AI Insurance and Liability: Who Pays When AI Gets It Wrong

Your customer does not care whose model it was

A chatbot tells a customer they are entitled to a refund they are not entitled to. An extraction system misreads a delivery address and a high-value order goes to the wrong city. A drafted client letter contains an incorrect tax position that the reviewer missed. Somebody loses money. Who pays?

The instinctive answer is the AI vendor. In practice, it is almost always the business that put the system in front of the customer first. There is a well-known Canadian tribunal decision from 2024 in which an airline was held responsible for incorrect information its website chatbot gave a passenger about fares. The airline's argument that the chatbot was somehow responsible for its own statements did not succeed.

That does not mean vendors never bear liability. It means the chain of recovery starts with you, and whether you can pass the loss along depends on contracts, law and insurance that are worth understanding before anything goes wrong. This is a practical overview from an engineering firm, not legal or insurance advice.

The chain of responsibility

The key point is the gap between the first two rows. Your exposure to your customers can be large and open-ended. Your vendor's exposure to you is usually capped and full of exclusions for output accuracy.

What the law is doing

Legal frameworks are catching up but remain patchy, and we would not rely on any particular reading without advice.

• Existing law already applies. Negligence, contract, consumer protection, data protection and equality law do not stop applying because a decision involved AI.
• Product liability is widening in the EU. The revised EU Product Liability Directive explicitly brings software, including AI systems, within the scope of product liability, with member states implementing it over a transition period. That mainly affects those who supply products, but it matters to anyone selling AI-enabled products into the EU.
• The dedicated EU AI liability proposal stalled. The Commission withdrew its proposed AI Liability Directive in 2025, so fault-based AI claims continue to rely largely on national law.
• The EU AI Act adds duties, not a compensation scheme. Failing to meet deployer obligations for high-risk systems can bring regulatory consequences and would likely weaken your position in any related claim.
• UK, US and Gulf positions differ. Largely existing law applied to new facts, with sector regulators issuing guidance.

Timelines and details here move. Check the current position for your jurisdictions with a lawyer before relying on any of it.

What insurance may and may not cover

Insurance is where many businesses assume they are covered and have not checked. The relevant policies are usually existing ones:

• Professional indemnity for advice or services where AI helped produce the output. Check whether AI-assisted work is covered, excluded or requires disclosure.
• Cyber insurance for data breaches and some system failures. Check how it treats data sent to third-party AI providers and losses from manipulated AI inputs such as prompt injection.
• Public and product liability for physical harm or product defects, relevant where AI is embedded in products or operations.
• Directors' and officers' cover where claims allege poor oversight of AI risk.

Insurers have been reviewing wording because of 'silent AI' exposure, meaning policies that neither explicitly include nor exclude AI-related losses. Expect new questions at renewal and, in some cases, new exclusions. Specialist products that explicitly cover AI performance failures have also appeared. Whether any of this suits you is a conversation for your broker.

Questions to put to a broker:

1. Do any of our policies exclude losses arising from AI or automated decision-making?
2. Do we need to disclose our AI use, and have we?
3. Is AI-assisted professional work treated the same as unassisted work?
4. Are losses caused by a third-party AI vendor's failure covered, and does the insurer expect us to pursue the vendor?

Contract terms that shift some of the risk

You will rarely get an AI vendor to accept unlimited liability for its outputs. You can often improve your position at the margins: data protection and confidentiality breaches outside the general cap, an IP indemnity that covers outputs, warranties that the system will operate in line with its documentation, and clear notice of model changes. We go through these in more detail in AI procurement contract clauses.

The controls that matter more than any policy

Contracts and insurance deal with losses after they happen. The best protection is making serious errors unlikely and small ones containable. From an engineering point of view, that means:

• Human review before AI output reaches a customer, a payment or a decision about a person, wherever errors are costly
• Constrained outputs, such as a chatbot that can only quote refund policy from an approved source rather than generating it
• Confidence thresholds that route uncertain cases to people
• Full logging of inputs, outputs, model versions and human actions, so an error can be explained and its scope established quickly; see our post on AI audit trails
• Clear disclosure to customers that they are dealing with an automated system, and an easy route to a human
• An incident process that treats an AI error like any other operational incident

When SpiderHunts builds customer-facing assistants through our chatbot development service, the refund-promising chatbot is exactly the failure we design against. Anything with financial or legal consequence is pulled from a verified source or handed to a person. It makes the bot slightly less impressive in a demo and considerably less expensive in production.

You cannot insure your way out of a system that says whatever it likes to customers. Design it so it cannot.

A short checklist

1. List the AI systems whose errors could cause a customer or third party a financial loss
2. For each, identify the control that stops or catches errors, and test it
3. Read the liability and warranty sections of each vendor contract
4. Ask your broker the four questions above, in writing
5. Make sure logs would let you reconstruct any disputed decision
6. Record all of this in your AI risk register and review it annually

Frequently asked questions