EIOPA's February 2026 AI Survey. What the results mean for enterprises seeking coverage.

What the EIOPA February 2026 survey found

The European Insurance and Occupational Pensions Authority published its survey on generative AI in the European insurance sector on 2 February 2026. It covers 347 undertakings across 25 countries, which makes it the broadest picture available of where European insurers actually are with this technology. Its findings are instructive for enterprises on both sides of the AI liability equation: those that use AI and want to insure it, and those that write insurance and need to understand the risk they are covering.

Nearly two thirds of undertakings are actively using generative AI. The weight of that use sits behind the counter rather than in front of it: 64 percent of use cases are back-end productivity work, and 36 percent are customer facing. The governance picture moved faster than the deployment picture. 49 percent now have a dedicated AI policy in place, up from about 25 percent in 2023, close to a doubling in three years. Asked what worries them, insurers named hallucinations and inaccurate outputs first, then cybersecurity, then data protection.

Read together, those numbers describe an industry that has decided AI is real, has started writing the rules for its own use of it, and has kept most of it away from the customer while it does. That is a cautious posture, and the caution is the point. It is also the reason the survey is worth citing precisely rather than loosely: the figures measure insurers governing their own AI, not insurers preparing to underwrite yours.

The implication for an enterprise seeking cover runs in two directions, and the second is the more useful one. A carrier still keeping most of its own AI in back-office roles is unlikely to have the actuarial models and underwriting criteria to price AI liability for external clients with confidence, which is part of why the European product shelf is still short. But a carrier that has written a dedicated AI policy for itself has built the vocabulary, and half of them now have. An underwriter who has had to define acceptable AI use inside their own firm can read a governance file from yours. That capability arrives before the product does, and it is the reason a documented deployment is worth preparing now rather than when a European product finally lists.

The gap between enterprise demand and European insurer readiness

Across the globe, demand for AI liability coverage is being driven by enterprises that have deployed AI agents in consequential roles and are beginning to understand the exposure they have created. The US market has moved first: the Artificial Intelligence Underwriting Company launched from stealth in July 2025 with a USD 15 million seed round led by Nat Friedman at NFDG, Munich Re's aiSure is underwritten and marketed by Mosaic Insurance with up to EUR/USD/CAD 15 million in initial capacity, and Armilla's standalone AI Liability Policy carries limits of up to $25 million per organisation. ElevenLabs secured a first-of-its-kind AI agent insurance policy backed by AIUC-1 certification.

The European market is forming more slowly. The EU AI Act creates a compliance deadline rather than an immediate litigation shock. European enterprises are managing the compliance question first and the coverage question second. This sequencing means that European demand for AI liability coverage is building toward the August 2026 enforcement date but has not yet peaked. European insurers reading the EIOPA survey data are making the rational calculation that the market will form, but they have time before the peak.

The result is a gap. Enterprise demand is building. Insurer product readiness is developing. Between those two curves, enterprises seeking coverage in mid-2026 will find a market that is more constrained than the US equivalent. This is not a reason to delay. It is a reason to build the documentation that will make an enterprise coverable when products become available, rather than waiting and assembling governance records in response to an underwriter's questionnaire under time pressure.

What EIOPA's governance opinion requires of European insurers

EIOPA's opinion of 6 August 2025 on artificial intelligence governance and risk management is a supervisory statement, not a binding regulation. But supervisory statements from EIOPA carry practical force because they define how the Authority expects national competent authorities to interpret existing binding requirements (Solvency II, IDD, DORA, GDPR) when applied to AI systems.

The opinion establishes that European insurers must apply the same governance standards to AI systems that they apply to other material risk systems. This covers four areas. First, risk management: AI systems used in consequential functions must be subject to documented risk assessment, validation, and approval processes consistent with the insurer's existing risk management framework. Second, model validation: AI models used in underwriting, pricing, or claims must be validated with the same discipline as actuarial models, with documented validation reports and defined re-validation triggers. Third, explainability: decision support AI must be explainable to the standard necessary to comply with policyholder explanation rights under IDD and GDPR. Fourth, accountability: there must be clear ownership of AI systems at the senior management level, with defined escalation paths when AI-driven decisions produce unexpected outcomes.

This internal governance requirement shapes how European insurers will approach AI risk assessment for clients. An insurer whose own AI governance follows EIOPA's framework will use the same conceptual toolkit when evaluating an enterprise client's AI governance documentation for underwriting purposes. This creates a practical alignment: enterprises that have built governance documentation consistent with the EIOPA framework will present evidence that European underwriters are equipped to evaluate.

What the major players are planning for H2 2026

Based on publicly available statements and market intelligence, the AI liability coverage landscape in Europe for H2 2026 is expected to take the following shape.

Munich Re's aiSure, underwritten and marketed by Mosaic Insurance since their partnership was announced on 26 February 2026, is the most likely first mover for structured AI liability coverage in the European enterprise market. aiSure settles on measurable performance data: coverage responds to measured performance deviations rather than a lengthy liability investigation. This model requires actuarial data on the deployer's system performance, which connects directly to the monitoring records that the EU AI Act's Article 26(3) and Article 72 require. An enterprise with a monitoring record can supply the performance data that aiSure's coverage model depends on.

Armilla, a Lloyd's coverholder, names AI regulatory violations in its standalone AI Liability Policy, covering defence costs and insurable fines arising from investigations under regulations including the EU AI Act. That is a meaningful product development for the European market, with the standing caveat that administrative fines themselves are uninsurable on public policy grounds in most member states. Armilla's model requires a technical evaluation and governance documentation before cover is written, which is the structural link between readiness and insurability. A European equivalent, when it arrives, will require documentation that maps to EU AI Act requirements specifically.

The Lloyd's market has been circulating draft AI endorsements for consultation among syndicates and managing agents. These endorsements, which would extend existing professional liability and technology errors and omissions policies to cover AI-specific losses, are expected to reach the market in Q3 2026. The endorsements are likely to follow the AIUC-1 structure in requiring governance documentation as a condition of coverage.

European domestic carriers (Allianz, AXA, Zurich, Generali) have not yet announced dedicated AI liability products as of May 2026. Their entry into the AI liability market is more likely in 2027, once the enforcement landscape has crystallised and actuarial data from the first year of claims is available.

What enterprises should build now

The coverage market for European enterprises is forming around a predictable set of underwriting requirements, which are simultaneously the compliance requirements of the EU AI Act. Building compliance documentation and building an insurance submission are the same activity if approached correctly.

Four document categories are consistently required across all the emerging AI liability products. First, technical documentation: the Annex IV documentation received from the AI provider, covering system design, training data governance, testing results, and known limitations. Second, monitoring records: documented evidence that the system was monitored in production, what was found, and how incidents were handled. Third, governance evidence: a description of the oversight structure, the personnel responsible for the system, their training and authority, and the escalation process. Fourth, incident documentation: a record of any incidents involving the system, their nature, their handling, and their resolution.

Enterprises that have these four categories of documentation assembled before they approach a European insurer in Q3 2026 will be presenting the equivalent of a completed underwriting questionnaire. The insurer's assessment work is largely done. This position creates pricing leverage, accelerated underwriting timelines, and a higher probability of obtaining coverage at the first available product launch.

For the regulatory documentation requirements that feed this insurance preparation, see the Article 26 deployer obligations guide on agentliability.eu. For the certification framework that structures this documentation systematically, see the Agent Certified methodology.

Frequently asked questions