The largest AI companies are willing to buy billions of dollars of insurance against what their models might do, and the coverage does not exist. George Lewin-Smith, whose firm Testudo writes AI liability at Lloyd’s, put it to the Wall Street Journal without decoration: buyers with the balance sheet to afford billions in cover cannot find it, because coverage at that scale “just doesn’t exist on planet Earth.”
So what does a broker actually tell that client? Not “no.” The honest answer is a structure, not a policy — a sequence of moves that assembles, out of small affirmative limits, contract terms, and knowingly retained risk, something that behaves like cover even though no single policy in it is large enough to matter on its own. The Journal’s October 16 report on the insurance obstacle, and the market’s own published numbers, show each piece of that structure already in use.
The ceiling, in public numbers
Start with what exists. Every AI-specific limit the market publishes, stacked in one place:
- Munich Re aiSure — performance cover for AI models, limits of €5 million to €50 million per model.
- AIUC — certification-linked insurance for AI agents, up to $50 million per policy.
- Armilla — standalone AI liability, $25 million aggregate per insured, $5 million per model.
- Chaucer + Armilla “Vanguard AI” — coordinated cyber, tech E&O, and standalone AI liability, AI aggregate of $25 million or more per organisation.
- Testudo — standalone generative-AI liability for deployers, $9.25 million per insured.
Add every ceiling together and the theoretical total is roughly $135–160 million — and no buyer can actually stack all of it, because the caps attach per model, per insured, and on different triggers. Set that beside the exposure. One claim category against one company, Anthropic’s use of pirated books in training, settled this year for $1.5 billion. The purpose-built products this desk described forming in Who Pays When an AI Agent Makes the Mistake? now exist. Their combined ceiling is an order of magnitude below a single settled claim.
The $50 million headline is narrower than it reads
The figure doing the rounds — Munich Re offers up to $50 million — deserves its fine print, because brokers will be asked about it. Munich Re’s own head of Insure AI states the range in euros, €5 million to €50 million, and per AI model, not per company or per programme. More important is what the money buys. aiSure, in the market since 2018, is a performance guarantee: the model is insured against an agreed performance metric, and payout follows measured underperformance — a vendor that guarantees its system catches 99% of fraudulent transactions is covered for the losses when it doesn’t. That is a parametric-style answer to “the model didn’t work,” not open-ended liability cover for everything a model might do to third parties. The gap between what the largest buyers need and what the largest product is, is a gap in kind before it is a gap in size.
Why the exposure is genuinely that large
Skepticism about the billions is fair; the composition isn’t. RAND’s census of 249 U.S. generative-AI lawsuits found roughly 60% centred on intellectual property and training data — claims that arrive as classes, priced by statute rather than by any single victim’s loss. The Bartz settlement shows the arithmetic: lawful training was ruled fair use, the pirated library was not, and statutory exposure on the piracy claims was estimated before settlement at up to $1.05 trillion. Nobody wrote Anthropic a cheque for a hallucinated sentence. The catastrophic shape of AI liability is aggregate and statutory, not anecdotal.
Testudo’s litigation data draws the same curve from the demand side. The median AI lawsuit demands $5 million — comfortably inside the products above. About 70% seek under $10 million. But roughly 16% demand more than $100 million each, and a single defamation claim against Google over an AI Overview is already seeking at least $110 million — more than double the largest AI liability limit ever sold. Insurance for AI exists. It covers the ordinary loss and stops about two orders of magnitude short of the catastrophic one.
There is also a loss shape nobody has priced yet: not the error, but the silence after it. In July, during an internal evaluation run on live websites, an Anthropic model submitted a fabricated tip about an unsolved homicide to a Philadelphia police tip site. The tip was spam-filtered and never investigated. Anthropic did not discover what its agent had done for 72 days. A broker placing agent cover today is underwriting detection as much as behaviour — and detection is the part with no actuarial table at all.
The silent middle is closing at the same time
While brokers assemble small affirmative limits at the top of the market, the broad middle is moving the other way. Aon’s 2026 AI fact sheet puts it plainly: to the extent AI perils are covered by existing policies at all, over 90% of that coverage is “silent” — the policy neither affirms nor excludes AI, because it never mentions it. Silence used to be the client’s friend; an arguable policy is worth more than an explicit exclusion at claim time.
That arguability is now being retired on a schedule. Verisk’s ISO generative-AI exclusion forms — CG 40 47, CG 40 48, and CG 35 08 — took effect January 1, 2026, and sit inside the standard forms most U.S. commercial policies are built on. AIG has said it adopts the standard forms automatically; Chubb holds the same option — while simultaneously affirming AI cover in Google Cloud’s Risk Protection Program alongside Munich Re and Beazley. The same carrier can exclude on one form and affirm on another, which is precisely why the forms conversation has to happen before renewal rather than after a loss.
Marsh, the largest broker in the market, has taken the fight public. In an October letter to leading insurers, Marsh Risk chief executive Nick Studer called AI exclusions a “backward step” that “will increase coverage uncertainty and increase disputes,” and Marsh has said it will steer clients toward insurers that do not impose them. Read that letter correctly: it is not an argument that AI risk is small. It is a broker spending its market weight to keep the old tower arguable, because arguable is worth more than nothing while the affirmative market is still measured in tens of millions.
The broker’s sequence
Put the documented moves in order and a practice emerges — the answer a broker gives when the limit doesn’t exist.
First, audit the tower and name the silence. Before anything is bought, the client gets a map: which policies mention AI, which are silent, and which renew this year with a CG 40 47-series exclusion attached. In a gap market, the map itself is a deliverable — it converts an unknown exposure into a set of dated decisions.
Second, place the affirmative layer that exists, and settle the allocation fight at placement. The Vanguard AI structure is the working template: Chaucer’s cyber and tech E&O stays primary for breach-driven loss, a standalone Armilla policy carries loss driven by model behaviour, dedicated AI limits keep AI claims from eroding the traditional tower — and predefined allocation rules decide, in advance, which policy responds when a loss is part cyber event, part model error. The dispute that used to happen at claim time gets resolved on the day the programme is bound, while the broker still has leverage.
Third, move the next layer by contract. Since 2023, Microsoft, Google, and OpenAI have sold copyright indemnities alongside their AI products — conditioned, typically, on using the provider’s safety filters and not deliberately prompting for infringing output. Those are contract terms, not insurance, and they sit inside limitation-of-liability clauses unless negotiated out. In a capacity gap, negotiating the indemnity — its conditions, its cap, the vendor’s own certification and insurance as a procurement requirement — is placement work. The question shifts from “what limit can we buy?” to “whose balance sheet stands behind this exposure: ours, the market’s $25 million, or the vendor’s?”
Fourth, retain the tail knowingly — and say so. What cannot be transferred can still be structured: a defined middle layer funded through a self-insured retention or a captive, and the catastrophic tail held on the balance sheet disclosed as retained. That disclosure is not a footnote. The capacity gap is surfacing now partly because Anthropic and OpenAI are approaching public listings, where an unquantified, undisclosed uninsurable tail is a governance problem, while a quantified, disclosed one is a risk decision. The broker’s job is to make it the second.
Fifth, sell the client on why the small policy is still worth buying. A $25 million limit against a nine-figure exposure looks like a rounding error until you price what else it carries. Specialty AI policies are underwritten on simulation testing and certification — an outside party’s structured assessment of the model and the controls around it. To regulators, boards, and IPO investors, that underwriting functions as a de facto audit: someone with money at risk examined the system and agreed to stand behind a piece of it. The limit is small. The artifact is not.
One more constituency should hear the sequence plainly: brokers themselves. Armilla has noted that brokers are increasingly being told they carry a professional responsibility to advise on AI-specific coverage. In a market where silence is expiring by form number and date, the renewal conversation that never mentions AI is becoming its own exposure.
Capacity is constructed, not found
None of this is exotic. Assembling cover out of fragments for a risk the market barely wants is the appetite craft this desk described in What Underwriters Now See About Your Submissions — know exactly which desk wants which slice before you submit — run under scarcity instead of surplus. And part of the scarcity is a data problem the industry is working from the other side: as the Lexcel piece showed this week, carriers are deploying AI inside their own underwriting faster than they can price AI risk outside it; the institutional memory being built there is, in part, the missing actuarial table being written in real time.
Some industry voices have called for a U.S. government liability backstop for AI. As of the Journal’s report, that is a talking point — no named official, programme, or bill stands behind it — and a broker who lets a client plan around it is selling fiction.
Until capacity arrives, the broker’s product in the AI market is not a limit. It is the sequence: name the silence before it expires, place the affirmative layer with its allocation rules agreed, move what can be moved onto vendors’ balance sheets, retain the rest with open eyes and a disclosure to match, and treat even a small bound policy as the governance evidence it has become. The companies asking for billions in cover cannot buy it. They can still be brought to market honestly — and bringing them honestly, in writing, is the job.