Coalition affirmative AI coverage: scope, triggers, and what the European market still lacks.

Coalition is a US cyber insurer that put explicit AI language into its cyber form in March 2024, and its endorsement is now the most cited example of affirmative AI coverage in the market. It is also narrower than its reputation. This analysis reads what the endorsement actually triggers on, why the gap between its name and its wording matters to a buyer, and what European operators can and cannot reach today.

What Coalition is and why its AI language matters

Coalition was founded in 2017 as a cyber insurance managing general agent and has since obtained admitted carrier status in most US states, writing on surplus lines paper where admitted placement is not available. Coalition positions itself as an active risk management partner rather than a passive indemnifier, providing attack surface monitoring and threat intelligence to policyholders alongside traditional coverage.

Coalition's AI language emerged from the same market problem that drove Counterpart's November 2025 expansion: standard cyber and technology errors and omissions policies were written for a world in which the primary insured technology risk was network intrusion, data breach and ransomware. When AI systems became consequential participants in professional decisions, financial outputs, and customer-facing interactions, the standard policy language produced coverage uncertainty. Carriers and insureds disagreed at claim time about whether an AI-generated output error was a covered cyber event, a professional liability error, or an uninsured technology performance failure.

The two carriers answered it in different places. Coalition amended its cyber form, so the AI losses it reaches are cyber claims sitting inside the cyber limit rather than a distinct product. Counterpart went to professional liability, adding a technology errors and omissions insuring agreement across its miscellaneous professional liability and allied health products. Where a carrier chose to put its AI language tells you which failure mode it thinks it is insuring, and neither choice covers the other's half.

What the affirmative AI language covers (US product)

Note: The following coverage description refers to Coalition's US product. This coverage is not available to European-domiciled enterprises through standard direct placement.

Coalition's Affirmative Artificial Intelligence (AI) Endorsement was published on 26 March 2024 and attaches to its US Surplus and Canada cyber insurance policies. It is worth reading precisely, because the name promises more than the wording delivers, and the gap between the two is the most useful thing in it. The endorsement does two things.

It widens the security failure and data breach definition. The definition is expanded to include an AI security event, meaning one where artificial intelligence technology caused a failure of computer systems' security. The effect is to close an argument rather than to open a new coverage grant: where a security failure has an AI system somewhere in its causal chain, the insured no longer has to establish that the event still counts as a security failure in the traditional sense.

It widens the funds transfer fraud trigger. The trigger is expanded to cover a fraudulent instruction transmitted through the use of deepfakes or any other artificial intelligence technology. This is the limb with the clearest claims logic behind it. Social engineering fraud has always turned on whether an instruction was genuine, and synthetic voice and video attack exactly that question, so a policy that stays silent on deepfakes invites a dispute at the worst possible moment.

What the endorsement does not do is equally important, and it is the reason the market's shorthand is misleading. It is a cyber and fraud extension. It does not respond to financial loss caused by an AI producing a wrong answer that somebody relied on. The hallucinated citation filed with a court (Mata v. Avianca, 22-cv-1461, S.D.N.Y. 2023) and the chatbot that misstated a fare rule to a customer (Moffatt v. Air Canada, Civil Resolution Tribunal, British Columbia, 2024) are the canonical AI liability scenarios, and neither is a cyber event. They sit on the professional liability side, which is why Counterpart's November 2025 expansion went to miscellaneous professional liability and allied health rather than to a cyber form. Two carriers, two different halves of the same problem.

The structural consequence is that AI perils reached through this endorsement sit within the cyber limit rather than in a standalone limit. An insured carrying both cyber and technology errors and omissions cover should know which limit an AI-caused loss will erode before the loss happens, not after.

What the coverage does not cover

Beyond the output-error gap already described, the endorsement addresses AI within the insured's own technology operations. It does not reach losses caused by AI systems the insured does not operate, third-party AI infrastructure failures, or losses arising from an AI system's intended outputs rather than its unintended errors. If an AI system performs exactly as designed but the design was legally non-compliant with EU AI Act requirements, the resulting regulatory fine is not a covered loss, and in most member states would be uninsurable in any event.

Physical injury and property damage arising from AI system failures are not within the cyber framework and would require separate product liability placement. For European enterprises deploying AI systems in high-risk categories under Regulation (EU) 2024/1689 Annex III, including systems used in safety components of products, infrastructure management, or employment decisions, the product liability exposure under Directive 2024/2853 runs separately from any cyber coverage.

AI systems used in medical diagnostics, mental health applications, and autonomous safety-critical systems typically fall outside standard carrier appetite for AI endorsements, including Coalition's. This exclusion pattern is consistent across Counterpart, Armilla, and Munich Re aiSure. For a detailed map of what current AI insurance products do and do not cover across all these providers, see the full guide to what AI agent insurance covers and costs.

The governance evidence Coalition requires

Coalition's underwriting process for accounts where AI coverage is material includes supplemental questions directed at the AI governance posture of the applicant. The questions are structured around the same evidence categories that well-designed AI compliance programmes produce. The practical overlap with EU AI Act compliance documentation is substantial.

Coalition asks for an inventory of AI systems the applicant operates. This maps directly to the technical documentation requirement under EU AI Act Article 11, which requires providers of high-risk AI systems to maintain technical files covering system purpose, architecture, and training data. For deployers of high-risk systems, Article 26 of Regulation (EU) 2024/1689 requires maintaining logs, monitoring plans, and human oversight procedures. Both the regulation and the underwriting application want the same starting point: a documented list of what AI systems exist and what they do.

Coalition asks about output monitoring. Article 9(1)(d) of Regulation (EU) 2024/1689 requires a risk management system that includes evaluation of the AI system in light of data obtained from post-market monitoring. Coalition's underwriting equivalent asks whether the applicant monitors AI outputs for accuracy, drift, and anomalous behaviour. An enterprise with a functioning post-market monitoring programme as required by the EU AI Act has the documentation to answer this question with specificity.

Coalition asks about incident response for AI failures. The EU AI Act under Article 73 requires providers and certain deployers of high-risk systems to report serious incidents to national market surveillance authorities. A reporting procedure requires an internal incident detection and escalation process to exist before the report can be made. Coalition's question on incident response asks whether that process exists.

The overlap is not coincidental. Both the EU AI Act compliance framework and insurance underwriting for AI coverage are attempting to answer the same question: does this enterprise understand what its AI systems are doing, monitor whether they are doing it correctly, and have a process for responding when they fail? An enterprise that can answer yes with documentation is both a better compliance subject and a better insurance risk.

The European market gap

Coalition's endorsement has been available on US Surplus and Canada cyber policies since 26 March 2024. As of August 2026, no admitted domestic European carrier has published a comparably structured affirmative AI endorsement with named trigger conditions and standard policy terms available to European-domiciled enterprises through normal broker distribution.

This is the European market gap. It is not that European enterprises cannot obtain any coverage for AI-caused losses. They can, through three current routes.

Armilla, as a Lloyd's coverholder backed by Chaucer, offers affirmative AI coverage to enterprises including those domiciled in Europe. Armilla's evaluation process involves technical testing of the AI system as well as governance documentation review. Limits run to USD 25 million per organisation. Access is through Lloyd's broker channels, not through standard direct domestic placement. Armilla explicitly excludes medical diagnostics, mental health, and autonomous vehicle applications, consistent with the sector-wide pattern.

Munich Re aiSure offers AI performance insurance. Unlike Coalition's occurrence-based trigger model, aiSure settles claims on measured performance data: if an AI system's accuracy or output quality drops below a defined threshold for a defined period, settlement follows without requiring the insured to prove causal loss from a specific incident. This is a materially different coverage architecture. It removes the causation proof problem but requires the insured to define measurable performance metrics at underwriting. Munich Re's European market presence makes aiSure accessible to EU enterprises; access routes and availability for SME accounts vary and should be confirmed with a specialist broker.

Lloyd's market cyber products with bespoke AI language, placed through specialist London market brokers, can be tailored to include explicit AI coverage provisions for larger European accounts. This is not a standard product with published trigger language. It is a manuscript policy drafted to the account's specific needs, which requires a minimum account size and specialist broker involvement to be practical.

The gap Coalition's product illustrates is the absence of a standard admitted domestic European cyber or tech E&O product with published affirmative AI trigger language, available through normal broker distribution, at SME-relevant premium levels. European insurers are not standing still, but the evidence of that is about their own operations rather than their product shelves. EIOPA's survey published on 2 February 2026, covering 347 undertakings across 25 countries, found nearly two thirds actively using generative AI and 49 percent with a dedicated AI policy in place, up from about 25 percent in 2023. That is an industry building the internal governance capacity a new line requires. It is not the same as a product an operator can buy, and it should not be read as one.

For a current tracker of which AI insurance providers are active in the European market and what they offer, see the European AI agent insurance market tracker, June 2026.

The regulatory pressure that is driving demand

The European demand for Coalition-equivalent coverage is not hypothetical. It is driven by two converging regulatory instruments.

Regulation (EU) 2024/1689, the EU AI Act, creates a tiered compliance framework that imposes the heaviest obligations on high-risk AI systems defined in Annex III. These include AI systems used in critical infrastructure management, education and vocational training, employment and workforce management, access to essential private and public services, law enforcement, migration and border control, administration of justice, and democratic processes. Deployers of high-risk systems face obligations under Article 26 that include implementing monitoring plans, maintaining logs, and reporting serious incidents to national competent authorities. Non-compliance exposes deployers to fines of up to EUR 15 million or 3% of global annual turnover.

The high-risk provisions were originally scheduled to apply from 2 August 2026. A provisional deferral to 2 December 2027 was agreed under the Digital Omnibus legislative package on 7 May 2026. This deferral is not yet formally adopted: the legislative process must conclude before the new date binds. Until formal adoption, the original 2 August 2026 date remains in force. Enterprises that are waiting for the deferral to be formally confirmed before beginning compliance work are taking regulatory risk that may not materialise into enforcement, but also may.

Directive 2024/2853 on liability for defective products, which entered into force on 9 December 2024 with a three-year transposition deadline, extends strict product liability to software and AI systems. Under the revised directive, a damaged party does not need to prove fault, only damage, a defect, and a causal link. The rebuttable presumption of defect provisions further reduce the evidentiary burden for plaintiffs. For European enterprises deploying AI systems in contexts where a software defect could cause harm to consumers, the Product Liability Directive creates a direct financial exposure that affirmative AI coverage in a liability product would address.

The combination of EU AI Act enforcement obligations and Product Liability Directive exposure creates a specific need for European affirmative AI coverage that maps to the compliance framework. Coalition's US product illustrates what that coverage looks like at the product level. The question for European operators is when a domestic admitted product with equivalent trigger language will be available, and what they do in the interim.

For the current state of how professional indemnity and cyber products in Europe are addressing this space, and where the gaps remain, see the analysis of AI exclusions in cyber and E&O policies.

For how Coalition's approach compares to the Lloyd's market capacity being built through specialist coverholders for European accounts, see the Lloyd's London AI insurance capacity analysis for Europe 2026 on Agent Liability.

Five questions every European operator must put to their broker

In the absence of a standard admitted European product with Coalition-equivalent affirmative AI language, European operators purchasing cyber or tech E&O coverage need to verify the coverage position themselves. The following five questions should be put to any broker placing AI-adjacent coverage for a European enterprise in 2026.

Question one: Is AI coverage affirmative or implicit? Ask the broker to identify the specific policy clause or endorsement that covers AI-caused losses. If the answer is that AI losses are covered because there is no AI exclusion, the coverage is implicit. Implicit coverage means the coverage position will be litigated at claim time. Affirmative coverage means there is a named peril clause. Only accept the answer that identifies a specific clause.

Question two: Which AI failure modes are named triggers? Affirmative AI coverage that only covers AI hallucinations does not cover autonomous decision errors or AI data manipulation. Ask for the complete list of AI failure modes that are named as covered triggers. Any failure mode not named should be treated as potentially excluded or ambiguous.

Question three: What governance documentation is required at underwriting and at claim stage? Many coverage disputes arise because the insured provided different information at underwriting and at claim time. Ask the broker to confirm what governance documentation will be required if an AI claim is made, and verify that the enterprise has that documentation now. If the claim will require evidence of pre-deployment testing and the enterprise does not have pre-deployment testing records, the claim is at risk regardless of what the policy language says.

Question four: Is the trigger occurrence-based or claims-made, and how does it interact with AI system updates? AI systems are updated continuously. An occurrence-based trigger requires the loss-causing AI failure to occur during the policy period. A claims-made trigger requires the claim to be made during the policy period. If the AI system was updated between the failure and the claim, the question of which policy period applies becomes contested. Ask the broker how the carrier treats AI system version history in claim disputes.

Question five: Does the policy contain a silent AI exposure clause? Some cyber policies include broad technology exclusions or AI-adjacent language that could be invoked to dispute AI claims even where no explicit AI exclusion exists. Ask the broker to confirm that there is no policy language that could be read to exclude losses where an AI system was involved, other than named exclusions clearly communicated at placement. Silent exclusions that are invoked at claim time are among the most commercially damaging coverage outcomes.

What Coalition's position signals about where the market is going

Coalition is not alone among US insurtechs in moving toward affirmative AI language. Counterpart's November 2025 expansion, AIUC-1's certification-backed coverage structure behind the ElevenLabs policy, and the growing Lloyd's market capacity for European accounts through Armilla all reflect the same structural shift: AI coverage is becoming a named product category rather than an ambiguous gap in existing products.

Market-size projections for AI insurance circulate widely, and this desk has stopped repeating them. A figure attributing a category forecast for 2030 to the Artificial Intelligence Underwriting Company appeared in an earlier version of this article; it is not published at aiuc.com, checked 17 August 2026, and has been removed. The directional claim underneath it survives without any forecast, because it can be counted rather than estimated: new named products are being introduced, published capacity is growing, and underwriting standards are being codified into referenceable frameworks. Those three are observable. A number for 2030 is not.

For European operators, the signal is time-sensitive. The US market is approximately 18 to 24 months ahead of the European market in developing standard affirmative AI coverage products. The governance documentation required to access US-market products through Lloyd's broker channels is the same documentation that EU AI Act compliance requires. European enterprises that spend 2026 building AI governance documentation are not only preparing for regulatory compliance; they are also building the underwriting submission that will qualify them for coverage when domestic European products become available.

The window in which "no standard AI-specific coverage exists in Europe" is closing. The window in which enterprises can build governance documentation ahead of regulatory deadlines is also narrowing, whether the high-risk AI provisions apply in August 2026 or December 2027. Both timelines favour starting now.