Evidence note: one grounded research pass (2026-08-06) on how product-liability law and the insurance market treat evidence about AI systems. Every load-bearing quotation was checked at its issuing source; assessments are labelled. Re-verify before relying on time-sensitive claims.
AI liability and insurance: who can compel evidence¶
The question. When an AI system contributes to a harm, who can actually compel evidence about how it behaved? Ahead of any AI-specific statute, two mechanisms are answering that in practice: product-liability law, which now treats software as a product and penalises non-disclosure, and insurance underwriting, which prices what it can assess. Both bear directly on the Charter's argument that accountability requires evidence someone outside the operator can check — so it is worth knowing precisely what they require today, rather than assuming. This note is a citable evidence base, not a conclusion.
Short answer (assessment). Both mechanisms are moving, and neither yet reaches independent evidence. Liability law is the sharper of the two: from December 2026 an EU defendant who cannot disclose relevant evidence faces a presumption that its product was defective. Insurance is the softer: underwriters increasingly ask for documented internal governance, and nothing found shows a carrier or broker requiring an audit trail or a per-action record as a condition of cover. "Show us your governance" and "show us evidence someone else can check" are different asks, and only the first is currently being made.
What holds up¶
Grades: primary = read at the issuing body's own published source · self-reported = a company's claim about its own product · corroborated = trade press with a stated method, or two independent sources · unverified = circulating, not confirmed at source.
| # | Finding | Source (dated) | Grade |
|---|---|---|---|
| 1 | The Lloyd's market says it cannot see its insureds' AI use, and prices the risk on opinion rather than data. Respondents found the survey hard to complete because "Insurers are remote to insureds' use of AI; it is not always clear whether an insured is using AI in the ordinary course of their business and little data on AI usage is currently collected during underwriting, so survey questions exploring this usage have relied on underwriters' views and opinions rather than data", plus "a lack of claims data on AI contribution to losses" | LMA, Understanding AI Exposures: AI Loss Scenarios Survey Results, David Powell, Head of Technical Underwriting; survey conducted mid-2025 | primary |
| 2 | Underwriters nonetheless report high confidence in insureds' AI risk management — and the LMA states that confidence rests on no collected evidence. Only 18% thought insureds' procedures inadequate (89% "adequate" in the professional-indemnity scenario), under an explicit note: "The survey did not collect risk management data, claims information or data from external sources." Small n: a minimum threshold of six responses per scenario, up to 19 for some | LMA, same survey (2026-08-06 read) | primary |
| 3 | Brokers state publicly that evidence of AI governance changes commercial terms. "Underwriters increasingly expect: Clear evidence of AI governance · Documented model testing · Robust third-party oversight · Safeguards against data leakage and manipulation · Scenario analysis that incorporates AI-driven failures", and "Organizations that can demonstrate maturity in these areas will secure cleaner terms, greater capacity and more favorable outcomes" | Aon, AI Risk 2026: What Business Leaders Need to Know, 7 May 2026 | primary (broker-stated) |
| 4 | Affirmative AI cover exists, is keyed to measurable performance, and rests on the insurer's own assessment. Munich Re's aiSure covers "underperformance, unreliability and drift of machine learning models" and is "designed to address the KPIs of the AI most important to you", via a "structured process" and the reinsurer's own "risk assessment expertise". Armilla — a Lloyd's coverholder — pays out when an AI "fails to meet contractual KPIs (e.g., accuracy, bias) or defined business outcomes" | Munich Re aiSure and Insure AI; Armilla (both read 2026-08-06) | self-reported |
| 5 | A named case of third-party model validation preceding risk transfer. For the MKIII loan-decision model, "Armilla validated the model's performance, fairness, and robustness" and then wrapped it in an embedded performance warranty. Munich Re's page separately states the same MKIII model "is backed by Munich Re's aiSure™ insurance" | Armilla; Munich Re aiSure | self-reported (the relationship between the two claims is unverified) |
| 6 | Reinsurers publish AI liability as a named risk class with accumulation risk. AI brings "liability exposures linked to algorithmic failures or bias, intellectual property disputes, and non-physical business interruption"; "Growing reliance on a small number of cloud and AI service providers adds a further layer of systemic and accumulation risk"; insurers' own AI use is "reinforcing the need for strong governance, transparency, and human judgement" | Swiss Re Institute, sigma insights 01/2026: AI adoption is reshaping the risk landscape, Mahir Rasheed, 13 Jan 2026 | primary |
| 7 | Lloyd's own published position to legislators: AI is a liability and resilience challenge, but the answer is existing law, not new rules. "Lloyd's believes that AI may heighten cyber security risks and pose challenges in terms of professional and product liability. There is also potential increased risk to operational resilience because of the high concentration of insurers using the same cloud providers and similar Large Language Models"; and regulators "should focus AI risk management efforts on enforcing existing laws … rather than introducing new regulations". Context: 77 syndicates, 52 managing agents, £55.5bn GWP in 2024; "enhanced underwriting" already ≈$5bn of premium (~7% of 2023 GWP) | Lloyd's of London, written evidence AIFS0036 to a UK parliamentary committee inquiry into "how UK financial services can take advantage of the opportunities of artificial intelligence", April 2025 | primary (the specific committee was not confirmed) |
| 8 | EU product liability makes missing evidence legally expensive — and software is in scope. "'product' means all movables … it includes … software" (Art. 4(1)); a defendant must disclose relevant evidence on request (Art. 9(1)), which a court may require "to be presented in an easily accessible and easily understandable manner" (Art. 9(6)); and "The defectiveness of the product shall be presumed where … the defendant fails to disclose relevant evidence" (Art. 10(2)(a)), or where the claimant "faces excessive difficulties, in particular due to technical or scientific complexity" in proving defect or causation (Art. 10(4)(a)), rebuttably (Art. 10(5)). Transposition by 9 December 2026 (Art. 22(1)); the old directive is repealed from the same date (Art. 21) | Directive (EU) 2024/2853 | primary |
| 9 | The EU legislature tied its own review clause to insurance availability. Commission evaluation reports, from 9 December 2030 and every five years, "shall include information about the cost and benefits of the transposition of this Directive, a comparison with OECD countries and the availability of product liability insurance" (Art. 20) | Directive (EU) 2024/2853, as above | primary |
| 10 | There is no harmonised EU AI-specific fault regime to sit beside it. The AI Liability Directive proposal was listed for withdrawal in the Commission's 2025 work programme and formally withdrawn, notice published in the Official Journal on 6 October 2025 (C/2025/5423) | European Parliament Legislative Train — AI liability directive | primary (the Commission's stated ground — no foreseeable agreement — is corroborated, not read in the work-programme annex) |
| 11 | Switzerland's financial supervisor has already found, on inspection, that AI results often cannot be traced or reproduced. "Die FINMA beobachtete, dass Ergebnisse häufig nicht nachvollzogen, erklärt oder reproduziert und somit nicht kritisch beurteilt werden können" (§2.6); and "nur wenige Beaufsichtigte eine unabhängige Prüfung des gesamten Modellentwicklungsprozesses durch dafür qualifiziertes Personal durchführen" (§2.7). Where decisions must be justified to clients, staff, the supervisor or the audit firm, FINMA examined explainability "vertieft" | FINMA-Aufsichtsmitteilung 08/2024, Governance und Risikomanagement beim Einsatz Künstlicher Intelligenz, 18 Dec 2024 | primary |
| 12 | FINMA's expectations already name the Charter's own mechanisms. Pre-set performance indicators before productive use ("vorab festgelegte Performance-Indikatoren"), thresholds and validation methods, data-drift detection, documentation covering purpose, data selection, model choice, performance measures, assumptions, limitations, testing, controls and fallback — and monitoring that includes "die Analyse von Fällen, in denen die Ausgabe von den Anwendern ignoriert oder verändert wurde", because manual overrides reveal weaknesses (§§2.4–2.5). Independent review must deliver "eine objektive, versierte und unvoreingenommene Meinung" (§2.7) | FINMA 08/2024, as above | primary |
| 13 | The Swiss insurance association describes AI as silent in existing policies. "Verschiedene Exponierungen können durch verschiedene bereits bestehende Policen abgedeckt sein, da üblicherweise KI-Risiken weder ausdrücklich erwähnt noch explizit in der Police ausgeschlossen sind"; "In den meisten Teilen der Welt besteht Unklarheit in Bezug auf KI und bestehende Haftpflichtregime"; and designing cover — "Deckungsumfang, Limiten, Ausschlüsse oder Geltungsbereiche" — "wird für die Versicherer eine grosse Herausforderung darstellen" | SVV, Künstliche Intelligenz als Emerging Risk in der Haftpflichtversicherung, 4 March 2026 | primary |
| 14 | Standard generative-AI exclusion endorsements are now available for US general-liability policies — available for carriers to attach, not automatically present in every wording. Three ISO/Verisk endorsements — CG 40 47 (Exclusion – Generative Artificial Intelligence), CG 40 48 (Coverage B only) and CG 35 08 (products/completed operations) — effective January 2026, defining the term as "a machine-based learning system or model that is trained on data with the ability to create content or responses, including but not limited to text, images, audio, video or code" | Big "I" Virtual University, Nancy Germond, 21 Oct 2025; form numbers confirmed by Carrier Management, 23 Jul 2026 | corroborated — the ISO form text itself is licensed, not public |
| 15 | Adoption is broad across P&C groups. More than 60 P&C groups have filed to adopt or to delay adopting AI exclusions across D&O, E&O and general liability — 41 groups with at least one subsidiary filing to adopt, a further 20 filing to delay — from a review of nearly 10,000 filings via S&P Capital IQ. Groups named include AIG, Allianz, Arch Capital, Axis, Berkshire Hathaway, Chubb, Liberty Mutual, Munich Re, Swiss Re, The Hartford, Tokio Marine and Zurich. Verisk's VP of Liability, Joe Lam: "Everyone acknowledges that this is new technology that is going to create or introduce new exposures that were never contemplated before" | The Insurer, 23 Jul 2026; Carrier Management, 23 Jul 2026 | corroborated (trade press, method stated; not read in the underlying filings) |
What the same sources say against the thesis¶
Recorded because they bound the claim, not as decoration.
- The market is not broadly retrenching. Aon, in the same article as finding 3: "AI is reshaping risk at speed, but the insurance market is not responding with broad exclusions or sharp retrenchment. Instead, 2026 is defined by clarification, targeted adjustments and a deeper focus on how AI modifies exposure within established lines. Capacity remains available, but underwriting scrutiny is rising." An exclusion wave read as an assurance-demand signal is the weaker reading; rising scrutiny inside available capacity is the stronger one.
- An exclusion is a substitute for assurance, not a demand for it. Where a carrier can simply decline the exposure, evidence has no price. Evidence only becomes valuable where the insurer wants to write the risk — which is why findings 3–5 matter more to this thesis than findings 14–15. [assessment]
- The Lloyd's market is asking for less regulation, not more. Finding 7 is a published request that regulators enforce existing law rather than introduce new rules. Whatever is happening here, it is not the market calling for a new mandated obligation. [assessment]
- Underwriters currently believe insureds are managing AI well (finding 2). Any account premised on the market feeling unsafe would contradict what the market has published about itself. What the LMA does say is that this confidence rests on no collected evidence — a different and narrower point. [assessment]
What did not hold up¶
- No carrier or broker was found to require an audit trail or pre-execution evidence as a condition of coverage or pricing. Scope of the search: published product pages of Munich Re (aiSure), Armilla and Mosaic; Lloyd's Market Association AI publications and its model-wordings material; Aon and WTW public AI publications; Swiss Re Institute and SVV publications; FINMA supervisory communications; and insurance trade press to 2026-08-06. Not searched, and where a requirement would most plausibly live: actual policy wordings, broker submission packets, and carrier application questionnaires — none of which are public. The absence is a search result, not a finding of fact.
- Circulating quantified claims about AI-governance premium credits do not survive checking. Specific figures (e.g. "premium reductions of 20% to 50%", "80% of companies using AI-powered defences receive premium credits", "AI Security Riders requiring proof of red-teaming") appear only on marketing and search-optimised sites with no traceable source. Do not cite them. A second-hand claim that firms without documented AI governance "face coverage denials at renewal", attributed to Willis research, could not be traced to a WTW publication and is treated as unverified.
- Zurich Insurance's position could not be established. Zurich appears in the S&P-derived list of groups filing to adopt or delay AI exclusions (finding 15); a separate trade report, not retrievable at source, was summarised as having it state no such plans for standard liability products. Neither reading is confirmed here, so no position is attributed — see open questions.
Two limits on reading anything into this¶
- FINMA 08/2024 is not an AI assurance scheme. It is supervisory expectation for financial-market institutions, and it records that Switzerland has no AI-specific legislation ("Bislang existiert in der Schweiz keine KI-spezifische Gesetzgebung"). What findings 11–12 support is narrower and still useful: a Swiss supervisor has looked at AI traceability and independent review and published what it found lacking.
- No relationship exists with any party named in this note. Every finding is drawn from public material. None of it implies contact, interest, or endorsement in either direction.
Open questions¶
- Does any carrier or broker in fact require an audit trail, decision record, or pre-execution evidence to bind or price cover? The public record cannot answer this; a single conversation with an underwriter or broker could.
- Have liability underwriters priced the Art. 10(2)(a) disclosure presumption ahead of the 9 December 2026 transposition, and does any wording or questionnaire yet reference evidence disclosability?
- Which Swiss transposition path applies? Switzerland is outside the directive, so the exposure route for Swiss suppliers is products placed on the EU market — the scope of that indirect effect was not researched here.
- Does the LMA's model-wordings work define "AI" or "AI system" in market wordings, and does any wording condition cover on demonstrable governance? The survey page references a related LMA Chief Underwriting Officer commission that was not retrieved in full.
- What is Zurich Insurance's actual published position on generative-AI exclusions?
- Is the Armilla/Munich Re relationship on the MKIII case a value chain — independent assessor → warranty → reinsurance capacity — or two separate arrangements? Both pages describe the same model; neither describes the other's role.
- Both affirmative-cover products rest on the insurer's or coverholder's own assessment of the model it then carries risk on. Whether any separation between assessor and risk-carrier exists elsewhere in this market could not be established from public sources.
Provenance: researched and written 2026-08-06 from primary sources except where graded otherwise. Findings 1–4 and 7–13 were read directly at the issuing source; four quotes initially obtained via page summarisation were re-read at source before inclusion, and two were corrected in the process (the Armilla carrier panels differ by product, and the LMA survey's finding on insureds' risk management is the opposite of the summary first obtained). Findings 14–15 rest on trade and association reporting because the underlying ISO form text and state filings are not public; they are graded accordingly. No figure in this note comes from a third-party chart or social-media post.