The AI liability line is being built without its raw material.
Every priced line began with a loss history. This one has none, so the market is pricing on model testing and on questionnaires, while exclusions are being written at the same time as the cover is being asked for.
7 of 13Lawyers’ professional-liability carriers reporting actual AI-related claims, and adding AI questions at underwriting.EPIC 16th LPL survey, 2026
May not coverStandard malpractice policies may not respond to AI-related claims at all.ABA Journal, February 2025
January 2026ISO’s generative AI exclusion for general liability. Where a carrier adopts it, AI cover becomes its own decision at renewal.ISO CG 40 48 01 26
80%+Of carrier requests to exclude AI-related damages from corporate policies, approved by state insurance commissioners.CSIS, September 2026, citing The Information, April 2026
The stop is insuredA new cyber endorsement pays the business interruption when an insured suspends its own malfunctioning AI. A claim needs the record of when it drifted and who stopped it. The stop, proved.Beazley, AI Voluntary Shutdown, 24 September 2026
Affirmative AICFC wrote enhanced affirmative AI cover into its cyber policy, “to provide clarity and confidence”. To write it, an underwriter needs to see what the AI is allowed to do. See it live.CFC, 6 October 2026
At renewalA firm that can hand its broker a signed conduct record instead of an assurance is a different risk on the same form.The renewal question is already on the form
Beyond one insurerA frontier AI developer told investors that no single insurer, and possibly not the insurance industry as a whole, may have the capacity to underwrite cover for a catastrophic AI incident.Anthropic, Form S-1, 26 October 2026
What it takes
The technology stack to write AI insurance.
From the carrier’s seat, a control becomes evidence when nine requirements are met. Here is each one, and where Regulayer™ stands today.
Supplies itWorks with it
LAYER 1The evidenceWhat the insurer prices on.
01A standard evidence schemaConsistent data across every insured.Supplies it
02Loss data and pricing modelsFrequency and severity, to set price and capacity.One signed record per action, allowed or refused: the raw material for loss data. Incident databases count incidents but not actions taken, so no rate per action exists. Every action here is counted, which gives the exposure base: rates per 1,000 actions. The models stay the insurer’s.Supplies the data
03Incident reportingThe claims signal, on time.Every refusal and every effect is recorded as it happens, so the timeline of an incident exists on the day, not after discovery.Supplies it
LAYER 2The proofWhat survives a claim.
04Audit rightsChecking the record without taking the insured’s word.An auditor checks the record without the insured’s system or ours.
05Legal admissibilityEvidence that stands up in a dispute.The path is certification under FRE 902(13) and 902(14).
06Independent certificationSomeone else carries the checking.Regulayer™ supplies the evidence. It sits beside ISO/IEC 42001 and insurer-linked audits, and gives the auditor records to test.Works with it
LAYER 3The resilienceWhat keeps the control from becoming the risk.
07Continuity if the vendor failsControl infrastructure can die.Records verify offline, with an open verifier, whether or not Regulayer™ is still there.Built in
08Accumulation riskOne shared control failing across many insureds.Runs on the insured’s own infrastructure, with no shared cloud service of ours between insureds. Each control states the release it runs, its key custody, its time source and its dependencies, so an insurer can count how many insureds share one point of failure.Designed for it
09Availability and false refusalsA control that stops too much becomes business interruption.Off the authority, an action is sent back to correct before it is stopped, so the work keeps flowing. Every period the control was unavailable is signed, with what it refused. Every refusal is linked to what followed, so refusals that proved unnecessary are counted, with the value and hours they held.
The nine requirements come from Regulayer™ market research across carrier, standards and regulator sources. Regulayer™ supplies the evidence; the insurer makes the determination.
Authority and cover
The authority defines the action. The policy defines the cover.
Say which agent may do what, under whom, up to how much. The record shows whether each action was inside that authority or stopped, at the moment it happened. The insurer decides cover from the policy.
Inside the agreed authorityAuthorised action.A named person allowed it, and their authority held at the moment it took effect. Cover is the policy’s decision.
Outside itThe action stopped.It never took effect, and the record proves it. Anything else it caused is weighed on its own.
Outside it, by choiceAdditional cover.The insured widens the authority. Cover and premium are agreed on their own. The record shows the change.
Totals and boundaries
What the record answers for an underwriter.
Did the authority hold?Each record names the authority it was checked against, and whether it still held at the moment the action took effect.
What do the allowed actions add up to?Every allowed action is sealed too, not only the stops, so the total of what was allowed can be read from the record as it builds, by insured, class and named person. An allowed action is not necessarily a completed action, and not a loss.
Where does the record end?It is complete only for the agents and systems connected and the span it states. Every statement names that boundary and any gap inside it, so you see what the record covers before you rely on it.
Was the decision sound?The record shows who allowed each action and whether their authority held. Whether the action made economic sense stays your judgement.
Which loss scenarios does it touch?Take the scenarios you already underwrite. For each one, the record shows whether the agent’s action ran inside a named person’s authority, was sent back, or stopped.
With the insured’s agreement, the carrier reads the records at any time through the Transponder™: drift, stops, withdrawals and trends across its book, sliced by country, insured, sector, class, named person and period. What the carrier may see is agreed at deployment.
A carrier can make the control a condition of affirmative AI cover, or price better terms when it runs, the way telematics works in motor.
Two ways in
Start with the proof. Add the control.
The barrier to AI cover, as CSIS puts it, is that carriers cannot see “whether claimed risk controls actually exist.” The Transponder™ shows them. Both run on the same sealed record. The insured holds the control. The carrier holds a read-only view, with the insured’s agreement, the way a driver agrees to a telematics box.
The Transponder™ · the proof
See what the AI did, live.
The insured runs Regulayer™, which seals every AI action as it happens. The carrier reads the book through the Transponder™: actions, drift, stops and trends, by insured, class and named person.
What is recorded, and what is shared, is agreed with the insured.
Every record verifies offline, by anyone.
The first step for a carrier and a book.
Regulayer™ Control · the control
Outside the agreed authority, stopped.
The insured sets the authority, named person by named person. An action outside it is stopped before it takes effect, and the record shows it. The control is one agreement. The cover is another.
A condition of affirmative AI cover, or better terms.
Drift is stopped before it takes effect.
Outcomes an underwriter can weigh, once validated.
The insured
The carrier
Holds
The authority and the control, inside its own environment
Enter your own figures for one insured, or a whole book. The arithmetic runs in your browser and nothing is sent.
Drifted actions a year
0
Scenario cost if every drifted action takes effect
$0
Scenario amount at stake in stopped actions
$0your figures. Not a measured saving, not a loss avoided, not what a policy would pay.
Records a year for the underwriter
0one sealed record per action, allowed or stopped
Your figures and your assumptions. The models and the price stay the insurer’s.
The precedent
Cyber went through this first.
Early cyber policies took the insured’s word on controls, and the word turned out to be worth very little at claim. The market moved to evidence of controls as a condition of cover, and priced accordingly. AI has arrived at the same point without the equivalent evidence existing yet.
In Johnson v. Dunn the firm had an AI policy in place and its lawyers were sanctioned anyway. The policy was not the failure. The failure was that nothing existed to show whether it had been followed on the day.
What a carrier gets.
Self-evaluating coverage conditions.A condition written against attested operating state, checkable by both sides, with neither party seeing the other’s content. Replaces a questionnaire answered once at bind.
