What Does AI Agent Insurance Cover, and What Does It Cost?
AI agent insurance covers the losses ordinary errors and omissions and cyber policies now exclude. Cover groups into four triggers: hallucination loss (a customer relies on fabricated or wrong output), data leakage (the agent exposes personal or confidential information), harmful output (generated content infringes intellectual property or defames a third party), and faulty tool actions (an agent with authority to act executes a transaction or change that causes loss). Most policies cover both third-party claims and the operator's own first-party costs, and most require the agent to be assessed first.
On cost: pricing is set per submission, not from a rate card. Illustrative 2026 market observations, not guaranteed quotes: roughly EUR 5,000 to 25,000 a year for an SME extension with EUR 1 to 5 million of limit, EUR 25,000 to 120,000 for a mid-market programme with EUR 5 to 15 million, and six figures for enterprise autonomous deployments. Certification against a recognised framework can move terms by something in the order of 10 to 25 percentage points, because it lowers the underwriter's uncertainty.
Key takeaways
- The four coverage triggers are hallucination loss, data leakage, harmful output, and faulty tool actions. A standard cyber or errors and omissions policy was not written for any of them.
- Cost is underwriting-led, not list-priced. The honest range is wide because loss data is thin; the variables that move it are deployment scope, autonomy, sector, and certification posture.
- Certification is the lever a buyer controls. Evidence against ISO/IEC 42001, the NIST AI Risk Management Framework, or AIUC-1 narrows carve-outs and compresses the submission.
- Faulty tool actions, where an autonomous agent executes a transaction in error, are the trigger least likely to be covered by an add-on extension and the clearest reason to look at standalone cover.
- Liability sits with the deployer, not the model provider. The revised Product Liability Directive (Directive (EU) 2024/2853, applying from 9 December 2026) raises the stakes at the same moment insurers are tightening wordings.
Two questions arrive together whenever a European operator looks at AI agent insurance: what does it actually pay for, and what will it cost. The answers are now specific enough to set out plainly. The cover has settled around four loss triggers rather than one, the limits available in the market are visible, and the pricing, while still underwriting-led rather than list-priced, follows a logic that a buyer can read and influence. This page covers all three: the triggers, the limits, and the pricing logic, with the real instruments and cases named, and a clear next step at the end.
None of this is speculative. It draws on wordings already in the market, including the AIUC-1 reference standard, the Munich Re aiSure product schedules, Armilla's AI policy form, and the AI exclusion endorsements now standard on general liability paper. The specifics will keep moving. The structure has settled.
Why AI agents need a separate class of cover
An AI agent is an autonomous software system that can take action on behalf of a person or organisation inside a defined operational scope. That definition is the reason the existing policy lines do not fit. Professional indemnity and errors and omissions cover attach to the work of a professional. Cyber cover attaches to the unauthorised acts of a third party. General liability covers bodily injury and property damage. An autonomous agent is none of those cleanly: it is not a professional, it is not an outside attacker, and it is often not software sold to a customer. It is a decision-making system acting on its own authority inside the insured's own business.
When it causes loss, the policy question is not only who pays but who decided and what the decision was made against. That is the gap purpose-built cover is designed to fill. The emerging wordings separate the underlying technology risk from the action risk and let insurers price them independently. The practical proof that the market treats this as a distinct class is the ElevenLabs policy backed by the AIUC-1 standard, announced on 11 February 2026, the first AI-agent-specific cover of its kind.[5]
The four coverage triggers
Across the published wordings, cover groups into four loss triggers. Each is set out below with what it pays for, the real reference points that shape it, and the exclusions that decide a claim. A fifth section, regulatory penalty defence and indemnity, is covered separately because its availability depends on national law.
A customer relies on output that is fabricated or wrong
The first trigger addresses financial loss when an agent produces output that is factually wrong, fabricated, or unsupported, and a person or system acts on it: a quotation citing a price that does not exist, a summary that misstates a regulatory obligation, a research note that invents a source. The loss is not a cyber event or a professional's negligence. It is a generation error by the agent. AIUC-1 treats hallucination loss as a distinct insured peril and conditions cover on a policy-defined level of human review for specified workflow classes; Munich Re's aiSure addresses the same loss class with defence costs and direct loss indemnity where the output is the proximate cause.
Typically covered
Third-party financial loss where the output was used inside an authorised workflow in the way agreed with the insurer. Defence costs for the resulting claim.
Typically excluded
Losses where human review was required by the schedule and not performed. Cover is a transfer of financial loss, not a guarantee of correctness.
The agent exposes personal or confidential information
The second trigger covers third-party liability from unauthorised disclosure of personal or commercially sensitive information by an agent. Agents leak in ways cyber underwriters have not previously priced: prompt injection can make an agent reveal its context window, training-data exposure can surface content not anticipated at fine-tuning, and cross-tenant contamination can occur where a shared deployment fails to isolate customer data. Armilla's AI policy form treats these as distinct trigger events and sets out how they relate to liability for damage under Article 82 of the GDPR. Cover usually extends to data-subject claims, regulatory claims, forensic investigation, and notification costs.
Typically covered
Privacy and data-subject claims, supervisory investigation costs, breach forensics and notification, where the AI agent is the proximate cause.
Typically excluded
Leakage from failing to apply a published vendor security patch. Breaches originating outside the agent perimeter, where a classical cyber event is the cause.
Generated content infringes or defames a third party
The third trigger addresses claims that an agent's output causes legal harm to a third party: copyright, trade mark, design or database-right infringement, and defamation. The exposure is highest where agents produce customer-facing content, code, imagery, or technical documentation. An agent writing marketing copy can reproduce a protected phrase; an agent writing code can pull a recognisable pattern from its training set. AIUC-1 addresses intellectual property risk directly, and the AI endorsements circulating in the London market provide a broadly comparable framework that carriers and reinsurers are watching closely. This is also the trigger most often capped by a sublimit rather than written at the full policy limit.
Typically covered
Defence and indemnity for infringement or defamation claims, reasonable settlement, and mitigation expenses, frequently subject to a sublimit.
Typically excluded
Deliberate reproduction of protected material on the operator's explicit instruction. Use of models the operator already knows to be trained on unlicensed data.
An agent with authority to act executes a transaction in error
The fourth trigger is the one that most clearly separates AI agent insurance from cyber or professional indemnity, and the one most operators running market-facing or customer-facing agents will need. It covers loss when an agent, acting within its authorised scope, executes a transaction, commitment, or system change that causes loss. The scenarios are concrete: a procurement agent that issues a purchase order against the wrong supplier, a service agent that commits the business to a refund it was not authorised to make, a trading agent that routes an instruction outside the approved venue list. Munich Re's aiSure addresses autonomous action claims under a dedicated schedule, extended in early 2026 to cover procurement agents specifically.
Typically covered
Loss from a mistaken action taken inside the certified scope of the agent, where the required audit telemetry was retained.
Typically excluded
Actions outside the certified scope. Deployments lacking the policy-required telemetry. Circumvention of approval gates. This is the trigger an add-on extension is least likely to reach.
The fifth section: regulatory penalty defence and indemnity
Most European compliance officers ask about this first. Where offered, it covers the cost of defending a supervisory investigation and any insurable penalty under the AI Act, the GDPR, and the revised Product Liability Directive. The catch is that indemnity for a regulatory fine is only available where the underlying law permits a fine to be insured, and in several member states it does not, so the wording has to be read against each national implementation. The AI Act provides for administrative fines up to EUR 35 million or seven per cent of global annual turnover for prohibited-practice breaches under Article 5, and up to EUR 15 million or three per cent for other breaches; the GDPR provides for fines up to EUR 20 million or four per cent of global turnover.[1] A fully drafted section covers supervisory investigations, notice-of-intent proceedings, defence counsel, technical expert witnesses, and corrective-action planning.
The failure mode is rarely the total absence of cover. It is the seam between an extension that excludes the faulty action and a standalone policy nobody bought, with the claim sitting in the gap.
What the cover costs, and the logic underneath the number
There is no rate card for AI agent insurance in 2026, and any page that quotes a single clean figure is guessing. Pricing is set by underwriting review of the specific deployment, because the loss data that would let insurers price from experience does not yet exist at volume. What can be stated honestly is a set of indicative market observations and the variables that move the number. The figures below are illustrative observations, not guaranteed quotes.
| Deployer profile | Indicative annual premium | Indicative limit | Usual shape |
|---|---|---|---|
| SME, limited deployment, lower-risk sector | EUR 5,000 to 25,000 | EUR 1 to 5 million | E&O extension or endorsement |
| Mid-market, several agents, mixed autonomy | EUR 25,000 to 120,000 | EUR 5 to 15 million | Extension or standalone affirmative |
| Enterprise, autonomous agents, multiple sectors | Six figures and above | EUR 15 million and above | Standalone, often syndicated |
The limits available in the market follow the same shape. Cover runs from around EUR 1 million at the lower end of errors and omissions extensions up to about USD 25 million through Armilla's Lloyd's capacity, with Munich Re aiSure observed offering limits in the region of USD 15 million for initial placements. Carrier-specific limit figures should be verified before reliance, as they change with appetite. Sublimits frequently apply to intellectual property infringement, defamation, and privacy breach. Aggregate annual limits are typically set at two to three times the per-occurrence limit, and defence costs may sit inside or outside the limit depending on the product.
The five factors that move the premium
The number is not arbitrary. Five underwriting factors drive it, and four of the five are within the operator's control.
- 1. Deployment scope
- The number of agents, the decision volume they handle, and the jurisdictions they touch. Broader scope, more exposure, higher premium.
- 2. Autonomy envelope
- How independently the agent acts without human review. The faulty-tool-actions trigger is priced almost entirely off this. A human-in-the-loop workflow prices very differently from a fully autonomous one.
- 3. Certification posture
- Whether the deployment is documented against a recognised framework. This is the single largest lever the buyer controls, and the subject of the next section.
- 4. Sector
- High-risk categories under Annex III of the EU AI Act attract sector loadings. An agent in a regulated decision context prices above one drafting internal documents.
- 5. Claims history
- Limited in value today because the loss record is short, but rising in weight as data accumulates. The one factor a new buyer cannot influence.
Why certification is the lever that moves the price
The broadest AI carve-outs in the 2026 market exist for one reason: underwriters cannot yet price AI risk with confidence, so they default to exclusions and sublimits to contain what they cannot measure. The way a buyer changes that is by reducing the underwriter's uncertainty, and the instrument for doing so is documented evidence against a recognised governance framework. Evidence is what lets an underwriter narrow a carve-out, raise a sublimit, or move a line from exclusion toward affirmative cover. Indicative market observations suggest the effect is material, in the order of 10 to 25 percentage points of base premium, depending on the framework, the tier, and the carrier writing the line.
Three frameworks are referenced most often, and they layer rather than compete. ISO/IEC 42001:2023 is the certifiable management-system standard for AI, showing a governed, auditable system around the technology.[4] The NIST AI Risk Management Framework 1.0 is a voluntary lifecycle framework that many programmes run inside an ISO 42001 system, showing risk identification and mitigation across the agent's life. AIUC-1 is narrower and newer: an AI-agent-specific certification from the Artificial Intelligence Underwriting Company, built with technical input from institutions including Stanford, MIT and MITRE, audited first by Schellman, with ElevenLabs as the first certified company. It updates on a quarterly cadence and sits on top of, rather than replacing, standards such as SOC 2 and ISO 27001.[5]
The European supervisory backdrop reinforces the same direction. EIOPA published its Opinion on Artificial Intelligence governance and risk management (reference EIOPA-BoS-25-360) on 6 August 2025. It is addressed to national supervisors, takes a risk-based and proportionate approach, and grounds its expectations in existing law such as Solvency II and the Insurance Distribution Directive rather than creating new rules.[3] The indirect effect on buyers is real: insurers formalising how they use AI also formalise how they assess the AI risk they take on through policies, which increasingly means underwriters ask for governance evidence at submission. Operators who have completed an Agent Certified assessment have already produced much of what an AI underwriter asks for, which shortens the path from a defensive renewal to genuine cover.
Extension or standalone: the shape decides what is covered
The cover reaches the market in two shapes, and the choice between them is not only about price. An extension or endorsement bolted onto an existing errors and omissions or cyber policy is cheaper and faster, but it is usually narrower and capped by an AI sublimit, which preserves cover but limits recovery to a figure below the policy's overall limit. A cyber policy might carry a EUR 5 million aggregate while AI-related losses are subject to a EUR 500,000 sublimit inside it; the claim is covered, but recovery stops at the sublimit. A standalone affirmative AI agent policy addresses the four triggers directly with its own limit and wording.
The deciding factor is usually the faulty-tool-actions trigger. An autonomous agent that executes a transaction in error is the exposure an extension is least likely to reach, because the extension inherits the assumptions of the host policy, which was written for a human decision-maker. An operator running agents that act without human approval should treat standalone cover as the default and an extension as the fallback. The reverse holds for an operator whose agents only draft and recommend, with a person committing every action.
Who is liable, and why the cover matters now
The reason any of this is urgent is that liability already sits with the deployer, and the legal exposure is widening at the same moment insurers are tightening wordings. When an AI agent causes loss, liability falls on the business that deployed it, not on the model provider, because the deployer authorised the agent to act and under ordinary agency principles answers for what it did. The clearest authority is Moffatt v. Air Canada (2024), where the airline was held liable for a discount its chatbot invented.[6] Mata v. Avianca (2023) made the same point in a different register, sanctioning lawyers who relied on fabricated AI-generated case citations.[6]
In the EU the deployer also carries duties under the AI Act, and a defective AI system can trigger strict liability under the revised Product Liability Directive (Directive (EU) 2024/2853), which entered into force on 8 December 2024, must be transposed by member states by 9 December 2026, and applies to products placed on the market or put into service after that date.[2] The directive expressly treats software, including AI, as a product, eases the claimant's burden of proof through rebuttable presumptions of defectiveness, and can make a failure to supply security updates a defect. The transparency duties under Article 50 of the AI Act, which require telling people they are interacting with an AI system and labelling AI-generated content, apply from 2 August 2026 and are not deferred by the Digital Omnibus proposal.[1] The heaviest high-risk obligations carry a more contested timeline: the original date is 2 August 2026, and a deferral to 2 December 2027 was provisionally agreed on 7 May 2026 but, as of mid-June 2026, has not been adopted or published, so the original date remains the law for now.[1]
The net effect is a widening gap. The deployer's exposure is expanding while standard policy wordings are contracting, and AI agent insurance is the instrument that closes the gap, but only for an operator who can show an underwriter how the agent is governed.
What to do now
For any European operator with agents in production, the practical move is to prepare the underwriting evidence before approaching the market, because an underwriting review is an expensive moment to discover that nobody wrote down the scope, kept the telemetry, or mapped the agents to a framework. Four artefacts carry most of the weight: a written definition of each agent's authorised scope, a named governance owner and escalation path, retained audit telemetry of inputs, decisions and outputs, and documentation against a recognised framework. Operators who arrive with those get meaningful quotations. Operators who arrive without them spend the quarter preparing to submit rather than preparing to buy.
The fastest way to produce that evidence is a structured readiness assessment. The Agent Certified readiness pathway maps a deployment against the dimensions an AI underwriter reviews and produces the documentation a submission needs. On this site, the coverage framework sets out the four triggers in more detail, the pre-launch registration places an organisation in the queue for underwriting review, and the weekly Agentic Liability Monitor tracks the carriers writing this risk in Europe. For the underlying liability regime, the sister desks agentliability.eu and agentliability.co track the AI Act, the revised Product Liability Directive, and their implementation across member states.
Frequently asked questions
What does AI agent insurance cover?
It covers the losses ordinary errors and omissions and cyber policies now exclude, grouped into four triggers: hallucination loss, where a customer relies on fabricated or wrong output; data leakage, where the agent exposes personal or confidential information; harmful output, where generated content infringes intellectual property or defames a third party; and faulty tool actions, where an agent with the authority to act executes a transaction or change that causes loss. Most policies cover both third-party claims and the operator's own first-party costs such as incident investigation, and most require the agent to be assessed before cover is written.
What does AI agent insurance cost in 2026?
Pricing is set per submission, not from a rate card, because loss data is still thin. Illustrative market observations, not guaranteed quotes: an SME with a limited deployment in a lower-risk sector may access errors and omissions extension cover in the region of EUR 5,000 to 25,000 a year for limits of EUR 1 to 5 million; a mid-market organisation may see indicative premiums of EUR 25,000 to 120,000 for limits of EUR 5 to 15 million; enterprise deployers running autonomous agents across multiple sectors face six-figure premiums for higher limits. Actual pricing depends on underwriting review of the specific deployment.
Does my existing cyber or E&O policy already cover AI agents?
Usually not, and the gap is widening. Most errors and omissions, cyber, and general liability wordings were written before autonomous agents existed, and through 2026 insurers are adding explicit AI exclusions and sublimits at renewal. Verisk ISO introduced standardised generative AI exclusion endorsements (CG 40 47, CG 40 48, CG 35 08) with a January 2026 edition date for commercial general liability. Errors and omissions is your best existing chance, and only where a human stayed in the loop. Read the endorsement schedule on each line before assuming an AI claim is covered.
What are the coverage triggers for AI agent insurance?
The wordings settle on four. Hallucination loss covers financial harm when output is fabricated or wrong and relied upon inside an authorised workflow. Data leakage covers unauthorised disclosure of personal or confidential information, including through prompt injection. Harmful output covers third-party claims arising from generated content, such as intellectual property infringement or defamation. Faulty tool actions cover loss when an agent with authority to act executes a transaction, commitment, or system change in error. A fifth section, regulatory penalty defence and indemnity, appears where national law permits a fine to be insured.
How does certification affect the price of AI agent insurance?
Certification lowers the price by lowering the underwriter's uncertainty. The broadest AI carve-outs exist because insurers cannot yet price AI risk confidently, so documented evidence against a recognised framework lets an underwriter narrow a carve-out, raise a sublimit, or move from exclusion toward affirmative cover. Indicative observations suggest the effect is in the order of 10 to 25 percentage points of base premium, depending on the framework, the tier, and the carrier. ISO/IEC 42001:2023, the NIST AI Risk Management Framework, and AIUC-1 are the frameworks underwriters reference most.
What policy limits are available for AI agent cover?
Limits run from around EUR 1 million at the lower end of errors and omissions extensions up to about USD 25 million through Armilla's Lloyd's capacity, with Munich Re aiSure observed offering limits in the region of USD 15 million for initial placements (carrier-specific figures should be verified before reliance). Sublimits frequently apply to intellectual property infringement, defamation, and privacy breach. Aggregate annual limits are typically two to three times the per-occurrence limit, and defence costs may sit inside or outside the limit depending on the product.
Does AI agent insurance cover regulatory fines under the EU AI Act or GDPR?
Sometimes, and only where the underlying law allows a fine to be insured, which varies by member state. The EU AI Act provides for administrative fines up to EUR 35 million or seven per cent of global annual turnover for prohibited-practice breaches under Article 5, and up to EUR 15 million or three per cent for other breaches. The GDPR provides for fines up to EUR 20 million or four per cent of global turnover. A regulatory section, where offered, typically covers the cost of defending a supervisory investigation and any insurable penalty, read against the national implementation of each rule.
Who is actually liable when an AI agent causes the loss?
Liability falls on the business that deployed the agent, not on the model provider. The deployer authorised the agent to act, so under ordinary agency principles the deployer answers for what it did, which is why Air Canada was held liable for its chatbot's misstatement in Moffatt v. Air Canada (2024). In the EU the deployer also carries duties under the AI Act, and a defective AI system can trigger strict liability under the revised Product Liability Directive (Directive (EU) 2024/2853), which applies to products placed on the market after 9 December 2026. AI agent insurance is the instrument that lets the deployer transfer part of that exposure.
When will AI agent insurance be available in Europe?
Some cover already exists. The first AI-agent-specific policy backed by the AIUC-1 standard was announced for ElevenLabs on 11 February 2026. Munich Re aiSure and Armilla write AI-related cover into European programmes, and standalone affirmative products are emerging. The honest position in mid-2026 is that no off-the-shelf AI agent liability policy is sold to SMEs by a single European-native carrier yet. What exists is early, enterprise-first, distributed through specialist channels, or written as an extension, with broader availability expected to track the EU AI Act and Product Liability Directive timelines.
What does an underwriter want to see before writing AI agent cover?
Underwriters working from AIUC-1 and comparable frameworks ask four questions: what is the scope of authorised action for each agent, what governance sits around it including a named owner and escalation path, what audit telemetry of inputs, decisions and outputs is retained, and what independent certification exists. The single most useful thing a buyer brings is documentation against a recognised framework such as ISO/IEC 42001 or an Agent Certified assessment, because it shortens the submission and reduces broad carve-outs.
Is AI agent insurance the same as the AI errors and omissions cover my broker mentioned?
Not exactly. Today the cover reaches the market in two shapes. The first is an extension or endorsement bolted onto an existing errors and omissions or cyber policy, which is cheaper but usually narrower and capped by an AI sublimit. The second is a standalone affirmative AI agent policy that addresses the four triggers directly with its own limit and wording. Faulty tool actions, where an autonomous agent executes a transaction in error, are the trigger least likely to be covered by an extension and the clearest reason to look at standalone cover.
References
- Regulation (EU) 2024/1689 (the Artificial Intelligence Act). In force 1 August 2024. Article 5 prohibited practices and Article 4 AI literacy apply from 2 February 2025; GPAI and governance obligations from 2 August 2025; Article 50 transparency obligations from 2 August 2026 (not deferred by the Digital Omnibus proposal). Penalties under Article 99: up to EUR 35 million or 7 per cent of global annual turnover for Article 5 breaches, up to EUR 15 million or 3 per cent for other breaches. High-risk Annex III obligations apply from 2 August 2026 under the original Regulation; a deferral to 2 December 2027 was provisionally agreed on 7 May 2026 but, as of mid-June 2026, has not been adopted or published in the Official Journal, so the original date remains binding.
- Directive (EU) 2024/2853 on liability for defective products (revised Product Liability Directive), repealing Directive 85/374/EEC. Entered into force 8 December 2024; member-state transposition deadline 9 December 2026; applies to products placed on the market or put into service after that date. Expressly includes software and AI systems within the definition of product; introduces rebuttable presumptions of defectiveness; a failure to supply security updates may render a product defective.
- EIOPA. Opinion on Artificial Intelligence governance and risk management, reference EIOPA-BoS-25-360, published 6 August 2025. Addressed to national competent authorities; risk-based and proportionate; grounded in existing sectoral law including Solvency II and the Insurance Distribution Directive. Interpretive guidance, not new rules.
- ISO/IEC 42001:2023, Artificial intelligence management system (AIMS), certifiable international standard. NIST AI Risk Management Framework 1.0 (NIST AI RMF), voluntary lifecycle risk framework, commonly operated inside an ISO 42001 management system.
- AIUC-1, the Artificial Intelligence Underwriting Company (AIUC) standard for AI agents, launched mid-2025, with technical contributors including Stanford, MIT, and MITRE. First accredited auditor: Schellman. First certified company: ElevenLabs. The first AIUC-1-backed AI agent insurance policy was announced for ElevenLabs on 11 February 2026. Quarterly update cadence; positioned to sit on top of SOC 2 and ISO 27001. Munich Re aiSure (performance and parametric AI cover) and Armilla (AI liability and warranty cover, written through Lloyd's capacity) are real market reference points; specific limit figures should be verified before reliance. For operator documentation aligned to these frameworks, see agentcertified.eu.
- Moffatt v. Air Canada, 2024 BCCRT 149 (British Columbia Civil Resolution Tribunal): the airline was held liable for a discount its chatbot invented. Mata v. Avianca, 22-cv-1461 (S.D.N.Y. 2023): lawyers were sanctioned for filing fabricated AI-generated case citations. Both illustrate existing-law liability for AI outputs and are not rulings under the AI Act.