What is AI insurance?

AI Insurance, also known as affirmative AI insurance, has been developed to specifically address the risks associated with the use and performance of AI technologies and systems, and covers liabilities that are excluded from existing business policies such as general liability, directors and officers, errors and omissions, and cyber insurance.

“Many of the existing policies companies have in place have AI exclusions,” highlights Lauren Kornutick, senior director analyst, Analytics and AI at Gartner.

“As AI is used more, and in more strategic and high-stakes use cases, new risks are being introduced. This is a gap in the existing risk management approach that could result in large-scale financial penalties, which could be detrimental.”

What does AI insurance cover?

AI insurance can cover a wide range of risks. On the errors and misinformation side, this can include financial losses stemming from AI hallucinations, such as a chatbot dispensing bad advice, or flawed decision-making.

It can also extend to algorithmic bias and discrimination, picking up legal defense costs and settlements when an AI model inadvertently disadvantages a group in contexts like hiring or lending.

IP and copyright exposure is another area of coverage, protecting businesses against claims that an AI model was trained on, or generated, copyrighted material without permission.

Then there’s performance guarantees, which are leading to warranty-style offerings that will refund license fees or cover associated costs if a model fails to hit specific benchmarks like accuracy or fairness. At the more severe end of the risk spectrum, AI insurance can cover large-scale physical damage or property loss resulting from poor AI-generated advice, device hacking, system failures, or harmful actions taken by AI agents.

Why should IT leaders take notice?

AI insurance is still a nascent market, highlights Tomas Novosad, technology analyst and founder of Full Fibre Checker, and one that’s currently a collection of discrete coverage options – standalone, endorsement and exclusionary – instead of a single type of insurance category.

But while IT leaders may consider AI insurance a matter for the legal or finance departments to attend to, the reality is that AI risk is increasingly becoming an operational responsibility for IT teams.

“[This is because] once AI is embedded into core systems, accountability sits within the technology stack and the processes that support it,” explains Indranil Roy, managing partner and global head, Industry Solutions Group at IT solutions and consultancy firm Mphasis.

“In practice, IT teams are already seeing issues such as inconsistent AI-driven decisions across different channels, or difficulty tracing how an output was produced once it passes through multiple legacy and cloud-based systems.”

For IT leaders, he continues, the key issue isn’t the policy itself, but whether the organization can evidence how AI-driven decisions are made, logged and explained in live production environments, not just in design documentation. If something goes wrong, it’s the system design, data flows, and governance controls that determine whether the issue can be traced, identified, and resolved.

“This is why AI insurance is becoming directly relevant to enterprise IT governance, because it increasingly reflects how well organizations can operationalize control, not just define it,” Roy states.

The growing importance of AI governance

To underwrite such policies, insurers must have stringent procedures to evaluate the AI capabilities and risks of those companies seeking to buy insurance, and Gartner predicts that by 2030, they will mandate strong AI risk controls as a condition of coverage.

We’re already seeing movement in this direction, reflected in more detailed underwriter questions, AI exclusions, and dedicated limits for AI risks. “In financial services, regulators are already requiring explainability and bias audits for AI-driven decisions,” notes Pragati Awasthi, assistant teaching professor at Drexel University’s School of Computer and Information Sciences.

“Insurers will follow the same logic: if they can’t assess the risk, they won’t cover it.”

Insurers will look for ways that deployers of AI are addressing the operational complexity of AI governance and not just rely on dated and static governance, risk, and compliance (GRC) controls, notes Kornutick, adding that Gartner recommends IT leaders deploy a hybrid approach consisting of centralized and decentralized policy, team, and system as a complete piece.

“This includes layered (enterprise and department level) policies and rules, clearly designated responsible teams who deeply understand the application’s operation, and adopting hybrid technical platforms, such as an enterprise-level AI governance platform (AIGP) paired with decentralized, application-specific guardrails,” she says.

One key factor to consider is whether organizations are deploying AIGPs as part of their governance architecture, she adds. According to Gartner’s 2025 State of AI-Ready Data Survey, organizations that do are three times more likely to achieve ‘high effectiveness’ in their AI governance practices than those that don’t, with 42% of organizations effective in AI governance having already deployed AIGPs.

“The organizations building governance infrastructure now will have a meaningful competitive advantage in insurability by 2030. The ones waiting will face either exclusions or prohibitive premiums,” Awasthi warns.

Practical steps IT leaders can take today

For those organizations just getting started, Awasthi recommends three priorities. Firstly, build a model register. Know every AI system you're running, what decisions they influence, and who owns them. Secondly, implement logging for automated decisions so you have an audit trail if something goes wrong. Finally, run a bias and drift assessment on any model touching customers or employees.

"Underwriters are increasingly looking for documented model inventories, human-in-the-loop checkpoints for high-stakes decisions, monitoring for model drift and bias post-deployment, and a clear incident response plan specific to AI failures. Governance that exists on paper but isn't operationalized won't satisfy a serious underwriter."

As with every technology before it, AI will continue to bring new risks, and those who get ahead of them now will be far better placed than those who wait for something to go wrong.

With 2030 fast approaching and underwriter requirements only tightening, the window for IT leaders to get ahead of this is narrowing. With this in mind, there’s no better time to build the necessary foundations.