When AI Watches the Risk

Oct 14, 2026

IIAI Article Hero Image

How Continuous Monitoring Is Changing Insurance Loss Control, Claims, and Underwriting

Analysis
By James W. Moore

Key Takeaways

  • Insurance markets have been building better information about difficult risks for centuries, and insurers have long paired coverage with inspection and loss prevention.
  • Telematics moved that observation closer to real time and showed that continuously observed behavior can become a pricing input, but only after insurers build the data into underwriting and rating.
  • AI-agent monitoring pushes the model further. A control layer may be able to observe an individual decision and stop it before it is executed.
  • The immediate insurance value may be strongest in loss control and claims. Underwriting value grows as insurers learn which observed behaviors actually predict losses.
  • Continuous monitoring can tell an insurer what the risk is doing. It cannot, by itself, tell the insurer what that behavior will cost.
  • As monitoring starts creating referrals, changing terms, or influencing price, it stops being just a loss-control tool and starts becoming part of the underwriting infrastructure.

Insurance Has Always Watched the Risk

There is nothing especially new about insurance markets wanting better information about difficult risks. Lloyd’s Register traces its origins to 1760, and says subscriptions for its Register Book beginning in 1764 funded surveyors to list, rate, and class the condition of vessels. That was market information infrastructure rather than an insurer’s surveillance arm, but it shows how early marine markets organized around better evidence about changing physical risk.

The connection became more direct with boiler and machinery insurance. Hartford Steam Boiler was founded in 1866 around the idea of combining insurance with inspection. Its founders believed better design, maintenance, and periodic inspection could prevent boiler explosions, with insurance helping support the inspection relationship. HSB’s own history says safety and loss prevention were primary to the original concept.

That history matters because today’s discussion around artificial intelligence can make continuous monitoring sound more revolutionary than it is. Insurers have long wanted better information about changing risks, and in some lines they have also helped manage those risks directly. What technology keeps changing is the distance between observation and action.

An inspector might identify a dangerous boiler condition during a scheduled visit. Telematics can record driving behavior every time a car moves. Cyber monitoring can identify a changing vulnerability between renewals. AI-agent monitoring can potentially see a dangerous decision before the decision becomes an event.

The new part is not that insurance wants to watch the risk. It is how often insurance can look, how close the observation can get to the actual operation, and how quickly someone can act on what is seen.

From Inspection to Continuous Observation

Usage-based auto insurance provides the most familiar modern example. Telematics lets an insurer observe mileage, hard braking, acceleration, time of day, and other driving behavior. The NAIC describes the basic idea plainly: directly observed behavior can be used to align premium more closely with the way an individual actually drives.

That does not mean every data point automatically becomes a rate factor. Insurers still have to decide which observations matter, how to turn them into a score or rating variable, and how that variable enters the product. The NAIC notes that new rating plans often require regulatory approval and statistical support. The important change is that insurance moved from asking only what kind of driver someone appears to be toward also measuring how that person actually drives.

AI agents create a similar possibility in a very different kind of risk. An AI agent can be given authority to do more than produce text. It might approve something, move money, update a record, send a communication, choose a price, or call another system. Once software can act, observing the software becomes more consequential.

If the monitoring layer can also stop the action, observation starts to look a lot like loss control. That is where Harbor becomes useful as a current example.

Harbor Makes the Architecture Visible

Harbor emerged from stealth on October 13, 2026, with a platform designed to test AI agents before deployment, monitor them in production, score their behavior for risk, and apply guardrails to actions they attempt to take. Its documentation describes a simple loop: test before release, score in production, and guard at runtime.

The distinction between watching and controlling is important. Harbor says production monitoring records activity and scores traces, but the monitoring function itself fails open if Harbor cannot receive the information. Guardrails are different. When a customer chooses enforcement, Harbor says a tool call that violates a configured rule can be blocked before it executes.

Harbor’s gateway documentation is even more useful because it makes the division of responsibility clear. The company describes the gateway as a thin layer that captures activity and can enforce configured policies, but says it has no routing logic. Harbor creates a gateway around the customer’s decision process; it does not create the customer’s decision rules.

Those rules still have to come from somewhere. The customer decides what the agent is allowed to do, what requires approval, what should be blocked, who can override a restriction, and what happens when a threshold is crossed. Harbor’s underwriting job posting makes a similar distinction on the insurance side. The company is hiring an underwriter to turn its risk scores into appetite, limits, retentions, wordings, and prices that carriers and reinsurers will support.

That produces a fairly conventional insurance chain, even if the technology producing the evidence is new. The platform observes and controls. Underwriting interprets what those observations mean for the transfer of risk. The larger question is whether better observation makes an emerging risk more insurable, or merely better managed.

Loss Control Gets Faster

The easiest place to see immediate value is loss control. Suppose an AI agent is allowed to authorize payments up to $10,000 and attempts a $100,000 transfer. A traditional risk-management process might discover the problem during an audit, after an incident, or when somebody notices an exception report. A real-time control layer can stop the transaction before it happens.

The insurance idea is familiar even if the timing is not. A boiler inspector identifies a dangerous condition and recommends correction. A cyber risk service identifies an exposed system and warns the insured. An AI control layer may identify the dangerous action and prevent execution within the same transaction.

That moves loss control through a familiar progression: identify, recommend, intervene. The last step does not require the insurer to know the perfect price for the risk. If a control prevents a loss, it creates value before the actuarial model catches up.

That may be the first important role for continuous AI monitoring in insurance. It can improve the condition of the risk while the industry is still learning how to price it. But intervention also creates responsibility questions that a periodic inspection does not create as directly. Someone has to define the rule, decide who can override it, and decide what happens when the control blocks something legitimate or fails to block the action that causes the loss. The closer loss control gets to the actual operation of the insured system, the harder it becomes to treat the control layer as something sitting safely outside the risk.

Claims Gets Better Evidence, and New Problems

Continuous monitoring can also change what exists after something goes wrong. A conventional claim involving a complex software failure may require reconstructing events from logs, interviews, configuration files, emails, and vendor records. A monitored AI system can potentially preserve a much more complete record of which agent acted, which model was running, what authority it had, which tools it called, which rules applied, whether a control fired, and whether somebody overrode it.

That kind of record could matter to coverage, causation, defense, and subrogation. Telematics already provides a simpler version of the same idea. The NAIC notes that insurers can use driving data captured around an accident, including speed, hard braking, and time, to help estimate damage and reduce fraud. Continuous data is already moving from pricing into post-loss reconstruction. AI-agent records could make that evidence much more detailed.

The record may not always be complete. Harbor, for example, says its monitoring function is designed to fail open, so a failure to export telemetry does not stop the customer’s agent from operating. Its enforcement controls are separate. A gap may have an ordinary technical cause, but continuous monitoring is not the same thing as guaranteed continuous evidence. If the record becomes incomplete during a period that later matters to a claim, the missingness itself becomes an underwriting and claims question.

Cyber insurance also offers a useful precedent. In 2022, Travelers sought rescission of a cyber policy issued to International Control Services, alleging that the insured had misrepresented the extent of its multifactor authentication controls. The parties later stipulated to rescission, and the federal court declared the policy void from inception. There was no merits ruling establishing Travelers’ allegations as law, so the case is useful here as an insurance example rather than a legal precedent.

The point is narrow but important: a control that mattered during underwriting became central after the loss. Continuous monitoring changes the timing of that problem. Instead of discovering during the claim that a control was absent, changed, or poorly implemented, the insurer or risk partner may have been observing the control environment all along.

That can improve claims evidence, but it also changes when important facts become known. If the monitoring system saw the deterioration before the loss, what was anyone expected to do with that information? Continuous monitoring can move knowledge of a deteriorating condition from post-loss discovery to pre-loss knowledge. Once that happens, the policy, service agreement, and underwriting arrangement need to be clear about whether anyone has actually undertaken an obligation to act on what is being observed.

When Monitoring Starts Becoming Underwriting

At first, monitoring is simply better information. A risk score worsens, a control disappears, an agent receives broader authority, or an unusual pattern develops. An underwriter sees that information at renewal and considers it alongside everything else already known about the account.

The next step is also familiar. A deteriorating score might create an underwriting referral. That referral could support an individual risk premium modification, a higher retention, a lower limit, or different terms. Strong observed controls could support the opposite judgment.

The important progression is observation, referral, terms, price. Somewhere along that path, the monitoring layer stops being only a loss-control system and becomes part of the underwriting infrastructure.

That does not require the monitoring software itself to possess underwriting authority. Insurance systems are already full of inputs that influence decisions without owning the final decision. What matters is what the carrier has chosen to do with the signal and how deliberately that connection has been built.

That boundary is also beginning to appear in regulation. Colorado’s SB 26-189, which takes effect in 2027, covers automated systems that “materially influence” consequential decisions, including insurance, and requires developers to provide information about appropriate use and human review. The law is broader than insurance rating, but the language is useful: supplying information and materially influencing a decision are not necessarily the same thing.

This is also why continuous monitoring should not be confused with continuous underwriting. An insurer can see a risk change in real time without having the contractual or regulatory ability to reprice the policy in real time.

Data Does Not Rewrite the Policy

Becoming part of the underwriting process is not the same as having authority to change the contract. Telematics provides the simplest way to understand that limitation. Driving data affects premium because the insurer designed a product that allows driving data to affect premium. The carrier defined the variables, developed the rating structure, established when the information would be applied, and obtained whatever approvals were required in the relevant market.

The sensor did not create the rate. The insurance product did. The same will be true for AI monitoring.

A carrier may eventually decide that a particular monitoring score creates a referral, earns a credit, produces a debit, changes a retention, or affects eligibility. Those consequences still have to be intentionally built into underwriting and, where applicable, rating and policy structures. Simply knowing more about the risk does not rewrite an insurance contract.

That makes renewal an obvious early use case. A carrier can observe the risk throughout the policy period, then use that evidence when it next decides whether to write the account and on what terms. More dynamic products may come later, but they would need to be designed to work that way.

The risk can change continuously. The insurance contract usually does not.

What If the Carrier Itself Is Being Monitored?

Harbor’s launch materials say its early customers include banks and insurers, which creates another version of the problem. Imagine that the AI agent being monitored does not belong to an insured. It belongs to the carrier.

The agent might triage submissions, recommend terms, flag accounts for referral, handle part of a claim, or authorize a payment. In that setting, an outside monitoring and control layer may sit directly inside the carrier’s own decision path. If a claims agent attempts a payment outside its authority and the control layer blocks it, the immediate benefit is easy to understand.

The harder questions follow. Who defined the authority? Who defined the rule? Who can override the control? What happens if the outside control layer is wrong? What happens if the carrier gradually comes to depend on that control as part of its own governance? Once the control layer has authority to stop an action, failure of that control can also put the monitoring provider itself into the liability chain.

This is where the issue connects directly to an earlier IIAI analysis, The Carrier Owns the Decision Architecture. A monitoring provider may enforce a rule, but the carrier still decides what the rule should be, what evidence supports it, who has authority to override it, and what record must remain afterward.

The gateway can sit inside the decision path. It does not transfer ownership of the decision architecture.

What Continuous Monitoring Still Does Not Solve

Harbor frames the market problem broadly, saying insurers are excluding AI risk because there is not enough claims history to price it. The broader market is less uniform. Aon describes much of today’s exposure as “Silent AI,” where policies neither clearly affirm nor exclude AI-related risk. At the same time, the market is beginning to create explicit ways to narrow coverage. Gallagher Re notes that Verisk has introduced optional generative-AI exclusions for the ISO Commercial General Liability Program, including CG 40 47 for Coverage A and Coverage B and CG 40 48 for Coverage B only.

Those forms do not mean the industry has broadly excluded AI, and they address generative AI rather than every form of agentic risk. They do show a market moving from silence toward more explicit treatment of AI exposure. Swiss Re describes the underlying insurance problem more generally: technological novelty can initially leave insurers without historical loss data with which to assess exposures and price risk. Harbor’s proposition approaches that uncertainty from the other direction by trying to measure the operating risk much more closely and then insure what remains.

Telematics added new behavioral evidence to a risk auto insurers already understood very well. The industry had enormous volumes of claims data against which observed driving behavior could be compared. Even then, interpretation has taken time. More than two decades after the first U.S. usage-based insurance programs appeared, the NAIC still describes uncertainty around selecting and interpreting driving data and incorporating it into pricing while maintaining profitability.

AI-agent risk may arrive in the opposite order. Insurers may be able to observe the behavior before they have enough loss experience to know exactly what the behavior predicts. A monitoring system can show that an agent attempted prohibited actions more often this month, that its authority expanded after a software update, or that guardrails began firing after a model change. Those observations can be extremely useful without telling us how often a covered loss will occur or how severe that loss will be.

Continuous monitoring can tell an insurer what the risk is doing. It cannot, by itself, tell the insurer what that behavior will cost. Better observation can make a risk easier to select, manage, document, and eventually price, but it does not make uncertainty disappear.

There is also a portfolio question. If many insureds depend on the same monitoring platform or control logic, that control can become a shared dependency. A flawed rule or common failure could create correlated losses rather than preventing them. That is the same system-level problem explored in Noise Diversifies. Bias Accumulates.: greater consistency can reduce independent mistakes while increasing the importance of common ones. The control layer deserves underwriting too.

Harbor Is a Test Case, Not the Answer

Harbor is interesting because it brings several pieces together at once: pre-deployment testing, continuous observation, intervention, and an insurance proposition for the risk that remains. Harbor says the measurement makes the residual risk insurable and uses the phrase “our own money behind the answer.” Its public underwriting materials also refer to building programs and capacity with carriers and reinsurers, while the launch material does not explain what “our own money” means in risk-bearing terms.

For this discussion, that structure is less important than the architecture. Harbor is putting a current example around questions insurers will increasingly have to answer regardless of which company provides the technology: What can we observe? What can we prevent? What should change when the observations change? Which uncertainties remain even after we can see the risk much more clearly?

Those are not Harbor questions. They are insurance questions, and the historical progression is more evolutionary than revolutionary. Marine markets built better information about vessel condition. Boiler and machinery insurers put engineers close to the equipment. Telematics and cyber moved observation closer to real time. AI monitoring can put the control layer inside individual decisions as they happen.

Insurance has been inside the risk before, and technology keeps moving that involvement closer to the moment of action. The interesting question is not whether insurers will see more, but what they will do with what they see.

Sources

Subscribe to AI Insights Newsletter

AI Disclaimer: This content was created with assistance from artificial intelligence technology. While content is based on factual information from the source material, readers should verify all details directly with the respective sources before making business decisions.

Related Posts

468