In March 2024, Air Canada lost a court case over a chatbot that promised a grieving passenger a bereavement fare that didn't actually exist. The airline argued the bot was essentially a separate entity and therefore the airline couldn't be held responsible for what it said. The tribunal didn't buy it. Air Canada was ordered to pay. It was a small claims case, barely a blip financially, but the precedent it set was anything but small. When your AI makes a promise, you own that promise.
That case is a preview of what's coming at far greater scale. We're now in a world where AI systems are denying insurance claims, flagging loan applicants, routing emergency vehicles, and controlling physical machinery. The question of who's legally responsible when those systems cause harm is no longer theoretical. Lawyers are already building cases. Boardrooms are already nervous. And the insurance industry is scrambling to figure out how to price something it's never had to price before.
The Attribution Problem Is Real and It's Ugly
Traditional liability law runs on a simple concept: trace the harm back to a decision, trace the decision back to a person or entity, assign responsibility. That chain works reasonably well for human decisions and even for basic software bugs. It breaks down fast with modern AI.
A large language model trained on billions of parameters, fine-tuned by one company, deployed via API by a second company, integrated into a product by a third company, and used by a consumer who customized it with their own prompts, produces an output that causes financial harm. Who's liable? The original model developer? The deployer? The integrator? The user who wrote the prompt?
Legal scholars have started calling this the "many hands problem," and it's not just academic. In 2023, a lawyer named Steven Schwartz filed court briefs citing cases that ChatGPT had fabricated entirely. He argued he was deceived by the tool. The judge wasn't impressed and sanctioned him anyway. But the case raised a real question that courts will face repeatedly: when a professional uses an AI tool in good faith and it produces a confident, authoritative lie, where does responsibility fall?
For consumer-facing products, the answer is increasingly leaning toward the deployer. But enterprise contracts are full of indemnification clauses that push liability back to the customer. OpenAI's terms of service, for example, place responsibility for verifying outputs squarely on the user. Microsoft's Azure AI terms do similar things. This creates a gap between legal expectation and commercial reality that regulators are starting to notice.
The Insurance Gap Is Already Costing Companies Money
The cyber insurance market has been dealing with AI-adjacent claims for a few years now, mostly through data breach coverage and social engineering fraud policies. But pure AI liability, meaning harm caused by an autonomous decision rather than a hack or a human error, is a different beast. Most standard commercial general liability policies explicitly exclude "automated systems" acting outside human direction. Technology errors and omissions coverage, the policy type that typically covers software companies, wasn't designed with self-improving models in mind either.
Munich Re, one of the world's largest reinsurers, published analysis in late 2023 estimating that AI-related insurance losses could reach $30 billion annually by 2030. They also noted that the industry currently lacks the actuarial data to price those risks accurately. That's a significant admission. It means insurers are essentially guessing right now, which is a problem both for companies trying to buy coverage and for the insurers taking on exposure they can't fully model.
Some carriers are starting to build dedicated AI liability products. Convex, a specialty insurer, launched an AI liability line in 2023. Lloyds of London syndicates have been quietly writing bespoke policies for AI companies since at least 2022. But these products tend to be expensive, narrowly scoped, and available mainly to larger enterprises. A startup deploying an AI hiring tool or a medical diagnostic assistant often can't get meaningful coverage at a price that makes business sense.
What Gets Covered, What Doesn't
The emerging AI insurance products generally cluster around a few coverage areas: reputational harm from AI-generated outputs, regulatory defense costs when an algorithm gets investigated for bias or discrimination, third-party bodily injury when a physical autonomous system causes harm, and data privacy violations stemming from unexpected model behavior. What's mostly absent from current policies is coverage for economic harm caused by AI decisions that are technically within the system's design parameters but produce bad outcomes. An algorithmic trading system that legally executes a sequence of trades and destroys market value. An AI credit scoring model that systematically under-approves qualified applicants from certain ZIP codes. These harms are real, they're happening now, and they largely fall through existing coverage structures.
Regulators Are Moving, But Not at the Same Speed Everywhere
The European Union's AI Act, which began phasing in during 2024, takes a risk-tiered approach. High-risk AI applications in areas like medical devices, critical infrastructure, and law enforcement face mandatory conformity assessments, human oversight requirements, and detailed documentation obligations. Providers of these systems are required to maintain technical documentation sufficient to reconstruct decisions after the fact, which directly affects insurance claims investigations. That's actually useful. An auditable decision trail makes attribution possible.
The United States is moving more cautiously. Executive Order 14110, signed by President Biden in October 2023, directed federal agencies to develop sector-specific AI guidance, but there's no overarching federal AI liability statute yet. What exists instead is a patchwork: FTC enforcement on deceptive AI practices, CFPB guidance on algorithmic credit decisions, EEOC focus on AI hiring tools, and state-level initiatives like Colorado's AI law targeting insurance algorithms and California's ongoing legislative efforts. Companies operating nationally face a compliance matrix that's genuinely difficult to navigate.
China has moved faster on specific applications, particularly generative AI regulation, requiring providers to submit security assessments before public deployment. That creates an interesting dynamic where Chinese AI companies operating domestically face more upfront scrutiny, while U.S. companies often face liability exposure only after harm occurs.
Autonomous Vehicles Are the Stress Test Nobody Wanted
No sector has pushed AI liability questions harder than autonomous vehicles. When a Waymo robotaxi collides with a cyclist, or when a Tesla operating on Autopilot rear-ends a parked fire truck, the question of fault becomes genuinely complex. Was it a sensor failure? A software decision? A training data gap? Did the human driver have enough warning and enough time to intervene? Did the manufacturer's marketing about the system's capabilities create a reasonable expectation of performance that the system couldn't meet?
NHTSA data shows that Tesla vehicles account for the large majority of reported serious crashes involving driver assistance systems, which partly reflects Tesla's market share and partly reflects its approach to pushing capabilities to consumers faster than competitors. But the insurance implications are significant. Several major carriers have raised premiums on Tesla vehicles with Autopilot or Full Self-Driving enabled, citing higher repair costs and crash frequency data. State Farm, Allstate, and others have made public moves to price in AV-related risk.
What hasn't been resolved is product liability in AV crashes. Existing case law on software defects is thin. And the question of whether an AI system that performed as designed but produced a harmful outcome constitutes a "defect" under product liability law is one that courts will be settling for the next decade.
What This Means If You're Running a Company That Uses AI
If your business deploys AI in any customer-facing or decision-making capacity, your existing insurance probably has gaps you haven't mapped yet. The immediate practical steps matter: review your technology E&O policy exclusions specifically for language around automated decision-making, ask your broker about AI-specific endorsements, and document your human oversight procedures because they may determine coverage eligibility after an incident.
Beyond insurance, the contract language you're using with AI vendors deserves a close read. Indemnification terms, liability caps, and limitations on consequential damages in your API agreements could significantly affect your legal position if a vendor's model causes downstream harm to your customers.
Companies in regulated industries, healthcare, financial services, employment, housing, face heightened exposure because regulators in those spaces are actively looking for algorithmic harm cases to pursue. Having audit logs, bias testing records, and human review documentation isn't just good practice; in some jurisdictions it's already required, and in others it will be your strongest defense when something goes wrong.
The Bigger Picture
What's happening in AI liability right now is a version of what happened in cyber liability in the early 2010s. Coverage barely existed, companies didn't know what their exposure was, a few high-profile incidents shifted the conversation fast, and the insurance market eventually caught up with products that, while imperfect, gave companies something to work with.
The difference with AI is that the harm vectors are more varied, the attribution is harder, and the systems are changing faster than any insurance product can be designed to cover. A policy written for GPT-4 class systems may be largely irrelevant two model generations later.
The companies, insurers, and regulators that figure out workable frameworks first will have a real advantage. But right now, most of them are still asking the same question Air Canada's lawyers tried to dodge: when the machine makes a mistake, who's actually responsible? The answer, increasingly, is whoever deployed it. And the cost of figuring that out in court, rather than in advance, is going to be substantial.
