Underwriting the unknown: How AI is forcing insurers to rethink risk

In this article, we look at what AI means for insurers: not a line of business to sell, but a risk to price, a regulatory obligation to meet, and in some cases a liability the insurer carries itself. From claims-denial lawsuits to the strange, correlated way AI failures spread, we look at why AI risk in insurance doesn’t behave like the risks insurers already know how to underwrite, and what a sensible response looks like.

Written by

Richard Goodchild

Head of Enterprise AI Strategy & Client Solutions

Richard is a Solution, Data, and Cloud Architect specialising in technical consultancy. His focus is understanding a client's real business challenge before reaching for a technology solution, and staying close to both the commercial and technical sides of a project so the two stay aligned.

When “Just a Mistake” Doesn't Cover It

A chatbot promises a refund the company never intended to offer. A claims algorithm rejects thousands of cases in a single afternoon, with a physician's name attached but no physician's judgement behind it. A model quietly drifts off course for months before anyone notices the pattern in the output.

The instinct is to treat these as ordinary, operational error, the kind of thing staff have always occasionally got wrong, and insurers have always covered. But the comparison doesn't hold up. A person who misapplies a policy makes one mistake at a time. A flawed model makes the same mistake identically and simultaneously; across every customer it touches. It can be weeks before the pattern surfaces.

Negligence law is built for a human decision-maker who could reasonably have known better in the moment. An AI system's failure is frequently only visible in hindsight, from the shape of the aggregate output. A staff error has one clear owner. An AI error is spread across a chain instead: the model vendor, the team that integrated it, the company that deployed it, and sometimes a data provider behind all three.

Same underlying failure, but a legal and insurance framework that was never built for who's responsible. That gap sits underneath everything that follows, and insurers are on both sides of it: writing cover for it, and increasingly, living it themselves.

The Rulebook Insurers Have to Follow First

Regulation is arriving faster for insurers' own AI use than it is for most of the businesses they cover, which puts the industry in an unusual spot: writing the risk assessment criteria and being subject to them at the same time.

In the US, the NAIC's Model Bulletin on the Use of Artificial Intelligence Systems by Insurers has moved from principle to practice quickly. 24 states and the District of Columbia had formally adopted it by mid-2026, with several more in progress. The requirement at its centre is a written AI Systems Program: board-level accountability, documented model testing, and oversight of third-party AI. The insurer remains responsible for that third-party AI, regardless of who built it. A pilot examination tool is already being used across a dozen states to assess that governance directly during market-conduct exams. The direction is unambiguous: from policy statements to evidence an examiner can check directly.

In Europe, the picture is similarly live, if slower to land than first planned. Life and health underwriting sits inside the EU AI Act's high-risk category under Annex III. Solvency II duties already hold insurance undertakings fully responsible for their AI use, no matter how the supply chain behind a given model is structured. Those high-risk obligations were due to apply from August 2026. The EU's Digital Omnibus pushed the date back to December 2027 instead, buying insurers more runway to build the governance evidence an examiner will eventually ask for. Liability is moving the other way. From December 2026, the revised Product Liability Directive treats software and AI systems as products capable of being defective. That pulls model developers into a strict liability regime for the first time. Together, these point toward regulators trying to move liability further up the chain, toward the people who built the model as well as the people who deployed it.

Two Kinds of Liability, Not One

It's tempting to think of AI risk as something insurers assess in other businesses, sitting on the outside looking in. That misses where insurers themselves stand in this picture.

Cigna, UnitedHealth, and Humana are all currently defending active lawsuits over AI-driven claims denials in the US. The allegation: algorithms rejected medical claims in bulk, in one reported case at roughly a second per decision, with little or no individual review behind them. Legal commentary has started naming this its own cause of action: algorithmic bad faith. The argument turns on a question that will sound familiar from the section above: was there genuine human judgement behind the decision, or just a human name attached to an automated one?

Insurers carry AI risk directly too, inside their own claims and underwriting operations. The same black-box accountability problem applies just as much to the carrier's own model as it does to a policyholder's chatbot.

Why This Risk Doesn't Spread the Way Insurers Expect

Insurance works because most risk is idiosyncratic. One policyholder has a bad year, the next one is unaffected. AI risk breaks that assumption.

A large share of enterprise AI runs on a small number of foundation models. One survey of US enterprises estimates that just three providers accounted for 88% of enterprise spend on large language model APIs by the end of 2025, up from 77% in mid-2025. If one of those models develops a systemic flaw, whether a bad update, a disclosed vulnerability, or a bias pattern in a specific type of decision, every business relying on it is affected at once. There will be no storm front or declared pandemic to serve as the trigger conventional catastrophe modelling depends on. Reinsurers have already started saying this out loud. Gallagher Re published research this year warning that AI failures tied to widely used models could produce simultaneous losses across industries and jurisdictions. They framed it as an aggregation problem for the entire reinsurance market. A July 2026 paper, with co-authors from QBE, Generali, Aon, Moody’s Analytics and RAND among others, traces the same correlated, catastrophe-style accumulation risk to insurers’ dependence on a handful of foundation model providers.

It's the closest thing AI risk has to a catastrophe event. It needs to be reserved and reinsured with that in mind rather than priced like an ordinary spread of professional indemnity claims.

Exclude It or Insure It: The Market Hasn't Decided

Before insurers addressed cyber risk in policy wording, cyber losses were quietly paid out or disputed under policies that never mentioned it. Silent cyber, as it came to be known. AI is following the same path. Risk sits inside existing wordings, unpriced and unacknowledged, until a claim forces the question.

The market's response looks the same as it did with cyber, pulling in two directions at once. New standard exclusion forms took effect this year, including ISO's CG 40 47, CG 40 48, and CG 35 08, carving generative AI out of general liability cover. At the same time, specialist affirmative products are appearing: algorithmic liability cover, model drift and bias insurance, and regulatory compliance cover for AI governance failures. Both are hedges against the same underlying problem: nobody yet has the claims history to price this risk with real confidence, so the market is hedging in both directions.

What Shows Up on the Balance Sheet

Strip away the regulation and the case law, and the practical question for any insurer is what this does to loss ratio, capital, and cost.

Loss ratio. Correlated risk behaves like a book sitting on a single fault line, quiet for a long time, then a large simultaneous loss. Underwriters pricing AI exposure like ordinary E&O risk are structurally underpricing the tail.
Capital and reserving. Aggregation risk pushes up capital requirements under Solvency II and equivalent regimes, because it needs to be reserved as correlated exposure rather than diversified exposure. Expect closer rating-agency scrutiny of AI aggregation over the next few underwriting cycles.
Claims-handling cost. AI-related claims are more expensive to investigate. Establishing what a model did, and why, usually needs technical forensic capability most claims teams don't currently have in-house. That's a direct hit to combined ratio before a single claim is even paid out.
Own-book litigation risk. The carrier's own use of AI in underwriting and claims is now a first-party exposure: bad faith, E&O, regulatory action, class actions. It belongs inside enterprise risk management, not treated purely as an efficiency initiative.
Reputation and retention. The claims-denial lawsuits are generating exactly the coverage that erodes trust and drives policyholders elsewhere, regardless of how the litigation itself is eventually resolved.
The upside, with a catch. AI is a genuine growth lever too: faster underwriting, sharper risk selection, and entirely new specialist lines. But the efficiency gains and the new liability often come from the same deployment decision. Speeding up claims handling with AI is the same choice, made differently, as automating a decision that used to require a human being to look at it in the first place.

Governance Is the New Underwriting Signal

None of this points toward avoiding AI. It points toward being precise about which AI is which.

The NAIC's own examination approach is a useful template even outside the US. Who owns the outcome of a given decision? How is drift and bias monitored? Can the reasoning behind a decision be explained to the person it affects? And does a human actually sit in the loop, rather than rubber-stamp the output? That standard is starting to apply as much to insurers' own claims and underwriting systems as to anything they're assessing in a policyholder.

Strong governance has become the dividing line between AI a business can get affordably insured for, and AI it can't. For insurers specifically, that's the boundary between AI that improves the loss ratio and AI that becomes the next lawsuit waiting to happen.

Getting Ahead of a Risk That Won't Wait

The honest summary is that AI risk in insurance isn’t fully priceable yet. Not because insurers lack the skill, but because the loss data doesn't yet exist in the volume actuarial pricing usually needs. That's an uncomfortable position for an industry built on historical experience. It's also not a reason to wait.

The insurers who separate “AI used to make a process faster” from “AI making unreviewed decisions with legal consequences” will be the ones with a pricing advantage once the claims data does start to accumulate. Getting there means governing the second far more tightly than the first. Everyone else will be catching up on a fault line they should have been watching from the start.

Dot Collective helps insurers build the data and AI governance foundations that turn regulatory obligation into underwriting advantage. If you're working out where your organisation's AI risk sits, we'd like to talk.

Sources