AI is mitigating risks that are already modeled, already priced, and already reserved for. It is creating risks that are none of those things. Cyber loss, claims fraud, catastrophe exposure, and AML false positives all have loss histories behind them. Algorithmic discrimination, model drift, hallucinated advice, and correlated foundation-model failure do not.
That imbalance is why the industry's behavior looks contradictory. Carriers are deploying AI aggressively inside their own operations while moving just as fast to exclude it from their customers' policies. Both are rational. They simply belong on different ledgers.
WHAT AI CREATES
Three new exposures — and no existing control framework built to support them.
The first is model risk migrating into regulated decisions. Roughly two dozen states and D.C. have adopted NAIC's AI model bulletin, requiring a written AI program, board-level accountability, and discrimination testing. New York's Circular Letter No. 7 goes further, naming fairness metrics and requiring written explanation of adverse decisions within 15 days. Colorado has extended its AI governance regulation to auto and health; nine states now restrict AI in prior authorization and claims review. In the litigation that follows — Huskey v. State Farm, the NH Predict class actions against UnitedHealth — courts have shown no appetite for treating an algorithm as protection. This is model risk with lingering negative consequences and a civil-rights overlay that traditional model risk management never had to price.
The second is third-party AI risk, which is concentration risk wearing a new coat. Swiss Re Institute warned in January that "concentration among cloud and AI service providers creates accumulation and systemic risk concerns"; the Bank of England's July Financial Stability Report modeled correlated disruption through shared providers. Gallagher Re made the insurance point: unlike a windstorm, an AI failure spreads through the shared use of a widely adopted model, producing simultaneous losses across industries and jurisdictions. That is aggregation, and aggregation is how insurers get hurt.
The third is the silent exposure sitting inside policies written before any of this. Gallagher's 2026 benchmarking survey found one in five insurance professionals reporting a client loss or claim tied to AI risk, only 51% of them fully covered. The market is closing that gap by subtraction. ISO's three generative AI exclusionary endorsements — CG 40 47, CG 40 48 and CG 35 08 — took effect Jan. 1, and Berkshire Hathaway, Chubb, Travelers and W.R. Berkley have all filed exclusions. Affirmative capacity exists — Armilla, Chaucer, Mosaic, Munich Re's aiSure — but tops out around $25 million to $50 million per insured. Anthropic settled a single copyright matter for $1.5 billion and paid it off its balance sheet. That is the protection gap in one line.
WHAT AI RETIRES
The mitigation case is strongest where the loss data is best. IBM's 2026 Cost of a Data Breach study, across 602 breached organizations, found firms using security AI and automation extensively cut breach costs by nearly $2 million and contained incidents 65 days faster than those using none. HSBC reports its AI transaction monitoring identifies two to four times more financial crime than the rules-based system it replaced, with 60% fewer false positives — the rare compliance result where accuracy and efficiency moved together.
In claims, Allianz Partners cut its travel claim lifecycle from 19 days to four, and Intact Financial has disclosed more than C$150 million in recurring annual AI benefits. And in catastrophe risk, the gains are peer-reviewed, not self-reported: Google DeepMind's cyclone model, published in Nature in August, delivers three-day track forecasts as accurate as the two-day forecasts that preceded it — a full extra day of warning for every property book on a coastline.
THE MEASUREMENT PROBLEM
Risk managers have registered the shift. In January's Allianz Risk Barometer, AI entered the global top three for the first time, at No. 2, up from No. 10 — the sharpest single-year climb the survey has recorded. But registering a risk and pricing it are different things.
Measurement makes the imbalance worse. Evident's 2026 AI Index found just 65 publicly documented AI use cases with disclosed outcomes across the 30 largest North American and European insurers — 75% productivity gains, 2% revenue uplift. FactSet reviewed seven insurers that discussed AI on second-quarter earnings calls; none disclosed a dollar or basis-point figure tying AI investment to results. IBM's own data adds a caution: even as security AI saved money, average time to contain a breach rose to 247 days, reversing five years of improvement, with one in four malicious breaches now AI-enabled. AI is arming both sides.
That is not an argument against adoption, but for treating AI the way the market eventually treated cyber. The precedent is on the books: Lloyd's Market Bulletin Y5258 forced underwriters, in July 2019, to state affirmatively whether cyber was in or out. No equivalent mandate exists for AI yet, and until one does, exclusions will keep arriving faster than coverage.
That correction may come. If it does not, if the exposure proves too correlated for loss history to tame, then the conversation goes somewhere the industry has been before. Nuclear got Price-Anderson, terror got TRIA, flood got the NFIP, each after the market judged a risk real but not privately bearable. One proposal would apply that logic to frontier AI: a mandatory, risk-priced federal indemnity pool with a sunset. The sharpest objection is that it solves the wrong problem. Ian Adams argues the bottleneck is not capital but legal uncertainty: no one knows what courts will hold AI developers and deployers liable for, and mandating cover over an undefined duty of care subsidizes that uncertainty rather than resolving it. His remedy is clearer statutory duties and safe harbors. Insurers can price a loss once they know what it is.
For risk managers, the work is unglamorous: an inventory of every place AI touches a challengeable decision, a close reading of the AI language in each D&O, E&O, cyber and GL renewal, and vendor contracts written on the assumption that the model will fail. The coverage conversation has started without them.
SOURCES
Allianz Commercial, Allianz Risk Barometer 2026 (Jan. 14, 2026; 3,338 respondents, 97 countries).
NAIC, Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, and NAIC implementation map (as of April 2026).
NY DFS, Insurance Circular Letter No. 7 (July 11, 2024). Colorado DOI, 3 CCR 702-10, as amended effective Oct. 15, 2025.
Huskey v. State Farm Fire & Cas. Co., No. 1:22-cv-07014 (N.D. Ill.); Estate of Lokken v. UnitedHealth Group (D. Minn.).
Swiss Re Institute, sigma insights 01/2026: AI adoption is reshaping the risk landscape (Jan. 13, 2026).
Bank of England, Financial Stability Report (July 7, 2026).
Gallagher Re, Global insurtech Report: Artificial Intelligence — Risks and Opportunities in (Re)insurance and Beyond (March 2026).
Arthur J. Gallagher & Co., 2026 AI Adoption and Risk Benchmarking Survey (Feb. 23, 2026; 1,200+ businesses).
Verisk/ISO endorsements CG 40 47, CG 40 48, CG 35 08, effective Jan. 1, 2026.
IBM Security / Ponemon Institute, Cost of a Data Breach Report 2026 (July 29, 2026; 602 breached organizations).
HSBC, "Harnessing the power of AI to fight financial crime" (June 10, 2024).
Allianz Partners (Sept. 2025); Intact Financial Investor Day (May 21, 2025).
Google DeepMind, WeatherNext cyclone model, Nature (Aug. 6, 2026).
Evident Insights, 2026 Evident AI Index for Insurance (June 16, 2026).
FactSet Insight, "Insurance AI Investments Emerge So Far as Qualitative Comments vs. Quantitative Drivers" (Aug. 14, 2026).
Lloyd's Market Bulletin Y5258 (July 4, 2019).
Gregory C. Allen, The Insurance Industry's Retreat from AI Threatens to Slow Innovation and Adoption, CSIS (Sept. 4, 2026).
Cristian Trout, Insuring Uninsurable Risks from AI: Government as Insurer of Last Resort (arXiv 2409.06672).
Ian Adams, AI Insurance and the Backstop Reflex: A Policy for Every Risk, a Taxpayer for Every Loss, Truth on the Market (Oct. 8, 2026).
