Silent AI, and Who Pays When the Silence Ends

Silent AI is the industry term for the unpriced, unbounded liability created when a business integrates AI into its operations while the insurance policies covering that business neither explicitly include nor explicitly exclude AI-driven risk. The term is modeled directly on silent cyber, the coverage gap that defined commercial insurance through much of the 2010s: traditional policies, written before ransomware and large-scale data breaches were a known risk category, ended up paying out for exactly those losses simply because the old contract language never said they wouldn't. Insurers spent roughly five years forcing cyber risk out of general policies and into its own separately priced product. The same pattern is now repeating for AI, and repeating faster.

Silent AI's mechanism is best evidenced quantitatively before it is illustrated by example. Gallagher's 2026 research found that one in five insurance professionals surveyed reported their own insureds had already experienced AI-linked losses of this kind — a real, measured signal that the gap this memo names is not hypothetical. The specific mechanism is illustrative rather than a documented catalog of individual cases, but the pattern it describes is exactly what the survey data captures: a lawyer using generative AI that cites fabricated case law, or miscalculates a financial projection, generates exactly the kind of malpractice exposure that would be submitted under ordinary professional indemnity coverage, because the policy was never written to distinguish between a human's error and a tool's. An automated hiring system that inadvertently screens out candidates on a protected characteristic produces the same shape of exposure under standard employment practices liability coverage. An autonomous system — a manufacturing line, a delivery robot, a decision-making agent — that damages property or halts production falls under ordinary product liability and business interruption coverage the same way. In each case, the underlying dynamic is not that these specific claims are individually documented as "paid because of silence" in public records — it is that the insurer was covering a risk it never assessed, never priced, and in most instances never knew it was carrying, which is precisely the exposure the Gallagher figure quantifies at scale.

AI agent liability insurance is a real, priced market now — and most existing coverage was just excluded from it.

In January 2026, Verisk — whose standardized policy forms underpin roughly 82% of US commercial liability insurance — rolled out optional exclusion endorsements removing generative AI and AI agent losses from standard bodily injury, property damage, and advertising injury coverage. Carriers adopted them quickly; one Lloyd's coverholder predicted near-universal uptake, though as of mid-2026 adoption is not yet automatic on every renewal, and the market is fragmenting rather than cleanly bifurcating — some carriers are integrating AI risk questions into existing underwriting rather than applying a pure exclusion, and buy-back options exist alongside the endorsements themselves. This is the dominant market action ending Silent AI on a structural basis, as this memo has defined it: not a regulation, not a court ruling, but a standardized policy form that stops paying by accident and forces every AI-related risk to be either explicitly excluded or explicitly, separately priced. A growing share of businesses running agentic AI are discovering, at renewal, that coverage they had never questioned no longer contemplates the thing their business actually does.

A narrow, early, specialist market has formed specifically to fill the gap that exclusion created. Armilla — a Toronto-based managing general agent, the only one focused exclusively on AI insurance — launched the first standalone AI liability policy in April 2025, underwritten at Lloyd's, with capacity also drawn from Swiss Re among other reinsurers; by January 2026, coverage limits had expanded to $25 million per organization. HSB launched a product in March 2026 explicitly aimed at small and mid-sized businesses, distributed through partner carriers rather than sold direct — a genuine exception worth naming precisely, not the standardized, purchase-anywhere product a mature market eventually produces. Klaimee — insuring autonomous AI agents specifically, covering both first- and third-party harm — and several other specialist carriers round out a market that remains enterprise-first and largely bespoke; as of mid-2026, no carrier sells a policy a small or mid-sized operator can buy directly and off the shelf the way it buys general liability coverage. AXA, Allianz, and Zurich, the three largest European primary insurers, had not launched dedicated products as of the same date. This is early, not mature, and worth naming precisely rather than rounding up to "the market has arrived."

The evidence layer, and what it shares with work already done

The most consequential detail in this market is not the coverage limits. It is what unlocks them. AIUC-1, the certification standard used by ElevenLabs to secure the first AI-agent-specific policy in February 2026, functions as the evidence layer a carrier requires before it will underwrite — 51 requirements and 130 controls across six pillars, independently audited by a third party, with certified agents re-tested against thousands of adversarial scenarios quarterly rather than assessed once. It is a materially more formal and continuously verified process than an internal record, built by an industry consortium specifically to give carriers and enterprise buyers a standardized way to assess agent risk.

A correctly specified Accountability Trace — the specific subset of the Proof of Action record structured to establish legal accountability for an autonomous decision — does not replicate that apparatus, and claiming it does would overstate the comparison. What the Trace supplies is a substantial portion of the same underlying evidentiary content a certification process and a carrier are both looking for: contemporaneous verification state at decision time, a tamper-evident chain from input to output, and a link to the disclosed terms under which a decision was made. A business with a genuine Trace is not starting from zero when it approaches an insurer or a certifying body — it already holds the decision-level record those processes are built to verify. It has not, on its own, done the independent, adversarially-tested, continuously-renewed work that turns that record into a recognized certification.

Where the Trace is not yet sufficient on its own

Underwriting is not identical to regulatory documentation, and the gap is worth naming rather than assumed away. A carrier is pricing a specific financial exposure, which means it needs the Trace connected to something the compliance-facing version does not always include: a demonstrated Recovery Latency — the time from failure detection to restored autonomous operation — and Rollback Cost — the financial and operational cost of reversing an incorrect autonomous action once identified — history, since these are the operational metrics that most directly translate into claims experience: how fast a failure resolves and what it costs to reverse. A business approaching this market with a strong Accountability Trace but no measured Recovery Latency or Rollback Cost history is presenting a carrier with proof of correct design and no evidence of actual loss experience, which is a weaker underwriting position than either piece of evidence alone would suggest.

The connection to exit engineering

Turnkey Margin already argues that an autonomous business should be structured for immediate acquirer deployment: predictable cash flow, no Key-Man Risk, no cultural integration requirement at close. Insurability is a concrete, checkable addition to that same argument, not a separate consideration. An acquirer evaluating an autonomous business now has a real, external, third-party-verified signal available that did not exist eighteen months ago: is this business currently insured under a named AI agent liability policy, and if not, could it be, given its documentation. Sophisticated strategic and PE buyers with dedicated insurance advisors are already positioned to notice this; it is not yet a default line item every mid-market acquirer's checklist includes the way Key-Man Risk or customer concentration are, though the exclusion wave's visibility is pushing it in that direction. A business that can answer yes to both has de-risked a specific, checkable exposure ahead of the point where every diligence process treats it as standard. A business that cannot answer either carries a gap that a buyer's insurance broker, once involved, will surface regardless of whether the seller raises it first.

This also connects to Continuity Reserve's existing logic, extended outward. Continuity Reserve is the internal specialist bench a business holds in reserve for tail-risk events its generalist Steward cannot resolve alone. A named AI liability policy is the external equivalent: risk transferred to a third party specifically underwritten to absorb it, rather than absorbed internally through a bench of specialists the business itself maintains and pays for on standby.

What this means in practice, today

The honest state of this market limits how far this argument can be pushed. Coverage is enterprise-first, bespoke, and priced case by case; a small or mid-sized autonomous business cannot yet buy a standardized policy the way it buys general liability coverage. The practical guidance for now is preparation rather than purchase: build the Accountability Trace, the Recovery Latency and Rollback Cost history, and the underlying documentation an AIUC-1-style certification process would ask for, specifically so that when the standardized product this market is visibly moving toward does arrive, the business is already positioned to qualify for it rather than starting the evidentiary work from nothing at the moment coverage becomes available off the shelf.

The Operator's Verdict

Silent AI was never a stable state — it was a temporary accident, the kind of gap insurers close the moment its cost becomes visible on their own books. The exclusion wave made the absence of AI agent coverage visible before the market had finished building the products to fill it, the same pattern silent cyber followed a decade earlier, compressed from five years to eighteen months. A business that has already built the Accountability Trace, and has started measuring Recovery Latency and Rollback Cost as a matter of course, is not preparing for a future insurance requirement. It has already built most of what the requirement will ask for.

Technology changes what can go wrong autonomously. Insurance determines who is left holding the cost when it does — and evidence determines the price.