AI agent risk; the Artificial Intelligence Underwriting Company is certifying AI systems through 5,000+ adversarial simulations, with underwriting capacity from Beazley.
What it means for carriers
Strip it down and every carrier is facing two decisions, and most haven't made either one on purpose.
The first is an underwriting decision: will you cover the risks AI agents create? Exclusions feel like the safe answer, but Marsh's warning is the honest one — exclusions don't remove the risk, they move the premium. Somebody will write AI liability the way somebody wrote cyber when incumbents hesitated, and Beazley is already in the water. The second is a distribution decision: will you serve customers who arrive through AI agents? Twelve percent willingness is hardly nothing — it is the same number the last channel shift showed at its slow start. Declining an unfamiliar exposure is underwriting judgment. Declining to meet customers in an emerging channel is a strategy bet, whether you meant to make one or not.
Exclusions don't remove the risk, they move the premium.
Both decisions turn on the same missing piece: authority. Coverage language written for human agents doesn't answer "what was this agent authorized to do, and for whom?" Until the industry answers that cleanly, every claim involving an AI agent becomes a coverage argument — the dispute factory Marsh says it wants to avoid.
From the operator's chair
If I were running the book this week, I'd do three things.
First, write the authority model before someone else's agent writes it for you. Treat AI agent authorization like any other delegated authority: named principals, scoped permissions, and a recorded ledger of what the agent actually did. The industry knows this playbook from delegated underwriting and MGA oversight: the authority question is an economics question, not a legal abstraction. The rule I've held for years still applies: agents pre-qualify, a licensed person confirms, the ledger keeps the tape. Now it applies to software too.
Second, decide both decisions explicitly, in the same room. If the answer to both is "not yet," fine — but make it a decision with a date on it, not a drift. The risk of drift is that the specialists set the terms: the standards, the certifications, the customer relationship. Harbor's $10 million and AIUC's 5,000-simulation certification are small today. So was cyber in 1999.
Third, watch where the exclusions push the premium. If your response to agentic risk is a Verisk exclusion, you've just told Marsh to walk your commercial clients to someone who will write it. That is a portfolio decision disguised as a wording decision. Every exclusion has a recipient.
The agent era doesn't ask carriers to have AI figured out. It asks whether the industry's oldest questions — who is authorized, what did they do, where is the record — get answers before the claims arrive. The only choice is whether the answers are yours.
— Krishna