AI insurance sublimits and aggregate caps: what they actually limit

A headline policy limit is the number every operator remembers and the number that matters least on its own. What actually determines whether an AI agent insurance policy pays a meaningful amount toward a real loss is the combination of sublimits attached to specific trigger categories and the aggregate cap governing total payment across the policy period. This article explains both mechanisms, why they exist, how they interact with the five trigger categories that define the emerging AI agent liability class, and what to check before signing.

Why insurers use sublimits at all

A sublimit exists because an insurer is willing to accept a broad overall limit for a policy while remaining unwilling to expose that full limit to a specific category of loss it considers harder to price, more prone to severe or correlated outcomes, or simply less understood. In conventional commercial insurance, sublimits are common for categories such as data breach notification costs, business interruption, or crime coverage within a broader package policy. AI agent insurance inherits this structure and applies it to categories the market is still calibrating.

The practical effect is that a policy with an appealing headline number, EUR 10 million, for example, may in practice cap the specific category of loss an operator is actually exposed to at a small fraction of that figure. An operator whose primary exposure is autonomous action liability, the gap identified in the trigger analysis published on this site, needs to know the sublimit attached to that specific category, not the headline number on the policy schedule's first page.

Where sublimits are currently tightest

Two categories consistently carry the tightest sublimits in current market wordings, reflecting where insurers have the least loss history to draw on.

Autonomous action liability. Because this trigger category addresses losses arising from an agent acting entirely within its authorised scope, with no breach, no negligent advice, and no product defect involved, insurers have limited actuarial basis for pricing severity. Munich Re's aiSure Schedule D, which addresses this category directly, structures capacity separately from the broader aiSure programme limit, reflecting the insurer's caution in exposing its full capacity to a novel and still-developing trigger. Operators with agents that take meaningful autonomous action, procurement agents committing to purchase orders, scheduling agents making binding commitments, should expect this category to carry the tightest sublimit relative to their actual exposure, and should size their cover accordingly rather than assuming the headline limit applies.

Regulatory defence and penalty-adjacent costs. Coverage for the legal costs of responding to an AI Act or GDPR supervisory proceeding, discussed in the claims triggers article's regulatory enforcement category, is frequently subject to its own defence cost sublimit, distinct from the indemnity limit that applies to a third-party liability claim. This matters because a supervisory investigation can generate substantial legal and technical expert costs even where no fine is ultimately imposed, and operators who assume their broad liability limit applies to a regulatory investigation may find the relevant sublimit considerably smaller.

How aggregate caps change the calculation

An aggregate cap governs the total amount a policy will pay across every covered claim during the policy period, as distinct from a per-claim or per-occurrence limit, which governs a single event. A policy with a EUR 10 million per-claim limit and a EUR 10 million aggregate cap effectively has one full payout available for the entire year: after a single claim exhausts the aggregate, the policy provides no further indemnity for the remainder of the term even if additional, unrelated covered events occur.

This distinction matters disproportionately for operators running AI agents at volume. A business operating a single, low-volume advisory agent faces a meaningfully different realistic claims frequency than a business running a high-volume customer-facing agent across multiple markets, where the operator should model the plausible number of claims-worthy events across an entire policy year against the aggregate cap, not simply confirm that any one event falls under the per-claim limit. Armilla's up to USD 25 million per-company limit structure, introduced following its January 2026 capital raise, is priced against exactly this kind of volume and frequency analysis during underwriting, and operators should expect underwriters to ask directly about transaction or interaction volume as part of any submission.^[1]

Reading the schedule, not the headline

Munich Re's aiSure product illustrates why the schedule-level detail, not the single limit figure on the cover page, is where the real coverage picture lives. aiSure structures cover across separate schedules, with Schedule B addressing hallucination-driven output loss and Schedule D addressing autonomous action liability, each of which can carry its own capacity allocation within the EUR, USD, or CAD 15 million of initial capacity made available via the February 2026 Mosaic partnership.^[2] An operator whose primary exposure sits in Schedule D cannot assume the full 15 million figure is available to that category; the schedule-specific allocation is the number that actually governs a Schedule D claim.

The practical process for an operator is to obtain the full schedule of sublimits attached to any AI agent policy before signing, not just the headline limit, and to map each sublimit against the specific trigger categories identified in the operator's own risk profile. The underwriting submission preparation guide on this site sets out the documentation an operator should have ready to support this conversation with a broker or underwriter.

Questions to ask before signing

First, for each of the five trigger categories described in the claims triggers analysis, hallucination loss, autonomous action liability, agent-caused data leakage, intellectual property infringement, and regulatory enforcement, what specific sublimit applies, and is it a shared sublimit across more than one category or a dedicated one.

Second, is the aggregate cap equal to the per-claim limit, meaning the policy effectively pays out in full only once per year, or is the aggregate meaningfully higher than any single per-claim limit, allowing for multiple covered events within the same term.

Third, do sublimits reset separately if the policy is endorsed mid-term to add a new agent or a new authorised action class, or does adding exposure mid-term draw against the same fixed aggregate established at inception.

Fourth, does the regulatory enforcement sublimit cover defence costs only, or does it also extend to any element of an administrative fine that is legally indemnifiable in the relevant jurisdiction, noting that fine indemnity is not permitted in every EU member state.

For the underlying trigger mechanics that these sublimits attach to, see the AI agent claims triggers and coverage gap analysis on this site. For how a certification assessment can strengthen the underwriting conversation around these limits, see agentcertified.eu's analysis of certification and underwriting. For the EU regulatory obligations that drive the regulatory enforcement category specifically, see agentliability.eu's guide to Article 99 penalties and fines.