This is normal, and it is survivable.
Being asked to carry insurance is not an accusation. It is the standard way a large company contracts with a smaller one, and it has happened to every category of vendor before yours.
Contractors were asked for general liability. Accountants and lawyers were asked for professional indemnity. Anyone touching customer data was asked for cyber, and contractual requirements of that kind became one of the main reasons companies bought cyber cover at all — not because vendors wanted it, but because their customers made it a condition of doing business. AI is arriving at the same place, which is why you got the email.
You may already be most of the way there
If you carry technology E&O or professional liability, several provisions of a standard AI clause are probably already satisfied. The requirement is usually smaller than it reads.
One provision fails quietly
A policy can be valid, adequate and correctly certificated while excluding the exact thing your customer is worried about. That failure is invisible on a certificate, which is why the clause asks for it in writing.
Nothing on this page requires you to buy anything, and most of what it recommends is an email to the broker you already have.
Does the policy you already hold satisfy the clause?
Answer honestly, including “I don’t know” — which is the correct answer to at least one of these for almost everybody, and is itself a finding worth having. Nothing is sent anywhere; this runs entirely in your browser.
Does your policy explicitly respond to claims arising from what your AI system outputs or does?
Not whether you have insurance — whether the wording covers this. Technology E&O written before 2023 was drafted around professional services and software defects, not around a system that decided something.
Has your insurer confirmed in writing that there is no AI exclusion or sub-limit?
This is the one nobody has checked. Exclusions do not appear on a certificate, and several standard forms have had AI exclusions added at renewal without the insured registering the change.
Are your limits at least $5M each claim, with an aggregate to match?
The per-claim figure is the one on the certificate. The aggregate is the one that runs out — and if it is shared across every customer you have, the tenth claimant finds nothing left.
If your policy is claims-made, is the retroactive date earlier than your oldest live customer contract?
A retro date later than the contract start means the first stretch of that relationship is uninsured, even though you have held a policy the whole time.
Can you add customers as additional insured, primary and non-contributory?
Most clauses require it, including this one. Some carriers will not grant it on technology forms, which is usually discovered the week a contract is due to sign.
Is your insurer rated A− or better by AM Best?
Standard in almost every vendor insurance clause. Worth checking if your cover came bundled with something else.
Answer the six questions above
Your result appears here, with the specific provisions that need attention.
We write exactly this risk, and the application takes about two minutes. If your existing broker can close the gaps, use them — that is genuinely the cheaper path and we would rather tell you so now.
The provision that catches nearly everyone
Most vendor insurance clauses can be satisfied by adjusting a limit or requesting an endorsement. One cannot, and it is worth understanding before you reply to your customer.
As losses involving AI systems started appearing, insurers did what insurers do with an exposure they cannot yet price: they began excluding it. In January 2026, ISO published optional generative-AI exclusion endorsements for commercial general liability (CG 40 47, CG 40 48, CG 35 08), and more than sixty US insurance groups have since filed with state regulators around adopting them. The endorsements attach at adoption or renewal, usually as a small form on the schedule, and rarely with a phone call about it. Two things follow: your policy may have picked one up at its last renewal without anyone telling you — and because the wording targets generative AI, whether it reaches your agentic or robotic system may be genuinely undecided even after you read it.
The result is a vendor holding a genuine, paid-up, adequately-limited policy that would decline the one claim their customer is asking them to insure. And because exclusions never appear on a certificate of insurance, neither party finds out until there is a loss.
That sentence costs nothing and resolves the question permanently. If the answer is that an exclusion applies, you have found it in a week where you can do something about it rather than in a year where you cannot.
What to do this week
Send the exclusion email. One sentence to your broker, above. Everything else waits on the answer.
Find your declarations page — not the certificate. You need the limits, the aggregate, and the retroactive date if the policy is claims-made.
Reply to your customer with a date, not an answer. "We are confirming the position with our insurer and will come back by [date]" is a completely adequate response and buys you the time you need.
Fix the gaps in order of cost. Limits and retro dates are usually a premium adjustment. An exclusion generally is not, and may mean a different market.
Do not send a certificate and hope. If a clause requires written confirmation of no AI exclusion and you supply a COI instead, you have represented something you have not verified — in a contract you signed.
If it turns out you need cover, the clause your customer sent is carrier-neutral and any A-rated insurer satisfies it. We are one option and we would like the business, but a requirement met by your existing broker is met.