Most owners think about insurance when they sign a lease or hire the first employee, and not when they connect an AI agent to the mailbox. Yet an agent can send a wrong quote, expose a customer's data or delete records, and each of those is a loss that someone has to pay for. The question is whether your policies would respond.
This article gives you a practical list for a conversation with your broker. It is not legal or insurance advice, and it cannot tell you what your policy covers. Only your policy wording and your broker can do that. What it can do is help you arrive at the meeting with the right questions.
Why this is worth a conversation
Policies are written in terms of events such as a data breach, a professional error or damage to property. An AI agent does not appear in most of that language. Some insurers have started to add wording about automated systems or artificial intelligence, either to clarify cover or to limit it, and the wording differs from one insurer to the next. That is why a general assumption in either direction is risky.
The practical point is simple. If an agent makes a mistake, the loss will be sorted into one of your existing policies, or into none. You would rather learn which one before the mistake than after it.
Which policies might be involved
You do not need to buy anything new to start. First find out what you already have, and map a realistic mistake to each one.
Professional indemnity (errors and omissions). This is the policy that usually responds when your work or advice causes a client a financial loss. If your agent drafts proposals, answers customer questions or prepares reports, ask whether an error in that output is treated as your professional error, and whether it matters that a machine produced it.
Cyber insurance. This normally relates to data breaches, system outages, ransomware and the costs that follow, such as notification and recovery. If the agent has access to customer data, ask how a leak caused by the agent or by its vendor would be treated. The UK National Cyber Security Centre's small business guide is a useful reference for the security measures insurers tend to expect.
General liability. This usually covers bodily injury and property damage, and it is rarely the right place for a purely digital loss. Ask anyway, so that you know where the boundary is.
Directors and officers. If a decision to deploy an agent is later questioned by shareholders, partners or regulators, this is the policy that may be relevant. Ask whether decisions about technology are covered in the way you expect.
Crime and fraud cover. Some agents can move money, approve payments or change bank details. Ask whether a loss caused by a manipulated or mistaken agent counts as covered, and whether the policy requires a human approval step.
The U.S. Small Business Administration gives a plain overview of the common business insurance types if you want a starting point before the meeting.
Questions to ask your broker
Bring these in writing and ask for the answers in writing too.
- Is there any wording in my policies that mentions artificial intelligence, automated systems or algorithms? Ask for the exact clause and whether it extends or limits cover.
- Would a mistake made by an AI agent be treated as my own error under the professional indemnity policy? Give a concrete example, such as a quote with the wrong price sent to a customer.
- If the agent exposes personal data, which policy responds, and what are the conditions? Ask whether cover depends on security measures such as access controls, logging or multi-factor authentication.
- What happens if the loss comes from a vendor's failure rather than my own? Ask whether the insurer can pursue the vendor, and whether your contract with the vendor needs to preserve that right. The contract questions are covered in a separate article.
- Are there conditions on how the software is introduced? Some policies expect testing, approval or documented procedures. Ask whether a pilot counts, and whether you must tell the insurer before going live.
- What are the limits and the deductible for each scenario we discussed? A policy can respond and still leave you with a large share of the cost.
- Do I need to notify the insurer about the change? A significant change in how the business operates can matter at renewal and at claim time. Ask what counts as significant.
Exclusions worth looking for
You are not looking for something unusual. You are looking for ordinary wording that may apply to an agent in a way nobody intended.
- Unapproved or unlicensed software. If a team member connects a tool nobody approved, a clause on unauthorised systems could matter. This is one more reason to deal with shadow AI in the company.
- Failure to maintain security standards. Some cyber policies reduce or refuse payment if agreed measures were not in place. Check which measures are named.
- Contractual liability. Promises you made to customers in a contract, such as guaranteed response times or accuracy, may fall outside cover.
- Automated decisions. Wording on decisions made without human involvement could affect agents that approve, reject or price things on their own.
- Known issues and prior acts. If a problem was visible during testing and not fixed, the insurer may argue that it was known.
- Territory and data location. If the agent's vendor processes data in another country, check whether cover applies there.
What to bring to the meeting
A broker can give a much better answer to a clear description than to a general question. Prepare one page that states:
- what the agent does, in two or three sentences;
- which systems and data it can read, and which it can change;
- what it is not allowed to do, such as paying invoices or sending anything to customers without a person approving it;
- who reviews its work and how often;
- which vendor and model it relies on, and where the data is processed;
- how you can switch it off and undo its actions.
If you already have a staged rollout with a pilot and clear rollback criteria, you have most of this page. If you do not, preparing it for the broker is a good reason to write it. Insurers tend to look more kindly on a controlled, documented process than on an improvised one, although the decision is theirs.
What insurance does not do
Insurance pays after a loss, and often only part of it. It does not restore a customer's trust, bring back a lost contract or give you back the time spent on cleanup. The first line of protection is still the design of the agent: narrow access, a human check on actions that are hard to undo, a clear log of what happened, and a way to stop it quickly. Treat the policy as the safety net underneath those measures. For the data side, data security in AI implementation lists the controls to put in place.
A short checklist
- List the policies you have and the date each renews.
- Write the one-page description of the agent.
- Send your broker the seven questions and ask for written answers.
- Read the exclusions above against your actual setup, and fix what you can fix with process.
- Store the answers with the agent's documentation and review them at renewal or when the agent's role changes.
Conclusion
You do not need a special AI policy to start, and you should not assume that you are either covered or uncovered. You need to know which policy would respond to which mistake, what conditions it attaches, and which gaps you are choosing to carry. An hour with your broker and a one-page description of the agent will usually tell you that, and it is far cheaper to learn it before the first incident.
