By Emmanuèle Lutfalla is a Partner and Louis Fer is an Associate at Signature Litigation Paris.
When judgement becomes a dependency
Consider how enterprises actually use AI today. A mid-sized insurer deploys a third-party model to triage claims. A hospital trust uses a diagnostic tool built on a foundation model fine-tuned by a vendor nobody in the procurement chain has met. A bank embeds an AI assistant into its advisory workflow. In each case, the organisation has adopted a capability, not a product. It has not acquired a licence for a defined piece of software with a known failure mode. It has rented judgement.
That distinction matters enormously when something goes wrong. Traditional software fails in ways that are legible: it crashes, it corrupts data, it becomes unavailable. An AI system fails by being confidently wrong. It produces a credit decision that looks reasonable, a diagnosis that reads plausibly, a legal summary that cites cases which do not exist. The failure is invisible until someone acts on it, and by then the causal chain has already branched.
The wrong question at the wrong time
For insurers, the first difficulty is not estimating the probability of an AI failure. It is deciding what kind of event it is. If an AI-driven underwriting tool systematically misprices risk across a book of business, is that a technology errors and omissions claim, a professional indemnity matter, or a directors' and officers' exposure if the board failed to oversee the model's deployment? If a customer suffers loss after relying on AI-generated advice, does the claim fall under general liability, or does it sit outside every policy the insured holds?
These are not hypothetical questions. They are already being asked in coverage disputes that will shape the market for years. The uncomfortable reality is that most policy wordings were drafted before generative AI existed, and the exclusions now being bolted on are inconsistent, jurisdiction-specific, and frequently silent on the scenarios that matter most. The result is a patchwork in which the same AI failure could be covered in one country, excluded in another, and simply unaddressed in a third.
The correlation problem hiding in plain sight
The insurance industry understands correlation. It is the reason terrorism and pandemic risk are treated separately from ordinary casualty exposure. A single event that triggers losses across thousands of unrelated policies at once is not a pricing problem. It is a solvency problem.
AI introduces exactly this dynamic. If a widely used foundation model is compromised, or a common training dataset is poisoned, or a routine update introduces a subtle reasoning flaw, the losses do not stay contained within one insured's operations. They propagate across every organisation that depends on the same model, often without any of them knowing they share the dependency. A law firm, a hospital, a manufacturer and an insurer may have nothing in common except the API they all call.
The industry currently lacks the tools to map these shared dependencies across a portfolio, let alone estimate correlated losses. Most carriers cannot say with confidence which AI models their insureds rely on, how those models were trained, or what happens when they are updated. Underwriting AI risk without that visibility is not underwriting. It is guesswork with a premium attached.
What happened when the market walked away
The terrorism precedent is uncomfortable but instructive. Before September 11, terrorism risk was treated as a manageable peril. Afterwards, with insured losses approaching $47 billion, the private market did not gradually adapt. It withdrew capacity almost entirely, forcing governments to create backstops such as TRIA in the United States and GAREAT in France. The market did not solve the problem. It retreated from it, and the state absorbed what remained.
Whether AI tail risk follows the same path depends on decisions being made now, largely in the absence of regulatory guidance. The EU's AI Liability Directive was withdrawn in 2025, leaving national courts to apply fault-based doctrines designed for human conduct to systems that do not think. In the United States, ISO's generative AI exclusions have been adopted unevenly, leaving large parts of the market unaddressed.
The minimum condition for a functioning market is transparency. AI providers must disclose how their models are secured, updated and validated. Insureds must disclose where AI sits in their decision-making. Without that, neither underwriters nor risk managers can credibly claim to understand the exposure on their books.
|
