US carrier AI exclusion filings and what they mean for European buyers

In late 2025, three major US commercial carriers, AIG, Great American and WR Berkley, filed with US state insurance regulators to add or broaden AI-specific exclusions within their standard errors and omissions, directors and officers, and cyber insurance policies. The filings mark the practical end of what the market calls silent AI coverage, the period in which AI-related losses were arguably covered by omission rather than by design. For European enterprises, the filings matter well beyond US borders, particularly where coverage runs through a US-issued global insurance programme.

Why the exclusion trend matters

For several years, standard commercial policies did not mention artificial intelligence at all. A professional indemnity, directors and officers, or cyber policy written in 2021 or 2022 simply had no AI-specific language, favourable or otherwise. When an AI-related loss occurred, the coverage question turned on general policy wording never drafted with AI in mind. In practice, this ambiguity sometimes worked in the policyholder's favour: a loss connected to an AI system could be argued as covered because nothing in the policy said otherwise.

That period is ending. Carriers cannot price a risk they have not defined, and AI-related losses have accumulated enough visibility, through litigation, regulatory activity and internal claims data, that insurers are no longer willing to carry the ambiguity forward. The response is not to build new AI-specific products inside the standard commercial lines book. It is to write explicit exclusions into the policies that already exist, removing the ambiguity by removing the coverage. That is precisely what the AIG, Great American and WR Berkley filings do.

This matters because these three carriers, together with the other large US commercial lines writers likely to follow the same pattern, represent a meaningful share of the E&O, D&O and cyber market that both US and multinational European enterprises rely on. When exclusion language becomes standard in this segment of the market, the burden shifts onto the buyer to either accept the reduced coverage or actively seek out affirmative AI coverage elsewhere.

What AIG, Great American and WR Berkley filed, and why

In each case, the carrier submitted regulatory filings to US state insurance departments seeking approval to add or broaden AI-specific exclusion language across relevant commercial lines, principally errors and omissions, directors and officers, and cyber policies. A regulatory filing of this kind is a formal step required before new or amended policy wording can be issued to policyholders in a given state. It is not itself an announcement of a finished, market-wide product change, but it is a clear and public signal of underwriting direction, and once approved, it becomes the wording that policyholders receive at their next renewal.

The underlying rationale is consistent across all three filings and across the wider market they represent. AI-related losses, whether from model errors, hallucinated outputs, biased automated decisions, or AI-enabled fraud such as deepfakes, do not fit neatly into loss categories that standard E&O, D&O and cyber wordings were built around. Directors and officers coverage was built around business judgment and disclosure failures by human decision-makers. Errors and omissions coverage was built around professional services delivered by identifiable professionals. Cyber coverage was built around data breach and network security incidents. An AI system that makes an autonomous decision, generates a flawed output, or is used to commit fraud does not map cleanly onto any of those categories, and carriers have concluded that leaving the question unresolved in policy wording is no longer an acceptable position to underwrite from.

Broadening the exclusion, rather than leaving the ambiguity in place, is the carrier's way of forcing the AI-related risk question into the open. Policyholders who want AI-related losses covered must now ask for it explicitly, either through a negotiated endorsement back onto their existing policy or through a standalone AI liability product from a specialist provider. For a fuller account of how this kind of exclusion language is typically drafted and where it commonly appears in cyber and professional indemnity wordings, see the dedicated analysis on how AI exclusions are appearing in cyber and E&O policies.

The bifurcating market: exclusions on one side, affirmative coverage on the other

The AIG, Great American and WR Berkley filings are best understood as one half of a structural split now visible across the commercial insurance market. On one side, the mainstream market, represented by these carriers and others following the same underwriting logic, is narrowing what standard policies cover by writing AI out of them. On the other side, a small but growing specialist market is building products that explicitly write AI back in, on carefully underwritten terms.

The clearest example of the affirmative side is AIUC, the Artificial Intelligence Underwriting Company, founded in 2024 and launched from stealth in July 2025 with fifteen million dollars in seed funding from investors including Nat Friedman's NFDG, Emergence, Terrain, and Anthropic's Ben Mann. AIUC's model pairs an audit standard, AIUC-1, with an insurance product, so that a company's AI systems are assessed against a defined standard before a policy is written against them. ElevenLabs became the first AIUC-1-backed policyholder in February 2026, an early proof point for the audit-plus-insurance structure.

Munich Re aiSure takes a different approach, offering parametric AI performance insurance, coverage triggered by defined performance failures rather than by proving fault or negligence in the traditional liability sense. Munich Re has offered AI performance coverage since 2018 and extended it to large language model risk specifically from 2019. The product is distributed in part through a partnership with Mosaic Insurance, which provides coverage up to fifteen million euros, dollars, or Canadian dollars. Armilla, a Toronto-based Lloyd's coverholder backed by Chaucer and Axis Capital, offers up to twenty five million dollars in coverage per company following a January 2026 capacity expansion, and explicitly covers EU AI Act regulatory violations for European clients, while excluding medical diagnostics and mental health applications from its scope. Counterpart launched its Affirmative AI Coverage product in November 2025, covering miscellaneous professional liability, allied health and technology E&O, with triggers that include hallucinations, misclassification, hiring bias and deepfake fraud, backed by Aspen, Markel and Westfield Specialty.

The demand driving this specialist market's growth is precisely the exclusion trend on the mainstream side. As AIG, Great American, WR Berkley and other large carriers close off silent coverage in their standard policies, the enterprises that still need AI-related protection have nowhere else to go except the specialist providers building affirmative products from first principles. Related coverage on this dynamic is set out in the analysis of the bifurcation between retreating E&O and specialist AI coverage, and in the broader AI liability insurance market map published on this platform.

Why this affects European buyers specifically

A natural first reaction for a European risk or compliance team is to treat this as a US market development with limited relevance at home. That reaction misses a structural feature of how many European enterprises actually buy their commercial insurance. A significant share of European businesses with US operations, a US-domiciled parent company, or membership in a wider multinational group are covered not through a locally issued European policy alone, but through a US-issued or US-coordinated global insurance programme, a common structure for groups seeking consistent terms and centralised risk management across jurisdictions.

Where that structure exists, a European subsidiary's coverage is directly affected by what its US parent's policy contains, even though the subsidiary itself may have no US operations, no US employees, and no direct relationship with the US regulator that approved the exclusion filing. If the parent's US-issued E&O, D&O or cyber policy now contains a broadened AI exclusion that was not there a year or two ago, the European subsidiary's protection under that same global programme has narrowed too, and it has narrowed without any local European event triggering it.

This is a coverage gap that a European risk team can easily miss if it audits only European-domestic policies and assumes the global programme is a settled, static arrangement. It is not. Global insurance programmes are renewed on the same underwriting cycles as the policies feeding into them, and wording changes at the US parent level flow through to every entity covered under that programme.

The timing compounds the exposure. Regulation (EU) 2024/1689, the EU AI Act, becomes fully applicable from 2 August 2026, with provider obligations under Articles 9 to 17 and deployer obligations under Article 26 creating new compliance-driven liability for any organisation operating AI systems in scope. The revised Product Liability Directive, Directive 2024/2853, applies from 9 December 2026 and extends strict product liability to AI software. European enterprises are entering a period of materially higher AI-related liability exposure at precisely the moment their US-linked coverage may be narrowing rather than expanding to meet it. For the deployer obligation dimension of this exposure in detail, see the Article 26 analysis on agentliability.eu.

Where affirmative coverage is available now

European enterprises that find an AI exclusion has appeared in their US-linked or US-parent coverage are not without options, but the options sit in the specialist market rather than in a renewed conversation with the mainstream carrier that just excluded the risk. AIUC's audit-plus-insurance model is one route, particularly for enterprises willing to certify their AI systems against the AIUC-1 standard as part of securing cover. Munich Re aiSure's parametric structure suits enterprises that can define measurable AI performance benchmarks and want a claims process triggered by objective performance failure rather than a fault-based liability dispute.

Armilla's Lloyd's-backed programme is the most directly relevant option for European buyers concerned specifically about EU AI Act exposure, since its coverage explicitly extends to regulatory violations under the Act, a feature not all specialist providers offer. Counterpart's Affirmative AI Coverage, while built primarily around the US market structure of miscellaneous professional liability and technology E&O, is accessible to European enterprises through specialty brokers with transatlantic placement capability. Full coverage comparisons for each of these providers are available in the dedicated analyses of Munich Re aiSure, Armilla's Lloyd's coverholder programme, and Counterpart's affirmative AI coverage product on this platform.

None of these specialist providers underwrite on the basis of a self-reported claim of good AI governance. Each expects documented evidence: risk management processes, technical documentation, model testing records, and human oversight arrangements consistent with what the EU AI Act already requires of providers and deployers. The overlap between regulatory compliance evidence and insurance underwriting evidence is not incidental. It is the single most useful fact for a European risk team to act on.

What European risk and compliance teams should do now

The first and most immediate task is an audit, not of the European-domestic insurance book alone, but of every US-issued or US-parent global insurance programme that covers a European entity. That audit should specifically ask whether AI exclusion language has been added or broadened at the most recent renewal, and if so, what triggered the change and what, if anything, it means for the European entities sitting under that programme.

The second task is to resist the assumption that a European-issued policy is safe purely because a given exclusion filing was made with a US state regulator rather than a European one. Insurance regulation is jurisdictional, and a US filing does not itself change a European-issued policy's wording. But many multinational insurers, once they have developed a piece of exclusion language for one part of their book, apply a consistent version of it globally as local approvals allow. A European risk team should ask its carrier directly whether equivalent AI exclusion wording is being introduced, or has already been introduced, into the European-issued policy, rather than inferring safety from geography alone.

The third task is to treat EU AI Act compliance documentation and independent certification evidence as the working currency for the next stage of the market, whichever side of the split an enterprise ends up on. Whether the goal is negotiating an affirmative AI endorsement back onto an existing mainstream policy or securing terms from AIUC, Munich Re aiSure, Armilla or Counterpart, the underwriting conversation increasingly turns on the same evidence: documented risk management under Articles 9 to 17, human oversight arrangements, and, where available, independent verification of governance quality. An independent assessment against a recognised certification standard converts a self-reported compliance claim into third-party-verified evidence, materially changing how an underwriter weighs the risk. For the certification dimension of this evidence chain, see agentcertified.eu. For the broader coverage decision framework, see the Agent Insured coverage framework, and to track this market as it develops, see the Agent Insured waitlist.