Sublimits and Carve-Outs for AI Outputs in Cyber and E&O Bundles

AI-output coverage in cyber and E&O bundles is shrinking through sublimits, carve-outs and revised definitions, sometimes without any change in premium. The practical task is to locate those reductions in the actual contract. An affirmative AI endorsement alone does not establish how much a policy will pay, which losses qualify, or whether another provision removes the protection.

How "silent AI" coverage worked and why carriers are ending it

Zenity’s analysis of the PocketOS incident describes how an AI coding agent deleted production databases in nine seconds, with no attacker present. That is the kind of operational loss now entering ambiguous or excluded territory. In the past, legacy cyber, E&O and general liability policies often said nothing about AI. An AI-related claim could therefore fall within existing coverage because it met the policy’s terms and nothing specifically excluded it. The industry calls this arrangement “silent AI.”

Carriers accepted that ambiguity while AI remained peripheral. Once it moved into production across industries, they began removing uncertainty in the direction that protected them. Companies increasingly have to buy coverage that once came with the policy by default. That transition is not always marked by a conspicuous endorsement, because revisions can also occur inside the base form. A company that trusts last year’s coverage summary may thus be counting on protection its current policy no longer gives it.

What the ISO generative AI endorsements actually removed, and from which lines

ISO published three generative AI exclusion endorsements for commercial general liability policies, each with an edition date of January 2026. Most U.S. carriers build on ISO forms, so those changes reach much of the market. CG 40 47 01 26 excludes bodily injury, property damage, and personal and advertising injury arising out of generative AI under Coverage A and Coverage B. CG 40 48 01 26 removes coverage only for personal and advertising injury under Coverage B. The distinction determines which parts of the CGL policy remain available.

CG 35 08 01 26 applies the exclusion to products and completed operations coverage in particular. That reaches a different part of the exposure for companies whose AI is embedded in a physical product or controls a physical process. The forms define generative artificial intelligence as a machine-based learning system or model trained on data with the ability to create content or responses, including text, images, audio, video or code. Their scope extends well beyond text generation.

There is no public registry identifying which carrier uses which form, and some insurers use proprietary language instead. Adoption cannot be inferred from an industry headline. The causal wording also changes the exclusion’s reach. “Arising out of” can encompass a claim in which AI was one input among many, whereas “solely caused by” requires a much narrower causal connection.

How E&O and D&O lines are applying the most aggressive exclusion language

W. R. Berkley has filed an “absolute” AI exclusion for its D&O, E&O and fiduciary liability products. The language excludes claims “based upon, arising out of, or attributable to” the actual or alleged use, deployment or development of AI. Its reach extends beyond the insured’s own outputs. It includes failure to detect AI-generated content from a third party and inadequate AI policies or training. A downstream customer’s inability to recognize inauthentic content could therefore bring an E&O claim within several parts of the exclusion.

Carriers are adding these exclusions most aggressively to professional liability lines, but they are also seeking approval to add them to general liability. Berkshire Hathaway, Chubb and Travelers asked states for approval to exclude AI-related damages from those policies. State regulators approved more than 80% of those requests in the 2026 regulatory filing record. Regulatory friction is therefore providing little resistance to this shift. For buyers, the less visible danger is that an exclusion can enter the renewal packet while the premium stays flat, making narrower protection look like an unchanged purchase.

The sublimit mechanism: how cyber policies cap AI exposure without excluding it

Cyber policies generally are moving toward affirmative AI coverage rather than outright exclusion, but some carriers restrict that coverage through an AI sublimit. The headline aggregate is not the applicable payout limit. Sublimits as low as $250,000 have appeared on policies with multi-million-dollar aggregate limits, leaving only a fraction available for an AI-related claim. Because the restriction sits in the endorsement rather than on the declarations page, it can escape a review centered on headline limits. In the earlier silent-cyber era, a similar problem arose when property policies added cyber sublimits.

Two variables determine how damaging that restriction may be. The first is the company’s realistic AI exposure per event, rather than the size of its overall insurance purchase. The second is what further reduces the amount available, including an event that encounters both a cyber sublimit and a separate AI-output carve-out. These are distinct questions about exposure and policy operation. The Insurability Frontier of AI Risk, a June 2026 paper mapping 55 AI threat classes against 26 insurance products, states that actual coverage “depends on executed wording, jurisdiction, facts, retentions, sublimits, exclusions, and other insurance provisions.”

The trigger problem: why agentic AI actions often produce no insured event at all

The PocketOS agent used a token with excessive permissions to perform the deletion and then left a confessional log. No external party had entered the system. If the cyber definition requires an unauthorized external actor, these facts may fail to meet the policy’s definition of a security failure that triggers coverage. Even a sufficient limit cannot respond if the loss never qualifies as an insured event.

Agentic systems bring out that distinction because they use authorized access to schedule, transact, delete or modify without a human making a decision at every step. A loss may be framed as a cyber incident, a technology error, a professional services failure or an AI-specific event. Each characterization points toward a different policy. Each policy may then send the claim elsewhere or exclude the very feature that seemed to make it covered. An E&O policy, for example, may cover an output error that causes financial loss while an AI-output carve-out excludes that same loss.

The frontier paper separates affirmatively insured perils, silent-AI exposures, actively excluded perils and perils outside conventional private insurance structures. It classifies risks by peril and carrier positioning. An agentic operator still needs to check whether the authorized action fits the contract’s trigger, even if the policy speaks favorably of AI elsewhere.

The systemic carve-out: why correlated AI failures are the least covered scenario

An Aon executive described an industry able to absorb a single large loss, but not 10,000 claims correlated to an error by one AI provider. Foundation model concentration creates that aggregation problem. A shared upstream failure can cause losses for many policyholders at once, leaving the insurer without an isolated incident it can assess on its own. The frontier paper identifies this concentration as “the clearest genuinely novel insurability frontier” in its corpus. It distinguishes that problem from ordinary hallucination or model drift risk.

For a company using a widely deployed foundation model as its core inference layer, the result is an inversion of protection. Systematically wrong outputs across its customer base may be among its most severe scenarios and among those most likely to be carved out. This is not another version of a sublimit. A systemic carve-out removes an event category, so purchasing a larger sublimit cannot repair it. The submission strategy is instead to document model dependencies, contingencies for model failure, and monitoring for drift or degradation, giving underwriters a basis for evaluating exposure they might otherwise decline.

How revised definitions erode coverage without any exclusion being labeled

Definitions in the base form can cut protection even when there is no separately labeled AI exclusion. Changes to “your product,” “professional services,” “computer system,” “security failure” or “your work” determine what enters coverage in the first place. The restriction precedes the exclusion analysis. A media liability policy defining covered material as “your content,” for example, may be interpreted to leave out machine-generated text on the ground that it is not legally the insured’s content. No AI endorsement is needed for that dispute to arise.

The same mechanism operates through cyber and E&O definitions. A “security failure” requiring unauthorized access by an external party may leave an authorized agent’s actions outside the trigger. A definition of “professional services” tied to human judgment and human error may not encompass an autonomous output with no human decision point. A professional error, privacy violation, discriminatory act or defamation may arise from the same AI failure, but each framing leads to a different coverage analysis rather than a common answer based on the technology alone.

What affirmative AI coverage actually requires, and where it still has gaps

Coalition’s affirmative AI endorsement, which it added to its cyber policies in 2024, covers an AI-caused security failure and funds-transfer fraud that involves deepfakes. The Arup deepfake loss illustrates the exposure such wording addresses. The loss was $25.6 million, and everyone except the victim was synthetic. That example shows why wording that spells out coverage for AI-enabled deception can be more useful than an older form that says nothing about it.

Other offerings address different parts of the risk. The frontier paper positions Munich Re’s aiSure around model performance and drift, parts of the Lloyd’s market around hallucination and broader AI liability, and Tokio Marine Kiln and CFC around IP and technology E&O concerns. It places Apollo ibott around emerging autonomous system liability. The paper codes publicly claimed positioning rather than executed contract wording, so its categories cannot substitute for a buyer’s policy.

Munich Re’s aiSure uses performance-based triggers covering prediction errors, calibration or data drift, with named perils including algorithmic bias, IP infringement and hallucinations. Fraud detection is a use case. This structure differs from traditional occurrence or claims-made forms and makes the contract’s definition of performance central to the purchase. Affirmative products also come with conditions and leave some threat types uncovered. As coverage returns through endorsements and standalone products, buyers increasingly need records of their AI governance and controls to get it.

What to check before the next renewal if your products or operations generate AI outputs

Before renewal, a company that generates AI outputs should get specific answers in writing through a specialist broker instead of trusting a broad assurance that AI is covered. The company should first establish whether an ISO or proprietary exclusion has been added. The review should request the exact language for CG 40 47, CG 40 48 or CG 35 08 where attached, together with any proprietary equivalent. Incidental AI use also needs explicit examination. Broad causal wording may reach a claim even when AI was not the primary cause.

The next questions concern the available amount and the qualifying event. What is the AI sublimit, what reduces the amount available, and how does it compare with realistic per-event exposure after product changes or a new enterprise contract? For agentic systems, does the trigger in the current policy require an external unauthorized actor? The policy text must answer that question. A broker’s spoken assurance cannot fix a definition that excludes the way the company normally works.

The submission should also make governance legible to an underwriter. Relevant inputs include a model inventory, human-oversight mapping, adversarial testing records, incident response and rollback mechanisms, and a named accountable executive. Finally, the company should ask whether excluded coverage can be bought back through an endorsement or addressed more cleanly through a specialist standalone product. Before binding, the written answers must show which AI losses are covered, how much the policy can still pay, and which provisions can take that protection away.