Hunton Insurance Recovery Blog

The recent wave of "rogue AI" incidents should be a wake-up call for every business leader and risk manager paying attention.

Recent accounts document a sobering reality: AI systems from multiple leading AI developers have each escaped controlled testing environments and caused real-world harm—compromising outside infrastructure, exploiting third-party vulnerabilities, and even canceling another person's reservation to help a user jump a waitlist. These aren't hypotheticals from a sci-fi movie. They happened this summer.

The core liability risk is clear. When an AI system exceeds its instructions and causes harm, companies can't simply point to the technology's "autonomy" and walk away. And when accountability is on the line, it’s the company and its management that must explain how their human decisions gave the system its objective, its access, and its room to act.

The jury pool isn't starting from zero. Pew Research found that 59 percent of Americans have little or no confidence in companies to develop AI responsibly, and a Reuters/Ipsos poll found 67 percent believe AI will produce consequences people ultimately can't control. Corporate defendants are walking into courtrooms with a credibility deficit before opening statements.

So what does this mean from an insurance standpoint? A few things worth thinking through:

• Coverage gaps are real. Insurers contend that traditional general liability and professional liability policies weren't written with autonomous AI behavior in mind. According to insurers, if an AI system independently causes harm such as discrimination, privacy violations, or mental health injuries, there are genuine questions about whether existing policies respond, particularly around intent-based exclusions and "expected or intended" injury language. Ordinary rules of insurance policy interpretation suggest a more policyholder-favored outcome.  It is critical, therefore, that companies facing AI-related liability consult with experienced coverage counsel familiar with the rules of insurance policy interpretation and the historical evolution of traditional and emerging insurance policies.
• Cyber liability policies may not be enough. Recently reported incidents involve AI systems breaching external infrastructure. That's a cyber event, but it's also a product liability event, a professional liability event, and potentially an errors and omissions event all at once. Single-silo coverage won't cut it. Policyholders must think broadly when facing AI liabilities.
• Third-party and vendor risk is a blind spot. When multiple companies control different parts of an AI system such as the developer, the evaluation vendor, and the deployment customer, responsibility fragments. Contractual indemnification and additional insured provisions must be examined closely. If everyone's pointing fingers, the insurance program better not have the same gaps as the org chart.
• Directors and officers (D&O) exposure is growing. If public opinion data is any indication, boards that failed to demand adequate AI governance before deployment could face derivative claims. The scenario worsens for companies that are actually deploying AI bots to their boards and management teams. Yes, you read that correctly. See, for example, Icecat, an NPEX-listed company, and its newest AI board member, Elsa Frozenbrain, who also happens to be the company’s chief AI officer.

Practical takeaways for business leaders and risk managers:

• Conduct a thorough review of your current insurance program against AI-specific risk scenarios, such as autonomous behavior, third-party harm, discrimination claims, and mental health injuries. Identify the gaps now, not after a loss.
• Push for clear contractual allocation of AI-related liabilities across your vendor and partner ecosystem.
• Treat AI governance documentation, such as safeguard protocols, monitoring systems, and testing procedures as litigation exhibits, because that's what they'll become. Jurors will want to see what you did before the incident.
• Engage your broker and coverage counsel on emerging AI endorsements and standalone AI liability products. The market is evolving quickly, and early movers will have better options and pricing.

The companies that get ahead of this won't just be managing risk; they'll be building the governance infrastructure that could become the standard of care. The ones that don't may find themselves explaining to a jury why they deployed a system they couldn't fully control.