Washington has a standard playbook when it comes to emerging commercial risks: Make companies buy insurance coverage, then put taxpayers behind the losses. That prescription is gaining fans as artificial intelligence (AI) creates new liability risks. It skips the question insurers need answered first. What, exactly, will courts hold their customers liable for?
Nearly a decade ago, as the nascent cyber-insurance market was just finding its footing, I wrote about how coverage could encourage companies to improve cybersecurity. Well-meaning commentators and policymakers, impatient with the market’s progress, wanted government to give it a shove by requiring firms to buy coverage.
I was skeptical. In a policy study for the R Street Institute and commentary for The Hill and Insurance Journal, I warned against strangling the cyber-insurance market in its cradle. The argument was straightforward. Private cyber insurance could manage most risks, provided politicians stayed out of the cybersecurity market and avoided top-down mandates that distorted insurers’ incentives to assess and price risk.
The past decade supports that caution. Cyber insurance has grown substantially, but the promised cure-all has yet to arrive. The market has cycled through periods of steep premium increases and tighter coverage.
The bottleneck was never a shortage of private capital willing to insure these risks. It was—and remains—uncertainty about legal liability. Courts still struggle to establish what precautions companies must take, whom they owe a legal duty to protect, and when a breach is sufficiently connected to an injury to justify liability. That uncertainty makes it difficult for insurers to price the risk of rare but costly claims. They respond by raising premiums, narrowing policy terms, and excluding certain activities from coverage.
AI and autonomous systems—technologies that act with limited human direction—now present insurers with similar questions, even as they prompt familiar calls for insurance to manage liability. Compulsory coverage and government backstops to absorb losses are back on the menu.
We should reject those proposals for the same reasons that counseled caution a decade ago. Both chill innovation in insurance and the technologies it covers. They push insurers toward rigid, standardized products before they understand the risks and burden technology developers and users with premature compliance requirements.
California’s Fault Line
California’s response to the 1994 Northridge earthquake shows how an insurance mandate can set off a destructive chain reaction. As I explained in examining the origins of the California Earthquake Authority (CEA), state law required insurers selling basic homeowners policies to offer earthquake coverage, too.
Northridge exposed the risk of catastrophic losses that insurers had failed to price into their policies. The mandatory-offer requirement tied earthquake coverage to their homeowners business. To limit their exposure, insurers representing 95% of the market stopped writing new homeowners policies altogether.
The resulting crisis stalled residential real estate transactions and prompted the state to create the CEA to separate earthquake risk from basic homeowners coverage. California had to repair a market its own mandate had helped break. Mandatory AI insurance could set off a similar cascade, driving private capital from the underlying insurance markets when insurers cannot price the required coverage, then inviting government to fill the gap.
Private capital is already moving into AI insurance. The Artificial Intelligence Underwriting Council (AIUC), backed by $55 million in private funding, is developing technical auditing standards, including AIUC-1, alongside a mutual insurer model—a structure in which policyholders own the insurer. Its aim is to give insurers and customers a firmer basis for evaluating advanced AI systems.
AIUC draws explicit inspiration from Underwriters Laboratories (UL), whose safety-testing certification helped build trust in electrical products and support the electrical grid’s expansion without top-down mandates. That’s a promising model for building confidence in a new technology.
Yet AIUC’s foundational blueprint, “Underwriting the Agent Economy,” takes a wrong turn by endorsing a government backstop as the final layer of AI insurance. One proposed form is risk-priced state reinsurance—government coverage for insurers’ losses, with premiums tied to estimated risk.
Private innovators should resist that temptation. Calling for a federal safety net before private insurance arrangements have time to mature concedes defeat awfully early. It also threatens to distort the process through which insurers learn what risks cost and set premiums accordingly—the very process private mutuals aim to develop.
The Nuclear Option for AI Insurance
A recent analysis by the Center for Strategic and International Studies (CSIS) makes the same mistake. The otherwise excellent report argues that generative AI—systems that produce text, images, and other content—fails basic insurance tests for estimating losses and pricing coverage. It recommends preparing a layered federal backstop for catastrophic AI losses, modeled on the Price-Anderson Act’s framework for nuclear liability.
From a law & economics perspective, that proposal overlooks commercial nuclear energy’s cautionary history. Government efforts to shield the industry from risk ultimately crippled the industry they sought to protect. An AI version would repeat several mistakes:
- Weakening safety incentives. Shifting the risk of rare, catastrophic losses to taxpayers weakens the financial link between creating risks and bearing their costs. With government as the insurer of last resort, developers of the most advanced AI systems have less incentive to account for deployment risks or invest in safeguards. Private insurers also lose leverage to demand strict safety conditions.
- Advertising danger. Statutory liability caps send courts, state regulators, and the public an unsettling message—that the technology is so dangerous that private insurers will not cover it. In nuclear energy, that signal fueled local opposition, public hostility, and prolonged litigation. For AI, it could encourage regulatory panic and public resistance, undermining the trust its proponents hope to build.
- Crowding out private solutions. The promise of a federal bailout can discourage private alternatives before insurers have a chance to develop them. Those alternatives include catastrophe bonds, which enlist investors to cover specified disaster losses, and parametric reinsurance, which pays insurers when a predefined event occurs. Specialized risk pools and policyholder-owned mutuals offer other ways to spread losses. A backstop could short-circuit experimentation with all of them.
- Trading prices for prescriptions. When government displaces market pricing as the guide to acceptable risk, administrative rules take over. In nuclear energy, the Nuclear Regulatory Commission (NRC) imposed a rigid regulatory regime and tightened requirements during construction, sending capital costs soaring. Applying that template to AI would replace adaptable private audits with inflexible government mandates.
- Subsidizing the wrong problem. High premiums and narrow coverage can reflect a rational response to legal uncertainty. Treating them as proof of market failure mistakes the symptom for the cause. A taxpayer-funded backstop would subsidize uncertainty about civil liability while leaving the underlying legal questions unresolved.
Old Torts, New Tricks
Recent law & economics scholarship offers support for resisting these interventions. In “Liability for AI Agents,” KU Leuven legal scholar Maarten Herbosch challenges “technological exceptionalism”—the assumption that AI’s autonomy and unpredictability demand a wholesale overhaul of tort law, which governs civil liability for injuries.
Herbosch argues that AI agents fit largely within established rules governing negligence, defective products, and responsibility for another party’s conduct. His law & economics analysis calls for targeted refinements to those rules, with little justification for rebuilding tort law or imposing sweeping new accountability regimes.
That finding strengthens the case against insurance mandates and federal backstops. If existing legal principles can handle autonomous agents on economically sound terms, those interventions would needlessly distort the market. But insurers still face a practical obstacle. Courts have yet to establish clear, predictable precedents showing how those principles apply to AI.
Recent reporting in the Financial Times illustrates the problem. Insurers and legal advisers are assessing potential multimillion-dollar claims involving “rogue” AI agents, including incidents in which OpenAI models breached security controls at startup Hugging Face. Risk managers are also considering whether OpenAI’s Sam Altman or Anthropic’s Dario Amodei could face personal liability for inadequate oversight of their autonomous models. Such claims could implicate directors and officers (D&O) insurance, which covers certain claims against corporate leaders.
As scholars and insurers quoted in the article acknowledge, these liability theories remain untested in court. Would a judge find that an executive breached a duty of care or failed to exercise “reasonable business judgment” when a model that can respond differently to the same input behaves unexpectedly? How would negligence, strict product liability (liability for defective products without proof of negligence), or vicarious liability for another party’s conduct apply when an agent works across software supplied by multiple companies?
Hiscox CEO Aki Hussain captured the uncertainty of U.S. tort litigation: “It’s the US, so [a claim] could be under anything—whatever insurance they’ve got.”
Clarity Is the Best Policy
Insurers cannot price AI risks efficiently when they cannot predict how courts will apply D&O coverage or how claims will fall across errors and omissions (E&O) insurance—which covers claims arising from professional mistakes—cyber insurance, and general liability policies. That legal uncertainty drives narrower coverage and higher premiums. Private capital is available, and traditional tort law can handle the claims. But insurers still need a clearer sense of how courts will apply it.
Policymakers who want a mature AI insurance market that rewards sound safety practices should avoid coverage mandates and federal backstops. They should clarify legal standards, define duties of care within existing tort law, and establish statutory safe harbors that shield developers from specified liabilities when they meet clear requirements. Those steps would give insurers a firmer basis for pricing risk.
As in cyber insurance, private capital is already developing ways to manage the risks it can assess. Government’s useful contribution here would be legal clarity. Give insurers rules they can price.
