Editor’s Note
On Wednesday we published The Wheel of New Coverage, which argued that insurance rarely waits until a new risk is understood. It excludes the uncertainty, sells back a defined piece, and learns.
The same week, two of the largest commercial carriers described that process on their earnings calls. W.R. Berkley’s CEO said the company is identifying and controlling its AI liability exposure, using exclusions where appropriate. Chubb’s CEO laid out the likely path almost step for step: clarifications, exclusions, separate AI liability coverage, and pricing that tells one insured’s AI risk from another’s.
The rest of the week filled in the picture. Cyber claims data suggests the expensive AI problem may be a convincing voice on a call rather than a compromised server. State regulators gave examiners room to set traditional rating models aside. And a specialty insurer built a product around a risk the AI boom created that has nothing to do with algorithms.
The wheel turned on the record this week.
– James W. Moore, Editor-in-Chief
Chubb and Berkley Begin Drawing the AI Liability Line
Two large commercial carriers used their third-quarter earnings calls this week to explain how they intend to handle liability arising from their customers’ use of AI.
Chubb CEO Evan Greenberg, asked about coverage for AI liability, described it as a growing and emerging exposure that casualty underwriting has not contemplated to date. “As an industry, we have to put our arms around this,” he said. He expects some combination of coverage clarifications, exclusions and separate AI liability coverages, developing alongside underwriting and pricing that distinguish between insureds. He also suggested that certification standards for AI and agentic best practices could eventually support underwriting. (Insurance Journal)
W.R. Berkley CEO W. Robert Berkley Jr. told analysts on the company’s October 19 call that Berkley has worked to make sure its AI exposure is “identified, understood, controlled – and we’re getting paid for it,” and that it uses exclusionary language where it considers that appropriate. On the same call, he described the company’s own AI use moving from speed toward better decision-making, with intake efficiency up more than 20 percent. With more than half of claims settling for $5,000 or less, he suggested the company should be able to apply progressively less human touch. (Insurance Journal)
The broker side has a different emphasis. On Marsh’s earnings call last week, CEO John Doyle said a broad-based AI exclusion could create “real confusion and uncertainty,” and called for a more nuanced approach while claim activity remains very limited. Marsh Risk CEO Nick Studer argued that where AI is simply an evolution of an existing peril, it cannot be separated from the chain of causation, and excluding it invites disputes and gaps in cover. (Insurance Journal / Reuters)
Why it matters: Greenberg’s sequence is the wheel of new coverage, described by one of the world’s largest commercial insurers in response to an analyst’s question. Clarify the old promise, exclude what cannot be priced, and sell back a defined piece to insureds whose risk can be distinguished.
The disagreement with Marsh is real but narrower than it sounds. Nobody on these calls argued that AI exposure is standing still. The argument is about how to reach an underwritable promise: a broad exclusion that removes the ambiguity in one stroke, or precise wording that preserves cover for familiar losses that happen to involve AI.
Notice both halves of Berkley’s remarks. The same carrier is using AI to reduce human handling in its own claims operation while carefully controlling the AI exposure it assumes from customers. That is not a contradiction. It is what underwriting discipline looks like when a technology is simultaneously a tool and a peril.
Greenberg’s mention of certification standards may prove the most consequential line. Cyber followed a similar path: multifactor authentication and tested backups moved from good practice to underwriting questions to conditions of coverage. If AI governance follows, the insured that can document how its AI systems are controlled may be the one offered the buyback.
For independent agents, exclusions do not announce themselves. When an AI endorsement attaches at renewal, the agent is the person expected to notice it, explain it and, where a market exists, find the coverage that was carved out. The worst way for a client to learn about an AI exclusion is from a claim denial.
Cyber Losses Are Moving to the Payment Desk
Travelers says financial fraud and business email compromise now account for about half of its cyber claims.
Speaking at the NetDiligence Cyber Risk Summit in Philadelphia, Christine Mapes, a cyber managing director and counsel at Travelers, said the frequency of those claims rose 57 percent from the first half of 2025 to the first half of 2026, and that claim severity is up about 30 percent since 2023. She described criminals moving beyond traditional phishing toward IT and bank fraud manipulation and token theft, often persuading victims to hand over access voluntarily. Sara Trokan of Westfield Specialty said AI “makes impersonation more convincing,” describing claims in which employees believed they were communicating with senior executives across audio, video and email before making large fraudulent payments. (Insurance Journal)
These figures were reported by carrier executives on a conference panel rather than in a published loss study, but they come from claims files, not surveys.
The same week, Mosaic Insurance and MITRE released a three-part series examining how frontier AI is changing the economics of cyber risk. Its premise is that frontier AI can expose vulnerabilities and attack paths quickly for a much broader range of non-specialist attackers. One report argues that cyber insurers need to rethink underwriting signals beyond vulnerability counts. Another argues that risk managers should move boardroom conversations from indemnity and risk transfer toward organizational resilience. The series frames the central question as whether the operating models behind cybersecurity, cyber insurance and enterprise risk management can adapt quickly enough to the new pace of change. (MITRE; The Royal Gazette)
Mosaic writes cyber, so it has a commercial interest in how the market prices these distinctions.
Why it matters: Read together, these two items point to a shift in what cyber underwriting has to measure.
Much of cyber underwriting still rests on technical hygiene: multifactor authentication, patching cadence, backups, endpoint detection. Those controls remain necessary. But a loss in which an employee authorizes a payment to a convincing imitation of the CFO passes straight through most of them. The control that would have stopped it is a callback procedure, not a patch.
The panel’s moderator, Lindsay Nickle of Constangy, made the same point from the other direction: the response may be a low-tech verification process and the kind of awareness campaign the industry ran around social engineering several years ago.
MITRE’s Chris Folk described AI as giving insurers a way to price the difference between an organization that has looked hard at itself and one that has not. For carriers, the practical test is whether applications ask about the controls behind the losses actually being paid: out-of-band payment verification, who can change vendor banking details, and how a request from an executive is confirmed.
For agents, small commercial clients are the most exposed and the least likely to have written verification procedures. It is also a coverage conversation. Social engineering losses are often sublimited, and depending on the program they may respond under a crime form rather than the cyber policy the client assumes will pay.
The NAIC Gives Examiners a GLM Exit
Last week, insurance trade associations were asking the NAIC to keep generalized linear models out of its AI Risk Evaluation Supplement. Version 6.0 gives them part of what they asked for.
The NAIC’s Big Data and Artificial Intelligence (H) Working Group exposed version 6.0 on October 16, with a 14-day comment period closing October 30. A new sentence states that, based on existing oversight through ratemaking, regulators “may choose to exclude some or all GLMs” from inquiries under Exhibits B through D. GLMs are not removed. The draft still says they can carry a risk of unfair discrimination or other adverse consumer impacts, and Exhibit A still asks companies to identify them. (NAIC Version 6.0, tracked changes)
Other changes point in a different direction. Exhibit C adds a question asking whether a high-risk use case involves agentic AI and, if so, its objectives and what it is authorized to do without human approval. It also adds a question on testing variables and model outputs for proxy effects. The intent section now states that the Supplement does not independently create substantive legal duties or expand regulatory authority. InsureAI Wire, reading the redline, notes that the renamed definition of Adverse Consumer Impact no longer requires that a decision violate an insurance standard. (InsureAI Wire)
The working group lists a public meeting for November 2 and a session at the Fall National Meeting on November 16. Its published timeline has pointed toward considering a final version 7.0 at that meeting. Nothing has been adopted. (NAIC Big Data and Artificial Intelligence (H) Working Group)
Why it matters: Last week’s question was whether regulatory scrutiny should depend on how a decision is produced or on what the decision does.
Version 6.0’s answer is a compromise: visibility for everything, depth at the examiner’s discretion. Every GLM still appears in the initial inquiry. Whether it receives the deeper governance and model examination becomes the regulator’s call, justified by rate review that already exists.
That is a pragmatic way to avoid duplicating rate oversight. It also moves the boundary out of the document and into the examination. A carrier writing in many states may find its rating models set aside by one examiner and examined in detail by the next.
The more durable signal may be what arrived while the GLM boundary loosened. The new agentic AI question asks what a system is permitted to do without a human approving it. Regulatory attention is moving from models that score toward systems that act.
Arbol Insures the Politics of the AI Buildout
Arbol launched Data Center Regulatory Moratorium Cover on October 20, a parametric product that pays a predetermined amount if a government action halting or suspending data center construction remains in effect beyond an agreed waiting period.
The cover is designed for moratoriums that apply to data center construction as a class, not site-specific permit denials. Trigger and settlement are based on the public record. It is available to developers through brokers and may also interest the lenders and investors financing the AI data center buildout. Arbol says it underwrites the exposure using local data including water availability, grid capacity, power rates and each jurisdiction’s historical approach to data centers. (Artemis; Claims Journal / Bloomberg)
Arbol cites 45 state-level measures across 36 states and restrictions in 194 local jurisdictions as of August 2026, along with a March 2026 Gallup survey in which 71 percent of Americans said they oppose construction of an AI data center in their own area. Those figures come from Arbol’s announcement. The reports did not disclose limits, capacity or pricing.
“Regulatory risk of this kind has long been considered uninsurable,” the company said.
Why it matters: Wednesday’s article made the argument that “uninsurable” often means not insurable on the old form, at the old limit, for the old price.
Arbol has not made moratorium risk predictable. It has made the promise definable: a class-wide trigger, evidence from the public record, a fixed payment and a waiting period. That is how a market begins learning about a risk that produces no physical damage and no traditional proof of loss.
It is also a reminder that AI exposure for insurers is not confined to models. The physical buildout behind AI, including construction, power, water and the communities that increasingly object to all three, is generating risk across property, construction, surety and political risk lines.
And it carries an accumulation problem that parametric structures do not remove. A single state-level action could trigger every covered project in that state at once. How much of that correlated exposure Arbol and its capital providers are willing to hold will say more about the product’s future than the launch announcement does.
Sources
- Insurance Journal, “Chubb CEO Greenberg: Industry Has to ‘Put Arms Around’ AI Liability,” October 22, 2026
- Insurance Journal, “WR Berkley CEO Shares Insights on AI Adoption During Q3 Call,” October 21, 2026
- Insurance Journal / Reuters, “Broad AI Exclusions in Insurance Policies Could Create Uncertainty, Marsh CEO Says,” October 16, 2026
- Insurance Journal, “AI Accelerates Cyber Threat Landscape, Poses New Risks for Insurers and Businesses,” October 20, 2026
- MITRE, “Mosaic Teams With MITRE to Examine the New Economics of Cyber Risk in the ‘Age of Frontier AI,'” October 22, 2026
- The Royal Gazette, “Mosaic-backed research shines light on new economics of cyber-risk,” October 22, 2026
- National Association of Insurance Commissioners, AI Risk Evaluation Supplement Version 6.0 (tracked changes), exposed October 16, 2026
- National Association of Insurance Commissioners, Big Data and Artificial Intelligence (H) Working Group
- InsureAI Wire, “NAIC’s AI Supplement 6.0 Lets Regulators Leave GLMs Out of Exhibits B Through D,” October 20, 2026
- Artemis, “Arbol launches parametric insurance for gov-imposed data center construction moratoriums,” October 20, 2026
- Claims Journal / Bloomberg, “Insurer Rolls Out Policy to Protect Data Centers Against Growing Backlash,” October 20, 2026
AI Disclaimer: This content was created with assistance from artificial intelligence technology. While content is based on factual information from the source material, readers should verify all details directly with the respective sources before making business decisions.
