Your Business Uses AI. Does Your Insurance Know That?

Posted on by McGriff-Williams in Blog, Business Insurance |
Illustration of a laptop with a chat bubble, circuit lines, a shield and a policy document

Maybe your office manager uses AI to write job postings, your website chatbot answers questions after hours, or your estimator runs takeoffs through AI software. These tools save real time. They also raise a question most business owners haven’t asked: if something the AI produces harms someone else, who pays?

Often, the claim is made against the business that used the tool, even if you only subscribe to it. The insurance industry is still deciding how to handle that risk. Here’s what we know so far.

AI use is growing, and much of it is unofficial

According to the U.S. Census Bureau’s Business Trends and Outlook Survey, 17% to 20% of U.S. businesses reported using AI in the previous two weeks between December 2025 and May 2026. The rate was 37% for firms with 250 or more employees and under 20% for firms with four or fewer.

Employees also use AI tools on their own. A 2025 industry study of 600 organizations worldwide that had a data breach found that 20% had a breach involving “shadow AI,” meaning AI tools employees used without IT or security oversight. Organizations with high levels of shadow AI saw average breach costs about $670,000 higher than those with a low level or none.

Five ways AI can lead to a claim

AI rarely creates a new kind of lawsuit. It gives familiar claims a new way to start.

1. Financial harm from a wrong answer. In a 2024 Canadian tribunal case, an airline’s website chatbot gave a customer wrong information about a refund policy. The tribunal held the airline responsible and rejected the argument that the chatbot was responsible for its own statements. Picture a leasing chatbot that misstates an apartment’s fees.

2. Copyright, trademark or fake-review problems in AI-written marketing. AI-generated ads and images may closely resemble someone else’s protected work. The Federal Trade Commission’s rule on consumer reviews and testimonials took effect October 21, 2024. It bans fake reviews, including AI-generated reviews that appear to come from people who don’t exist or never used the product. That matters for restaurants, retailers and any business that depends on online ratings.

3. Defamation. AI tools sometimes state false things confidently. A post or chatbot reply with a false claim about a competitor or a former employee can lead to a defamation claim against the business that published it.

4. Unauthorized data disclosure. When an employee pastes tenant applications, customer records, pricing or bid details into a public AI tool, that information may leave your control. That’s a privacy problem, not only an IT problem.

5. Injury or property damage from relying on AI output. A contractor or manufacturer that relies on AI for quantities, specifications or product instructions still owns the result if someone is hurt or property is damaged.

Hiring tools deserve a mention too. In 2023, the U.S. Equal Employment Opportunity Commission (EEOC) reached a $365,000 settlement of its lawsuit alleging that a company’s application software automatically rejected older applicants. In 2025, in a separate case that is still ongoing, a federal court preliminarily allowed age discrimination claims against the provider of an AI applicant screening system to proceed as a collective action. Employers can still face discrimination claims over hiring decisions made with help from software.

How your current policies may or may not respond

Policies vary, and the answer always depends on your exact policy wording. Here’s a general look:

  • General liability (GL) policies generally address bodily injury, property damage and “personal and advertising injury.” Depending on the policy terms, that last category can include some defamation claims and some copyright claims tied to your advertising. Standard industry endorsements with a January 2026 edition date let insurers exclude claims “arising out of generative artificial intelligence.” One version (CG 40 47) excludes bodily injury, property damage and personal and advertising injury. Another (CG 40 48) excludes only personal and advertising injury. A third (CG 35 08) is for separate products and completed operations liability policies. These endorsements are optional, and their use varies by insurer and state, so not every policy includes them. Review your policy with a licensed member of our team to see whether yours has one or similar wording.
  • Professional liability / E&O may apply when your business provides professional services such as design, estimating or consulting and an AI-assisted result is wrong. Separately, at least one insurer has introduced a broad AI exclusion for management liability policies, such as directors and officers (D&O), employment practices and fiduciary liability.
  • Cyber liability usually addresses data breaches and privacy costs. How it treats a loss involving an AI tool, especially one used without approval, depends on its wording. A pure financial loss caused by a wrong AI answer, with no breach involved, may not fit a cyber policy at all.
  • Employment practices liability (EPL) is typically where discrimination claims from hiring and employment decisions are addressed, including decisions made with help from software.

A new kind of policy is emerging

Some insurance markets now offer standalone generative AI liability policies, including through the surplus lines market. Industry materials describe these policies as built for businesses that use AI, not only for tech companies that build it. Coverage is often organized around the same harms listed above: financial loss from wrong outputs, intellectual property and defamation, data disclosure, and injury or property damage.

They aren’t a cure-all. An insurance wholesale executive told Insurance Business in October 2026 that it may take real business losses before many companies buy this coverage, and that the industry is still sorting out how AI exposures fit with general liability, cyber and other coverage. Published terms for one such policy exclude cyber attacks, employment and discrimination claims, and AI tools not listed on the policy. That policy is also claims-made, aimed at mid-sized and larger companies, and not available in every state. For most businesses, the first step is understanding the policies you already have.

Practical steps

You don’t need to stop using AI. These habits help:

  1. List the AI tools you use, including chatbots, hiring software, estimating tools and AI features built into software you already pay for.
  2. Write a short AI use policy. Spell out what employees can and can’t put into AI tools, and who approves new tools.
  3. Keep a person in the loop. Have someone review AI-written ads, bids, specs and customer messages before they go out.
  4. Tell people when they’re talking to AI.
  5. Check vendor contracts to see who is responsible if an AI tool makes a mistake.

Questions to ask your agent at renewal

  • Does my general liability policy include a generative AI exclusion, such as CG 40 47, CG 40 48 or CG 35 08, or any other new AI wording?
  • Do my professional liability, D&O or EPL policies include an AI exclusion?
  • If an AI tool we use gives a customer wrong information, makes an advertising claim, or contributes to injury or property damage, how would my policies respond?
  • Would my cyber policy respond to a data issue involving an AI tool an employee used without approval?
  • Are standalone AI liability options available for a business our size in Florida, and what do they exclude?

We’re here to help you understand it

McGriff-Williams Insurance is an independent insurance agency that has served businesses from Gainesville since 1983. A licensed member of our team can review your current policies with you, point out AI-related wording, help you understand what you have, and may be able to compare options from the insurance companies we represent. Call us at (352) 371-7977 or visit mcgriffwilliams.com.

This article is for general education and isn’t legal advice. Coverage depends on the specific terms, conditions and exclusions of each policy. Policies vary, so review your policy wording. Information is current as of October 26, 2026.

Sources

  1. U.S. Census Bureau, “Large Firms With at Least 20 Employees Biggest AI Users” (May 2026): https://www.census.gov/library/stories/2026/05/ai-use-businesses.html
  2. IBM, Cost of a Data Breach Report 2025 press release (July 30, 2025): https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls ; IBM summary: https://www.ibm.com/think/insights/data-matters/cost-of-a-data-breach
  3. Moffatt v. Air Canada, 2024 BCCRT 149 (Civil Resolution Tribunal of British Columbia): https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do
  4. Federal Trade Commission, “Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials” (Aug. 14, 2024): https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials
  5. 16 CFR 465.2: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465/section-465.2
  6. U.S. EEOC, “iTutorGroup to Pay $365,000 to Settle EEOC Discriminatory Hiring Suit” (2023): https://www.eeoc.gov/newsroom/itutorgroup-pay-365000-settle-eeoc-discriminatory-hiring-suit
  7. Mobley v. Workday, Inc., No. 3:23-cv-00770-RFL (N.D. Cal.), order granting preliminary collective certification (May 16, 2025); case pending: https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_23-cv-00770/pdf/USCOURTS-cand-3_23-cv-00770-1.pdf
  8. Form CG 40 48 01 26, Exclusion: Generative Artificial Intelligence (Coverage B Only), form text: https://assets.alm.com/63/68/46ed4bf34a0e807c9695e15c9e19/cg-40-48-01-26-exclusion-generative-artificial-intelligence-coverage-b-only.pdf
  9. Pillsbury Winthrop Shaw Pittman, “AI Exclusions in Insurance Policies: Broad Language, Uncertain Impact” (JD Supra), describing CG 40 47, CG 40 48 and CG 35 08: https://www.jdsupra.com/legalnews/ai-exclusions-in-insurance-policies-1735637/
  10. Hunton Andrews Kurth, “The Continued Proliferation of AI Exclusions” (example of a broad AI exclusion for management and professional liability policies): https://www.hunton.com/hunton-insurance-recovery-blog/the-continued-proliferation-of-ai-exclusions
  11. Insurance Business, “It may take real losses to sell AI insurance…” (Oct. 26, 2026), industry commentary: https://www.insurancebusinessmag.com/us/news/excess-surplus/it-may-take-real-losses-to-sell-ai-insurance-crc-specialty-ceo-594917.aspx