The Wall Street Journal put two numbers side by side this week, and the space between them should bother anyone whose business now runs on somebody else’s model. Potential liabilities across the AI industry run into the tens of billions of dollars. The insurance policies standing behind most AI firms cap out around $50 million.
Hold that ratio for a second. If a deployed AI system fails at scale and the claims start arriving, the vendor’s insurer covers the first $50 million and then stops paying. Everything past the cap turns into a fight over the vendor’s balance sheet, the court calendar, and your patience. Procurement teams sign these contracts every week without ever seeing the gap.
I think this becomes the industry’s next structural constraint. Not compute, which got solved with money. Not trust, which got patched with safety teams and model cards. Insurance is different, because an insurer’s refusal to underwrite tail risk is not a PR problem you can message your way out of. It’s math.
Why insurers cap instead of price
Insurance works when someone can price a risk, and pricing takes loss history. Insurers know what a data breach costs because they have spent two decades paying for them. There is no equivalent history for “an agent hallucinated a contract clause” or “a model gave negligent advice at scale.” Those failure modes barely existed three years ago. No loss tables, no actuaries with opinions worth hearing, no reinsurance market ready to absorb the tail.
When an insurer can’t price a risk, it does the next best thing: caps it and excludes it. So AI firms end up holding policies with limits that made sense for conventional software, back when software mostly stored and displayed data instead of acting on the world. The Journal’s reporting makes the consequence plain. The industry’s potential exposure is measured in tens of billions. The coverage behind it tops out near $50 million.
The gap is widening, not closing
Two things are happening at once, and both point the wrong way.
Regulators are turning up the heat. The FTC is demanding 50 pages of records from OpenAI and Anthropic on safety incidents, which means the discovery pipeline for AI failures is being built right now. Whatever insurers couldn’t model, plaintiffs’ lawyers and regulators will assemble for them, one subpoena at a time.
And the incident surface keeps growing. In the same week as the WSJ piece, OpenCode told 1.4% of its Console users that stolen API keys from a distillation attack were being used to run up charges on their accounts. Amazon’s Atlas system was separately reported to have scored UK warehouse workers on union-organizing risk. Different failures, same pattern: systems acting at a scale and speed where one flaw propagates before anyone notices.
Every incident becomes a data point in the loss tables insurers don’t have yet. The market will eventually catch up, price the risk, and sell products for it. Between now and then, the gap is yours to hold.
Three questions before you sign
This is where the buying side has some agency. Before renewing or signing any AI vendor contract, get answers to these in writing.
What is the liability cap, and what is my exposure past it? Get the actual number. Adjectives don’t pay claims. Put it next to your own worst realistic case, the one where the model’s mistake becomes your recall, your lawsuit, your regulatory finding. If the cap covers a rounding error of that number, either the price drops or you walk.
Which failure modes are excluded? Ask for the policy’s exclusions schedule. The certificate of insurance is a summary; the exclusions are the real contract. Look hard at language around output accuracy, autonomous action, and model errors. My bet is the failure modes you worry about most are exactly the ones excluded, because that is precisely the risk the insurer refused to underwrite.
When the vendor’s model causes my regulatory problem, who pays? If the FTC comes after you because a system you deployed broke a rule, an indemnification clause covering “third-party IP claims” does nothing for you. Name the scenario in the contract and watch what the vendor does. Vendors who have thought this through will negotiate. Vendors who haven’t will blink, and now you know something about them.
What to do this week
Four moves, roughly in order.
Pull the exclusions schedule for every AI contract you have already signed. Plenty of procurement processes never request this document, which means plenty of companies are carrying risk nobody has read.
Map where AI outputs touch money, contracts, regulated advice, or personal data in your business. That map gives you a real exposure figure, the thing you compare against the cap.
Fix the gap on your side. Negotiate caps proportional to exposure, add indemnification for regulatory costs, or buy your own technology errors-and-omissions coverage. Any one of these is cheaper than a bad quarter with an uninsured vendor.
Add incident clauses at renewal: a notification deadline measured in hours, audit rights over the vendor’s logs, and a duty to cooperate with your regulator. If the contract is silent on incidents, your leverage after one is zero.
The boring part is the load-bearing part
Nobody demos insurance at a conference. It doesn’t trend. But the Journal’s numbers describe an industry that sells autonomy at scale while carrying coverage built for conventional software. That mismatch will get fixed, quietly, by actuaries, the way these things always get fixed. Until then the gap doesn’t sit on the industry’s books. It sits on yours, one vendor contract at a time, waiting for the incident that turns fine print into a payable amount.
