Does my professional liability or E&O policy exclude AI mistakes?

This is the operator's reading of whether existing professional liability, E&O, and cyber cover responds to an AI mistake in 2026. It covers what each line was built to do, how the exclusion wave is worded, where affirmative AI coverage now exists, why the European exposure makes the gap more serious, and the exact wording to check in your own policy.

Section 1. The honest answer, line by line

There is no clause in a standard policy headed "AI mistakes." Whether you are covered depends on which line of business the loss falls into, what your policy was built to do, and whether your insurer has already added AI-specific wording. The honest reading for the three lines operators ask about most is this.

Professional indemnity and E&O is your best existing chance. These policies respond to claims that you, in rendering a professional service, made an error that caused a third party a financial loss. If a professional uses an AI tool to help produce advice or a deliverable, then reviews and approves the output, and the output turns out to be wrong, the insured act is the professional's judgment, and a professional indemnity or E&O policy without an AI exclusion may well respond. The weaker the human review, the weaker the argument. Where the AI agent acted autonomously and a person never checked the output before it reached the client, the claim sits exactly where insurers are now writing exclusions.

Cyber was not built for this. Cyber insurance responds to network intrusion, data breach, business interruption from a security event, and extortion. A wrong answer produced by a model is not a security failure. Some pre-2024 cyber policies are silent on AI, so a hallucination loss could be argued into coverage as a data or system event, but that is a dispute, not a grant. Where the loss is a financial loss caused by inaccurate AI output in a service context, professional indemnity or E&O is the more natural home, and that is where you should read first.

General liability covers a different harm. Commercial general liability responds to bodily injury, property damage, and personal and advertising injury. It is relevant if an AI-driven physical system injures someone, or if AI-generated marketing content triggers an advertising injury claim, but it does not respond to a pure economic loss from bad advice. This is also the line where standardised AI exclusion endorsements arrived first in the US market, which is covered in the companion guide linked below.

The question that decides most AI mistake claims is not "is AI mentioned in my policy." It is "did a human review the output before it reached the client, and has my insurer added an AI exclusion since." Agent Liability EU

Section 2. Why exclusions are appearing now

The exclusion wave did not arrive without warning. Underwriters had flagged the same core problem for years: there was no actuarial loss history from which to price AI risk. Without credible loss data, without a settled legal framework for who bears liability when an AI system causes harm, and without a clear view of whether AI exposure was correlated across policyholders in ways that could trigger aggregate losses, carriers were carrying an unquantified and potentially systemic exposure on policies priced as though AI did not exist.

The legal environment then made the abstract concrete. A chatbot misrepresented an airline's policy and the airline was held liable for its output. Lawyers submitted fabricated citations generated by a large language model and were sanctioned. An automated hiring system screened out applicants by age and the employer settled. Each case showed that AI losses were real, that courts would assign liability to the deploying entity rather than the model vendor, and that the losses were landing in categories that standard policies were expected to cover. Those cases are set out in Section 6.

Reinsurers applied the decisive pressure. Munich Re, Swiss Re, and others had watched unpriced AI exposure accumulate in cedent portfolios, and the parallel with silent cyber was direct. A decade ago, ambiguous cyber wording crystallised into large disputed claims, and reinsurers forced cedents to clarify. The same mechanism is now playing out with AI, on a faster timeline. The practical effect is that at treaty renewal, primary carriers are being pushed to either grant AI cover on defined terms or exclude it, and silence is no longer an accepted position.

Section 3. How the exclusion is drafted, and the words to look for

Exclusions reach a policy in three ways: a named standard form, a carrier's own proprietary endorsement, or a sublimit that caps AI losses rather than removing them. You do not need to be an underwriter to find them. You need to read three places in your own policy.

The phrase that does the work is "arising out of." This is standard wording, and courts read it broadly to require only a causal connection rather than direct causation. A claim need not name an AI system as the cause: if the chain of events traces back to AI activity, the exclusion can apply. That is why an exclusion can defeat a claim that, on its face, looks like an ordinary professional error.

Named standard forms (US commercial market). The most cited are the ISO Verisk generative AI exclusions effective January 2026: CG 40 47 (broad, Coverage A and B of the commercial general liability part), CG 40 48 (Coverage B only), and CG 35 08 (products and completed operations). These are general liability forms, but they tell you what standardised AI exclusion language now looks like.

Carrier-specific forms reach the lines that matter most for AI mistakes. W.R. Berkley's Form PC 51380, filed in June 2024, is an absolute AI exclusion that applies to D&O, E&O, and Fiduciary Liability. It excludes any claim arising from the actual or alleged use, deployment, or development of artificial intelligence by any person or entity, and its scope reaches AI-generated content, a failure to detect third-party AI content, inadequate AI governance, chatbot misrepresentations, regulatory investigations relating to AI, and even statements about a company's AI capabilities. A management-liability or E&O buyer on this form has a broad carve-out to deal with, not a narrow one.

Sublimits are partial exclusions in disguise. On the London market, Beazley and QBE have introduced AI sublimits that cap AI-related payouts at roughly 10 percent of the total policy limit. Chubb has introduced an exclusion for widespread or systemic AI events while retaining some coverage for isolated incidents. A sublimit will not show up as an "exclusion," so read the limits and sublimits schedule as carefully as the exclusions. Carrier-specific wording and regulatory filing status vary by jurisdiction, so treat any specific form as an item to confirm with your broker. [VERIFY exact carrier wording before quoting it back to an insurer.]

Section 4. The countertrend: affirmative AI coverage

The other half of the story is that a small but growing set of carriers is moving the opposite way, writing affirmative AI coverage that names AI failure modes as covered perils rather than relying on the absence of an exclusion. For an operator, an affirmative grant is materially stronger than silence, because a covered AI failure produces a valid claim without the insured having to argue against an exclusion after the loss.

Counterpart (professional liability and Technology E&O)

Counterpart, a Los Angeles insurtech, expanded affirmative AI coverage in November 2025 across its Miscellaneous Professional Liability and Allied Health lines and added a Technology E&O insuring agreement. The coverage names AI-specific failures, including losses caused by AI hallucinations, AI misclassification errors, and AI-driven hiring bias, and it is positioned specifically at the silent AI gap in standard E&O wordings. Counterpart distributes to small and medium-sized businesses through a broker network (reported at roughly 28,000 policies placed via about 2,800 brokers), and its capacity is backed by Aspen, Markel, and Westfield Specialty. Its underwriting expects evidence of an AI governance programme, with alignment to NIST AI RMF or ISO/IEC 42001 viewed favourably.

Coalition (Technology E&O extension via active cyber)

Coalition offers a Technology E&O extension that brings AI risk categories within scope through its active cyber platform, combining cybersecurity monitoring with insurance. For a technology company, the extension reduces third-party liability risk and brings AI-related claims into scope as the product has evolved through 2025 into 2026. Coalition is a useful example of an existing cyber-led writer extending toward AI rather than excluding it.

Others writing affirmative or AI-extended cover

Vouch writes technology E&O with AI extensions covering hallucinations, algorithmic bias, and intellectual property infringement. Embroker offers an AI coverage endorsement on technology E&O. Armilla, a Lloyd's coverholder, writes AI model liability reported up to about USD 25 million and pairs cover with AI governance evaluation. Munich Re aiSure offers parametric AI performance cover settling on measurable performance data, and HSB (Hartford Steam Boiler, part of the Munich Re group) has written early affirmative AI and algorithmic-risk cover. Most of these are US-distributed or enterprise-first; European access is generally through the Lloyd's market or surplus lines brokers rather than a direct European channel. Confirm current limits and availability with a broker before relying on any figure. [VERIFY carrier-specific limits.]

Section 5. Why the gap is worse in the EU

For a European operator, the exclusion trend collides with a liability regime that is moving the other way. Your insurer is narrowing cover at the same moment European law is making it easier to hold you liable for an AI mistake.

The revised Product Liability Directive. Directive (EU) 2024/2853 expressly includes software and AI systems within "product," and it applies to products placed on the market or put into service after 9 December 2026 (the national transposition deadline is also 9 December 2026). It introduces rebuttable presumptions of defectiveness that ease the claimant's burden of proof where an AI system is technically complex or opaque, and it expands compensable damage to include data loss and medically recognised psychological harm. In plain terms, a claimant suing over a defective AI system after that date has a smoother path than under the old regime.

The EU AI Act deployer duties. Under Regulation (EU) 2024/1689, a deployer (the business operating an AI system) carries its own obligations distinct from the provider that built the model. The literacy duty (Article 4) and the prohibited-practice rules (Article 5) have applied since 2 February 2025. The transparency duties under Article 50 apply from 2 August 2026 and are not deferred by the Digital Omnibus. The heavier high-risk obligations were originally due on 2 August 2026; a provisional political agreement on 7 May 2026 would move them to 2 December 2027, but that deferral is not yet adopted, so the original date remains binding as of this writing. A failure to meet these duties is the kind of conduct that turns an AI incident into a liability claim.

The insurance supervisor's signal. The EIOPA Opinion on AI governance and risk management (EIOPA-BoS-25-360, published 6 August 2025) places AI within existing insurance law, including Solvency II, the Insurance Distribution Directive, DORA, and GDPR. It does not create new rules, but it tells insurers that supervisors expect AI to be addressed explicitly across pricing, underwriting, and claims, which is part of what is pushing carriers to replace silent AI with either a grant or an exclusion.

The combined effect is a scissor. Liability is becoming easier to establish under the Product Liability Directive and the AI Act, while standard E&O and cyber wordings are excluding AI. An operator who relies on a silent policy is exposed on both blades.

Section 6. The cases the exclusions are built on

Insurance underwriting is claims-driven. The wordings described above did not come from abstract theory. They followed a pattern of cases that made AI losses concrete and showed that the deploying organisation, not the model vendor, was held responsible.

Moffatt v. Air Canada (BC Civil Resolution Tribunal, 14 February 2024)

A passenger consulted Air Canada's website chatbot about bereavement fares. The chatbot gave inaccurate information about the refund policy. When the passenger sought the refund, the airline denied it and argued that its chatbot was a separate entity whose statements did not bind the airline. The tribunal rejected that argument, holding that the chatbot's representations were the airline's representations, found negligent misrepresentation, and awarded damages. The case established that an organisation cannot disclaim responsibility for its AI tools by treating them as independent. For a professional services firm, the lesson is that an AI tool's output is your output.

Mata v. Avianca, Inc. (S.D.N.Y., 678 F. Supp. 3d 443, 2023)

Attorneys submitted a court brief containing citations to cases generated by ChatGPT. The cases did not exist. The court identified the fabrications and sanctioned the attorneys. This was the first widely publicised demonstration that large language model hallucinations could enter formal professional work and expose a firm to sanctions and malpractice claims arising directly from unchecked AI output. It is the clearest illustration of the autonomous-output risk that E&O exclusions now target, and of why human review is the factor that preserves coverage.

Both cases map to a professional indemnity or E&O scenario: an AI tool produced a wrong output, a person relied on it, and a third party suffered loss. That is precisely the territory where insurers are writing exclusions and where affirmative AI products are positioning. The exclusion wave and the affirmative countertrend are two responses to the same set of facts.

Section 7. A decision aid: is my AI mistake likely covered?

Use this as a structured reading of your own position. It is a guide to the right questions, not a coverage determination, and your policy wording governs.

If you want a faster read on where your current cover and your AI governance stand against the EU obligations that drive this exposure, the AI Act Readiness Scorecard on this publication walks you through the deployer duties and the documentation an underwriter will expect. It is a self-assessment, not a coverage decision.

Section 8. Frequently asked questions

Related reading

For the full reading guide to the exclusion forms themselves, including the ISO endorsements and the carrier-specific language, see AI policy exclusions in 2026: what your existing coverage actually excludes on this publication. For how an autonomous AI agent's error is treated under European law, see When AI agents make mistakes: liability under EU law. For the two-sided EU exposure created by the AI Act and the Product Liability Directive at once, see The double exposure: the EU AI Act and the Product Liability Directive in 2026. For the carrier-by-carrier picture with limits and underwriting criteria, see the 2026 AI Liability Insurance Market Map on agentinsured.eu, and for Counterpart specifically the Counterpart affirmative AI coverage guide. For a policy-by-policy SME read, see Does my business insurance cover AI errors? on insureyouragent.com.