AI liability insurance for agencies starts with a surprisingly concrete question: if an agent gives a client the wrong answer or takes the wrong action, which part of that loss does your actual policy cover?

I looked into current insurer materials, coverage guidance, and transparency rules because a certificate saying “professional liability” leaves that question open. The useful answer lives in the insured services, exclusions, endorsements, and client agreement.

My recommendation is to bring your broker and lawyer the same example workflow. Ask them to explain the insurance response and the contractual allocation against the same failure, rather than approving two documents independently.

This is a practical planning guide for agencies, not legal advice, an insurance recommendation for your individual business, or a coverage opinion. Sources were checked November 4, 2026; a licensed broker and qualified counsel should review your jurisdiction, contracts, and issued policy.

Start with the loss, then ask who might pay

Imagine a fictional agency building a support agent for an equipment rental company. The agent reads the client's cancellation policy and prepares replies, while refunds require a named employee's approval.

After an outdated document enters the knowledge base, the agent promises a refund the business never offered. An employee approves the reply without checking the source, and the customer relies on it.

There are several separate questions here. Did the agency configure the system carelessly, did the client supply inaccurate material, did the employee miss an agreed review step, and what remedy did the contract promise?

An approval click does not answer all those questions. It is evidence about one checkpoint, alongside the design, instructions, source documents, and responsibilities each party accepted.

I would draw the money path before debating blame: the customer's demand, the client's response, a possible claim against the agency, and a possible request to an upstream supplier. Each transfer needs its own factual and contractual basis.

The policy question is separate again: even if the agency faces a claim, is that claim within an insured activity, during the relevant period, for a covered kind of loss? A headline about AI insurance cannot settle it.

That distinction is supported by Munich Re's analysis of AI liability coverage, which separates the trigger, covered event, and exclusions. Its older discussion of the market should not be read as proof that a current policy lacks an AI exclusion.

For the operational side, my companion guide to human approval checkpoints for AI agents explains why a review step needs a clear purpose. Here, the additional job is making that checkpoint match the agreement and the insurance submission.

Map different failures to different coverage questions

I would give a broker the following worksheet, with a warning at the top: these are starting points for discussion, not determinations that any policy responds. Ask the broker to replace every candidate with a reference to your own wording.

On small screens, scroll the worksheet horizontally to read every column.

The overlap is deliberate. A disclosure through a model output might be a confidentiality problem without the intrusion someone imagines when they hear “cyberattack.”

Armilla's current coverage description explicitly distinguishes model errors, agent mistakes, and non-breach privacy leakage. That is the provider's description of its offering, not a finding that your existing cyber coverage is inadequate.

For each row, add who is insured, who suffered the loss, who is making the demand, and who must notify whom. Then ask whether defense costs, settlements, and your own remediation expenses are treated differently.

Keep a separate column for expenses you might absorb commercially. Rebuilding a workflow, refunding your fee, and defending a negligence allegation are different costs; do not assume a policy pays all three because the incident has one cause.

My guide to AI agent security risks covers practical controls around data access and tools. The worksheet adds the financial question: what remains on the agency's balance sheet when those controls fail?

Read AI liability insurance wording beyond the headline

“We have E&O” and “the policy mentions AI” are useful beginnings. I would still ask for the complete policy package and a comparison against the expiring version.

Read the description of professional services first. Explain whether you build agents, maintain client knowledge, select models, connect tools, operate the deployment, or merely advise the client.

Then look at defined terms and exclusions together. Ask how the wording treats generative outputs, autonomous actions, third-party software, contractual commitments, confidentiality, intellectual property, and services outside the declared scope.

The important current signal is specific: HSB says ISO introduced AI exclusions in commercial general liability policies, and HSB's AI liability product page describes coverage intended to address those gaps. That does not establish that your professional liability policy has the same exclusion.

I would also distinguish a filed or available endorsement from an endorsement actually attached to your policy. Ask for its form number, edition, effective date, and the coverage parts it changes.

Next, check restrictions that do not have AI in their names. A promise to deliver error-free results may raise a different question from an allegation that you failed to exercise reasonable care; your broker and counsel need to examine both.

Finally, ask about the timing rules: when a claim must be made or reported, any retroactive date, continuity when switching insurers, and how known circumstances are handled. Have the broker explain the applicable trigger instead of assuming every policy works the same way.

Request a written answer to a concrete scenario. An explanatory email is useful evidence of the discussion, but it does not amend the policy; ask whether an actual endorsement is needed to achieve the intended cover.

Three offerings to discuss, with different jobs

I found named AI coverage useful as a market map, not a ranking. These examples have different public descriptions, and I have not inspected a quote or bound a policy with any of them.

HSB: the general liability gap

HSB's March 18, 2026 announcement describes small-business AI liability coverage including bodily injury, property damage, and advertising injury. Its public examples include AI-generated marketing and content.

My question would be whether this addresses a gap in the business's general liability program. I would not treat those named categories as proof of cover for every financial loss from an agency's professional advice.

Armilla: named AI failure modes

Armilla presents standalone affirmative AI liability cover for organizations building or deploying AI. Its current public page includes third-party financial loss from inaccurate outputs and claims arising from agent actions, with underwriting and issued wording determining coverage.

I would ask how the insured systems, use cases, models, and performance conditions are described. Also ask how changing a model or extending an agent's authority affects the submission and any required notification.

Counterpart: professional liability wording

Counterpart's November 24, 2025 company release, syndicated from Business Wire describes expanded affirmative AI coverage and a technology E&O insuring agreement across its miscellaneous professional liability and allied health products.

I would ask a broker whether the particular agency profession and services are eligible, and request the current forms. A company announcement is evidence of the offering's stated scope, not a substitute for a policy or a personalized quotation.

I would not compare these by premium alone. Request comparable insured activities, territory, limits, deductibles or retentions, defense-cost treatment, exclusions, and excess-layer wording before comparing prices.

Send a broker a workflow brief they can actually use

A broker cannot assess “we build AI” with much precision. I would send a short, redacted operational description rather than a prompt dump or an export of private client conversations.

Start with the business activity: who buys the service, what it produces, where customers use it, and whether an agent can act without a human decision. Identify higher-consequence jobs explicitly instead of burying them in “automation.”

Then give the fictional failure from the opening section, followed by these questions:

1. Insured services: Does the description cover building, hosting, maintaining, and operating this client workflow?
2. AI scope: Which attached terms address generated advice, tool actions, and third-party model failures?
3. Loss and claimant: What changes when the client's customer claims against the client, and the client then claims against us?
4. Financial structure: What limits, sublimits, retentions, defense costs, and shared aggregates apply?
5. Contract alignment: Which proposed warranties, indemnities, or remedies create obligations beyond the intended insurance response?
6. Operations: What must we disclose when models, data sources, permissions, or use cases change?
7. Incident process: Who receives notice, when, and what consent is needed before appointing counsel, settling, or offering remediation?

Ask for a response that cites forms or identifies an unresolved issue. “Probably covered” is a reason to keep talking, not a completed procurement artifact.

Separate your own policy from the client's and the platform's. Ask whose legal entity is insured and what rights, if any, you have under another party's coverage; a supplier displaying an insurance badge does not answer that.

I would also record the assumptions behind the answer. If the broker reviewed a draft-only agent, an unattended refund workflow should trigger a fresh conversation rather than inheriting the old assessment.

Five contract discussions to have before launch

These are negotiation prompts for counsel, not ready-to-sign clauses or a claim that every agency agreement must contain identical language. Local law, bargaining power, service scope, and insurance wording change the result.

1. AI use and the promised service

Describe where AI assists, where it acts, and what a human must verify. Name the permitted use and prohibited use in terms a client can recognize.

For the rental agent, I would propose: it drafts policy-based replies; a designated client employee checks cancellation eligibility before a message promising a refund is released. Counsel should turn the proposal into an enforceable allocation.

Keep that commercial description consistent with what the interface tells users. The EU AI Act's Article 50 sets distinct transparency obligations for providers and deployers, including exceptions; it is not a universal requirement to put the same sentence in every agency contract.

2. Evidence, provenance, and retention

Agree which records each party can produce: approved knowledge versions, model identifiers where available, instruction changes, outputs, tool results, and human decisions. Specify access, redaction, retention, deletion, and incident preservation with privacy obligations in mind.

Do not promise records your suppliers cannot provide. A useful evidence schedule distinguishes what your platform exposes from what your agency must retain separately.

For California-facing work, have counsel check current provenance duties against your exact role and media. The governor's September 30, 2026 signing announcement includes amendments to the AI Transparency Act, including SB 1000 and AB 2713; relying only on an old SB 942 summary is a poor starting point.

3. Intellectual property and permitted inputs

Separate ownership of your reusable configuration, the client's source material, human-created deliverables, and generated output. Ask what rights each party actually has authority to grant.

The U.S. Copyright Office's January 2025 copyrightability report distinguishes human authorship from material generated by AI and concludes that prompts alone generally do not supply the necessary control. A contractual transfer cannot create a copyright that does not exist.

My practical question for counsel is what we can responsibly promise about use rights and exclusivity. Also ask who supplies licensed inputs and how an infringement allegation will be handled.

4. Liability, remedies, and insurance

Put proposed liability limits, indemnities, warranties, acceptance criteria, and service remedies next to the policy review. Ask which commitments are insurable, which are excluded, and which the agency would fund itself.

A client may reasonably want a remedy for a broken workflow. The task is to agree a remedy the agency understands and can deliver, with exceptions and enforceability reviewed by counsel.

Price the ongoing responsibility alongside the build. My guide to pricing AI services covers the operating-cost side; I would add the broker's quote and the agreed maintenance scope to that model.

5. Review rights and incident cooperation

Define what a client may inspect, who can request it, how confidential material is protected, and which costs are included. Specify cooperation during a complaint, preservation request, or supplier investigation.

Treat these as negotiated review rights. Do not infer a blanket customer audit right, a universal record-retention period, or an unlimited source-code entitlement from the phrase “EU AI Act” or “SB 942.”

The AI agent compliance checklist is a useful inventory of regulatory questions, but recheck current law for the particular deployment. The contract work here is turning the relevant obligations into named owners and obtainable evidence.

Make the reviewer responsible for a visible check

“A human reviewed it” is weak evidence if nobody can explain what the person saw. I would design the approval screen and operating procedure around the specific mistake the reviewer is meant to catch.

For the rental example, that means showing the proposed reply, the relevant policy passage, the policy version, and the requested refund amount together. The person should be able to reject, edit, or escalate rather than choose only “approve.”

Keep a record of the decision and subsequent action. If the draft changes after approval, the earlier approval should not be presented as approval of the changed instruction.

These are my proposed controls, aligned with the broader emphasis on defined oversight roles and documentation in the NIST AI Risk Management Framework core. NIST guidance is not a guarantee of insurance coverage or a finding that a particular control meets local law.

When using Pickaxe, I would start by narrowing the agent's available Actions and checking the exact behavior in the deployment. A read-only drafting workflow and a tool that issues refunds need different review procedures.

If the workflow needs a durable approval record, verify that your chosen implementation produces and retains it. Do not describe an instruction asking the model to seek permission as proof of a separate, enforced approval gate.

I would use a separate incident record for the evidence packet and confirm what can actually be exported. Platform features, client permissions, and an operational procedure must work together; buying a builder does not transfer the agency's responsibilities.

Rehearse the incident before a real complaint arrives

Here is a proposed tabletop exercise, not a report of a customer incident. Give one colleague the role of the rental client and another the agency's incident owner.

The client reports that a customer received an incorrect refund promise. Ask the team to locate the deployed configuration, the source document at that time, the generated reply, any approval record, and the actual downstream result.

Then rehearse containment. Can the owner pause the relevant action without destroying the evidence, identify other affected interactions, and provide a factual status message through the agreed channel?

Use the policy's notice and consent requirements to draft the next steps with the broker. Ask who decides about insurer notice, external counsel, client communications, and any proposed payment; do not improvise those commitments during the drill.

Have counsel identify any separate legal notification or preservation obligations. These depend on the incident and jurisdiction, so this exercise does not supply a universal deadline.

Finally, change one fact at a time: the client supplied the wrong policy, the agency loaded the wrong version, the reviewer approved a correct draft but the action differed, or the agent acted without approval. Record which documents and controls need clarification.

My guide to testing AI agents covers failure cases before deployment. The tabletop extends that work to the people and documents needed after a complaint, when an accurate timeline matters as much as reproducing the model output.

Build one launch packet with three owners

I would finish the process with a single packet shared through approved channels, with client information redacted where appropriate. Give the broker, counsel, and delivery owner the same version of the workflow description.

• Broker: the coverage assessment, relevant policy references, unresolved gaps, and notice instructions.
• Counsel: the signed scope, responsibility allocation, review and evidence schedule, and incident cooperation terms.
• Delivery owner: the deployed version, permission inventory, acceptance evidence, approval procedure, rollback plan, and maintenance owner.

My proposed release gate is simple: each owner can point to the same permitted job and the same boundary around consequential actions. Unresolved gaps should be stated explicitly, with an owner and a decision before expansion.

Repeat the review when the job changes meaningfully. A new model, a new client-data source, or permission to write into a business system can change the assumptions behind the original launch.

For a Pickaxe implementation, I would attach the selected agent configuration and deployment procedure to this packet without calling either an insurance certificate. The product can help you build the workflow; your broker and counsel handle the coverage and contractual decisions.

AI liability insurance questions agencies ask

Does every agency need a separate AI policy?

There is no single answer in the public product descriptions I reviewed. Ask your broker whether the existing program, an endorsement, or separate cover best addresses your actual activities and losses; compare the wording and remaining gaps.

Does a client's approval move all responsibility to the client?

I would never assume that from the click alone. Ask counsel to evaluate the agreement, what was approved, what the agency controlled, and the applicable law; preserve evidence of the actual review.

How much should AI liability insurance cost?

I have not supplied a market-average premium because these public descriptions do not establish a comparable quote for an agency. Request terms for the same services, territory, limits, retention, and defense treatment before comparing numbers.

What should I do first?

Write one realistic failure scenario for your most consequential client workflow. Ask your broker where the insurance response is documented and ask your lawyer whether the client agreement promises something different.

If you want to build a small, clearly bounded agent while doing that work, you can get started with Pickaxe. Keep the permitted task, the review step, and the owner of the result specific enough that everyone can explain them.