What actually exists
There is a real AI insurance market. It is small, young, concentrated in a handful of writers, and mostly not doing what buyers assume it does.
The market divides into two things that get called the same name. Performance cover pays when a model fails to meet an agreed accuracy or performance threshold — no allegation of negligence needed, and no third party required. Liability cover pays when somebody else is harmed and comes after you. Munich Re has been writing the first since 2018. The second is far newer, far thinner, and the reason most of this page exists.
What is covered, and what is not
Grouped by how well the existing market actually responds. This is our assessment rather than a citation, and a broker with a specific risk may place things we would not expect to be placeable.
Model performance
Accuracy, drift and degradation against a contracted threshold. The oldest and best-developed part of this market.
- Performance guarantees for AI vendors
- Warranty-style triggers, no fault needed
- Well suited to enterprise procurement
Professional and tech E&O
Written for software that waits to be told what to do. Responds to some AI losses — and since January 2026, ISO generative-AI exclusion endorsements (CG 40 47 / 40 48 / 35 08) exist for carriers to attach, with 60+ US groups filing around adoption.
- Advice and output errors — sometimes
- Agentic action — rarely contemplated; ISO wording is generative-AI-specific, robotics reach unsettled
- Exclusions invisible on a certificate
Autonomous action and bodies
Loss caused by a system acting without a human confirming that action, and by machines that move. Little standardised capacity at any price.
- Agentic transactions and irreversible acts
- Humanoid and fleet third-party liability
- Correlated, fleet-wide software failure
For embodied systems specifically the position is starker. Robot fleets are today insured by disassembling them into lines written for other things: commercial general liability for the bodily injury, product liability for the manufacturer, inland marine or equipment cover for the asset, motor for anything road-registered, workers' compensation for the employee standing next to it. Each of those forms was drafted on the assumption that a person decided what the machine did. None of them contemplates the machine deciding, and the seams between them are where a claimant's lawyer goes to work.
Admitted, or surplus lines
This distinction is invisible on a certificate and decides what happens to you if your insurer fails. It is worth two minutes.
An admitted carrier has filed its rates and forms with the state insurance department and is licensed there. In exchange for that supervision, its policyholders are protected by the state guaranty fund: if the carrier becomes insolvent, the fund pays covered claims up to statutory caps.
A surplus lines (or non-admitted, or E&S) carrier is not licensed in the state and does not file rates or forms. That freedom is the entire point — it is how a new risk gets written at all, because you cannot file a form for a risk nobody has priced. The trade is explicit and it is the part buyers miss: surplus lines policies are not protected by state guaranty funds.
Essentially all dedicated AI liability capacity today is non-admitted — Lloyd's syndicates, Bermuda paper, and specialty E&S writers. That is not a scandal; it is the normal path. Cyber and environmental liability were both predominantly E&S for years before the admitted market built enough experience to file forms and follow. AI is at the same point on the same curve.
The practical consequence for a buyer is that carrier financial strength is doing the work the guaranty fund does elsewhere. When there is no state backstop, an A-rated balance sheet is not a nicety on a checklist — it is the whole of your protection. Ask which carrier, ask the rating, and ask whether it is admitted in your state. Roboline places on A-rated paper, admitted where available and surplus lines where it is not, and the certificate names the carrier.
What the courts have already decided
The question is no longer whether AI-attributed losses will produce large judgments. They have, across every mechanism by which such a loss can arise.
Grouped below by mechanism rather than by industry, because the mechanism is what determines whether a policy responds. Every figure is from public reporting or filings, linked at the foot of this page.
Physical autonomy
A jury priced driver assistance at $243M — while blaming the driver.
Benavides, Florida, August 2025. A Model S on Autopilot ran a stop sign at roughly 62 mph, killing a bystander. The jury assigned Tesla 33% of the responsibility — the driver, who had dropped his phone, carried the rest — and still returned $43M compensatory plus $200M punitive. The trial court upheld it in February 2026; it is on appeal, with three state attorneys general asking the Eleventh Circuit to cut the punitive award. The number to notice is not the total. It is that a minority share of fault produced a nine-figure bill.
Employment
The software provider was held in as an agent of its customers.
Mobley v. Workday, N.D. Cal. The court refused to treat Workday as merely a supplier of tools, finding it sufficiently involved in hiring decisions to face liability as an agent of the employers using it. In May 2025 the court preliminarily certified a nationwide ADEA collective covering applicants aged 40 and over screened since September 2020 — potentially millions of people — and authorised collective notice in February 2026. This is the case that puts the AI vendor in the caption, not just the deployer.
Training inputs
The largest copyright recovery in US history settled only half the question.
Bartz v. Anthropic, N.D. Cal., final approval July 2026. $1.5B, roughly $3,000 per work across an estimated 500,000 books. The detail that matters for anyone pricing this risk: the release covers the inputs side only — acquisition and copying — through August 2025. Claims arising from model outputs are expressly not released, and neither is future conduct. The largest AI settlement so far resolved the easier half.
Contract
A company is bound by what its bot said.
Moffatt v. Air Canada, BC Civil Resolution Tribunal, February 2024. The airline argued its chatbot was a separate entity responsible for its own statements. The tribunal rejected that outright and held the airline to the fare its bot invented. The award was C$650.88 — which is exactly why it belongs on this list. A trivial individual loss, arising from uniform automated conduct, applied to everyone who asked the same question, is the anatomy of a class action.
Algorithmic decisions
An algorithm that decided fast, and was wrong nine times out of ten on appeal.
Class actions over UnitedHealth's nH Predict tool for post-acute care denials survived dismissal in part in February 2025, and in March 2026 the court ordered broad discovery into how the tool was implemented and used. Reporting indicates roughly 90% of appealed denials were reversed. A parallel action over Cigna's PXDX — reportedly clearing claims at about 1.2 seconds each — was allowed to proceed in March 2025. Automated adverse decisions against individuals produce the cleanest class definitions in law.
Uncontrolled execution
Forty-five minutes of unsupervised execution ended a public company.
Knight Capital, August 2012. A deployment reached seven of eight servers and revived dormant code, producing roughly four million executions across 397 million shares before anyone could stop it. Pre-tax loss of about $440M and a firm that did not survive the year. It predates the current wave entirely, which is the point: this failure mode is not speculative and never was. Agentic systems simply make it available to companies that are not broker-dealers.
Shared dependency
One update, 8.5 million machines, and a single airline claiming half a billion.
CrowdStrike, July 2024. A content update crashed roughly 8.5 million Windows systems worldwide. Delta alone attributed about $500M in losses to it, across 7,000 cancelled flights and 1.3 million passengers, and sued. Delta's filing asserts that testing the update on a single machine would have revealed the fault. Every insured running the same dependency failed on the same morning — the property that makes conventional actuarial independence assumptions invalid.
Fixed per-act damages
Where the law sets damages per act, automation converts a config error into arithmetic.
The Telephone Consumer Protection Act sets statutory damages at $500 per violation, rising to $1,500 for knowing or wilful violations, assessed per message and uncapped in aggregate. An automated campaign reaching 100,000 recipients without valid consent creates $50M–$150M of exposure before anyone argues about actual harm. Similar per-act structures exist in biometric and privacy statutes. Harm stops bounding the loss; the multiplier is written into the statute.
The gap
The largest dedicated AI limit on the market is roughly $25M. The largest AI-attributed loss on record is $1.5B.
Those two numbers describe the same risk class, in the same year, and they are two orders of magnitude apart. Everything Roboline is building sits in the space between them.
Losses shown are gross amounts reported or awarded, not necessarily insured losses, and several remain subject to appeal. They are the right comparison anyway: an insurance market is sized against the losses that can occur, not the ones that happened to be covered.
Two conclusions follow, and they point in opposite directions for different people.
If you deploy these systems: where the exclusion has attached, the cheapest fix is a follow-form carve-back of exactly what it removed (RL-07) rather than a new programme. More broadly: the exposure is demonstrated, the defence that the software is somebody else's problem has been tested and has failed, and the cover available to you is thin, mostly non-admitted, and frequently excludes the specific thing you are worried about. That is a bad combination to discover during a claim rather than before one.
If you are looking at this as a market: a class with demonstrated nine-figure severity, effectively no standardised capacity, no agreed vocabulary, no published rating basis, and incumbents actively withdrawing via exclusions is the textbook description of a line that gets built by somebody. We would rather it were built on published methods than on whatever survives the first hard market.