Insurers filed 4,078 AI exclusions. They're the real AI regulator

Short answer: The AI law that actually decides who gets to build in America was not passed by Congress. It was written by Verisk, the company that drafts standard insurance policy language, and filed by carriers in 49 states plus DC in about twelve months: 4,078 generative AI exclusion records, 2,369 already in force by mid-2026. If your business cannot get liability cover for "any actual or alleged use" of AI, you cannot sign the enterprise contract, and no vote was ever held on that.

TL;DR: In July 2025 Verisk's ISO unit published standard forms that strip generative AI out of commercial general liability policies, and filings to attach them peaked at 413 in a single month by February 2026. The public rulebook, the NAIC's model bulletin on how insurers use AI, reached 29 jurisdictions in 34 months; the private one reached 50 in twelve. The company writing those forms runs a 44% operating margin, Big Tech can self-insure with its balance sheet, and the small builder is the one left holding an uninsurable product.

Key numbers

What	Number	Source, checked Oct 25 2026
Generative AI exclusion records in state filings, through Jul 31 2026	4,078 (2,369 in force)	Trades Coverage review, via Insurance Business, Aug 25 2026
Jurisdictions with at least one exclusion record	49 states + DC (all but Minnesota)	Insurance Business
Peak monthly exclusion filings	413 (by Feb 2026)	Insurance Business
Jurisdictions that adopted the NAIC AI model bulletin	29 in 34 months	NAIC adoption map, Oct 8 2026, our count
Verisk operating margin, last four reported quarters	44% ($1.37B on $3.10B)	Verisk 10-K and SEC XBRL, our calc
"Artificial intelligence" in Travelers' 10-K, fiscal 2021 vs 2025	2 vs 27	SEC EDGAR, our count
AI-related securities class actions, 2024 / 2025 / first half 2026	15 / 16 / 15	Cornerstone Research and Stanford SCAC
AI-related investor losses in suits filed, first half 2026	$385B (73% of the index)	Cornerstone Research, Jul 29 2026
Growth in AI-related lawsuits, 2021 to 2025	978%	Gallagher study, via Insurance Journal

The AI law already passed. You were not invited

Every week brings another hearing, another federal preemption fight, another state bill on "frontier models". The whole country is watching Washington and Sacramento to see who will regulate AI.

That is the distraction. The rules that decide whether a small company can sell an AI product were written in a policy form shop and filed with state insurance departments, one carrier at a time, with no hearing anyone watched.

In July 2025 Verisk's ISO unit published standard generative AI exclusion forms. The main one, CG 40 47, removes coverage for bodily injury, property damage and personal and advertising injury arising from generative AI. CG 40 48 strips only the advertising injury part, and CG 35 08 covers products and completed operations.

A month later the filings started. By July 31 2026, a review of admitted-market state filings by the insurance marketplace Trades Coverage counted 4,078 exclusion records across 49 states and the District of Columbia. 2,369 were already in force. Minnesota was the only state without one.

The private rulebook moved twice as fast as the public one

Compare that with the closest thing America has to an elected AI insurance rule. The National Association of Insurance Commissioners adopted its model bulletin on insurers' use of AI on December 4 2023. As of October 8 2026, 29 jurisdictions had adopted it.

So the regulators' own guidance took 34 months to reach 29 places. The industry's exclusion reached 50 in about twelve. And the bulletin governs how insurers use AI on you, in pricing and claims. It says nothing about whether you can buy cover for the AI you ship.

Look at the shape of the public line. A burst in 2024, then a crawl: four adoptions in 2025, four more so far in 2026. That is what consensus law looks like. The exclusion filings peaked at 413 in one month.

"Any actual or alleged use": the broadest AI rule in the country

ISO's forms are the polite version. W. R. Berkley introduced what Insurance Journal calls an absolute AI exclusion for directors and officers, errors and omissions and fiduciary liability. Reporting that traces back to the Financial Times describes one Berkley version that would block claims tied to "any actual or alleged use" of AI, even when AI is a minor part of the product (Beinsure, February 2 2026).

Read that as a builder. Errors and omissions is the cover that pays when your software gets something wrong. It is the policy enterprise buyers ask you to prove before procurement signs. "Any actual or alleged use" of AI describes almost every software product shipped in 2026.

By April 2026, W. R. Berkley, Chubb, Travelers, Berkshire Hathaway and AIG had each filed to adopt the ISO forms or their own equivalents, per Insurance Business. AIG told TechCrunch it had "no plans to implement them at this time". Filing an exclusion you do not plan to use is still a loaded gun on the table at every renewal.

No Congress could pass a rule that broad. An exclusion form does not need to pass anything. It needs a state filing and a renewal date.

Insurers saw it coming in their own filings

We counted the phrase "artificial intelligence" in four big carriers' annual 10-Ks. Travelers went from 2 mentions in fiscal 2021 to 27 in fiscal 2025. Chubb and W. R. Berkley went from zero to 10 and 13. AIG went from 3 to 13.

Travelers' 2025 filing says it plainly: "new technology, such as artificial intelligence, could create unforeseen exposures or coverage issues under the policies we write". The same filing says the company has invested in AI across its claims operations, and AIG's says it applies generative AI to parts of underwriting and claims.

So the carriers use AI to price you and to settle your claims, and they file forms that refuse to cover the AI you use. Our reading: AI is a cost saver when it sits inside the insurer and an uninsurable hazard when it sits inside your product.

Follow the money: who writes the rule, who pays it

Start with the form writer. Verisk's 2025 10-K says it provides "policy language, prospective loss costs, policy writing and rating rules" across 32 lines of insurance, and it is a licensed statistical agent in all 50 states, Puerto Rico and DC. Its policy language is copyrighted. It employs more than 250 insurance experts and lawyers to track roughly 17,600 legislative actions a year.

That is a private standards body with a public role and a very good business. Over the four quarters to March 2026, Verisk booked $3.10 billion of revenue and $1.37 billion of operating income, a 44% margin by our calc from its SEC filings. Not financial advice, just the arithmetic in the filings. The same 10-K advertises "generative AI-powered damage assessment" sold to insurers.

Now the winners and losers. A carrier with an AI exclusion keeps the premium and drops the tail risk. A giant like Microsoft does not need the market: on September 7 2023 it promised to "defend the customer and pay the amount of any adverse judgments or settlements" if a commercial customer is sued for copyright over its Copilots. That promise is only worth something because of the balance sheet behind it.

The startup has no such balance sheet. If its E&O policy excludes AI, it cannot offer the indemnity a bank or a hospital demands, so the contract goes to the incumbent who can self-insure. Our bet: the exclusion clause will pick more AI winners than any bill in Congress this decade, and it will pick the biggest companies every time.

The steelman: insurers are pricing a real risk

Here is the best case for the exclusions, and it is a serious one. AI lawsuits are real and growing: Gallagher counted a 978% rise in AI-related lawsuits from 2021 to 2025. Cornerstone Research and Stanford count 15 AI-related securities class actions in the first half of 2026 alone, against 16 in all of 2025, carrying $385 billion of investor losses, 73% of the whole index.

The deeper fear is correlation. An Aon executive told the FT that insurers can absorb a $400 million loss at one company, but not an agentic AI failure that triggers 10,000 losses at once. When thousands of insureds sit on the same few models, one bad update hits all of them on the same day. We made that case ourselves in the real AI risk is a quiet cascade.

All true. And none of it requires a blanket exclusion. Look at what those securities suits are: overwhelmingly claims that a company oversold its AI to investors, not that a model hurt a customer. Insurers price correlated catastrophe every day, hurricanes and pandemics included, with sublimits, aggregates and reinsurance. Lloyd's underwriters led by Chaucer launched an affirmative AI liability policy with Armilla in April 2025, which shows the risk can be written when someone wants to write it.

The choice to exclude instead of price is a business choice. It protects margins, it is cheap to file, and it shifts the whole cost of uncertainty onto the people with the least power to carry it.

An unelected licensing regime, hiding in plain sight

The loud AI safety fight is about licenses for frontier labs, and the open-source world fought it hard. Meanwhile, the licensing regime arrived anyway, in a form nobody marches against: a definitions section in a policy endorsement.

ISO's forms, effective January 2026, define generative AI as a machine-based system trained on data "with the ability to create content or responses", including text, images, audio, video or code. That covers a chatbot, a code helper, an autocomplete and half the SaaS on the market. Whoever can buy cover gets to ship into the enterprise. Whoever cannot gets to ship to hobbyists.

Nobody has proven yet that the exclusions will freeze small AI vendors out of big contracts. Our bet is that procurement teams will start asking "does your policy exclude AI?" within a year, and the answer will quietly sort the market into the insured giants and everyone else. That is a moat with a filing number, and the same pattern we found in regulated utilities: the rule nobody reads is the one that sets the price.

What this means for you

If you sell software with AI in it, pull your policies tonight and search them for "generative", "artificial intelligence" and the form numbers CG 40 47, CG 40 48 and CG 35 08. Ask your broker in writing whether your E&O excludes AI, and if it does, price an affirmative AI policy before your next enterprise deal asks for one.

Then make yourself the easy risk. Underwriters and procurement both ask the same questions: what is exposed, who can reach it, what happens when it fails. Write the answers down, with logs and limits, before anyone asks. Bigger picture, the fewer dependencies you rent, the fewer exclusions can reach you; more on that under AI industry and on our opinion page.

If you want the "what is exposed" answer fast, the $49 Launch Check reads your live URL the way an attacker does: exposed keys, open tables, missing headers, worst first, with the exact fix in 48 hours. If a problem we checked turns up later, we keep fixing it at no extra cost.

Sources

• Insurance Business, The AI clause that may already be on your contractor client's policy (Trades Coverage review of SERFF and Florida I-File filings), Aug 25 2026
• Insurance Business, ISO's generative AI exclusion is already on thousands of CGL policies, Sep 16 2026
• Insurance Journal, Don Jergler, Insurer Interest in AI Coverage Exclusions Growing as Risk Becomes Omnipresent, Aug 17 2026
• TechCrunch, Connie Loizos, AI is too risky to insure, say people whose job is insuring risk (citing the Financial Times), Nov 23 2025
• Beinsure, Peter Sonner, Insurers move to ring-fence AI liability (citing the Financial Times), Feb 2 2026
• The Decoder, Major insurers seek to exclude AI-related risks from corporate policies, Nov 24 2025
• Big I, Verisk to Roll Out New General Liability Exclusions for Generative AI Exposures (form numbers and definition), Oct 21 2025
• NAIC, Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, status as of Oct 8 2026
• Verisk Analytics Form 10-K for 2025 and SEC EDGAR XBRL revenue and operating income, pulled Oct 25 2026
• SEC EDGAR 10-K filings, fiscal 2019 to 2025: Travelers, AIG, Chubb, W. R. Berkley, our phrase counts, Oct 25 2026
• Cornerstone Research, Securities Class Action Filings Surge in the First Half of 2026, Jul 29 2026
• Cornerstone Research, Overall Size of Securities Class Action Filings Reached New Heights in 2025, Jan 28 2026
• The D&O Diary, Cornerstone Research: Securities Suit Filings Steady in Year's First Half (2024 AI-related total: 15), Jul 31 2025
• Microsoft, Microsoft announces new Copilot Copyright Commitment for customers, Sep 7 2023
• Armilla, Armilla Launches Affirmative AI Liability Insurance with Lloyd's Underwriter, Chaucer, Apr 30 2025