The Insurance That Does Not Yet Cover the Agent You Just Deployed

44% of finance teams will use agentic AI in 2026, an increase of over 600% from 2025, and 57% of banking executives expect AI agents to be fully embedded in risk, compliance and audit functions within three years. The number climbs faster than the governance frameworks that are supposed to contain it. What no executive survey is asking is who pays when the agent makes a $2 million error and the policy the compliance team negotiated eight months ago explicitly excludes autonomous AI from coverage.

A 2026 study by Gallagher Re, published in association with MIT and Testudo Global, finds that the pace of AI adoption has outstripped the insurance industry's capacity to develop responsive products, leaving organizations exposed to a growing class of uninsured liabilities. The gap is structural. The commercial insurance market is not merely lagging behind AI risk, it is actively beginning to retreat from it, with insurers increasingly limiting or excluding coverage for AI-related losses.

You are the person who has to sign the vendor contract, defend the decision to deploy, and explain to the board why the indemnity cap sits at 12 months of fees when the model risk assessment flagged concentration exposure across three business units. This is not a risk-management thought experiment. It is the contract in front of you, the coverage you do not have, and the liability that will sit on your balance sheet the day the agent goes into production.

What the standard policies actually say

Commercial general liability policies typically exclude technology-related professional services and increasingly contain AI-specific exclusions. Verisk's Insurance Services Office (ISO) introduced optional commercial general liability endorsements addressing generative AI, forms CG 40 47 and CG 40 48 with January 2026 edition dates, which exclude or significantly restrict AI-related bodily injury, property damage, or personal and advertising injury.

Technology Errors and Omissions insurance covers claims that your product or service failed to perform as promised. For AI products, model errors and faulty outputs are the core coverage scenario: your AI system produces an incorrect prediction or recommendation that a client relies on, they suffer a financial loss, and Tech E&O covers your legal defense and resulting damages. But pure AI performance failure without a security or media predicate may sit outside core coverage, and an AI-caused professional error may not be covered, particularly where an autonomous agent acted without required human review.

Standard AI vendor agreements include indemnification for third-party IP claims, but most agreements cap total liability, including indemnification, at 12 months of fees; for an enterprise paying $100,000 annually, that means a $100,000 ceiling regardless of actual damages that could reach into the hundreds of millions. When a vendor's contractual indemnification obligations lack adequate insurance backing, the question becomes what is that indemnity actually worth.

The specific gap agentic AI opened

Agentic AI is shifting FinTech from generating predictions to executing coordinated financial workflows, with major institutions including JPMorgan Chase, Visa, and Mastercard already deploying multi-agent systems; because each workflow concludes with a consequential action that the institution must later substantiate, delegating such authority introduces a new kind of risk.

Agentic AI raises an even more complicated question because an agent does not stop after producing an answer, it can do something with the answer. Research into insurance frameworks for agentic AI increasingly identifies factors such as agent permissions, autonomous execution, tool access, prompt injection, model behavior, third-party dependencies, governance, and human oversight as relevant underwriting considerations.

The failure mode is different. A credit-scoring model that drifts produces inaccurate risk assessments, and you can measure the error against outcomes. An agentic workflow that triages an AML alert, escalates it to the wrong team, triggers a premature account freeze, and causes a corporate client to miss payroll has executed five steps before anyone reviews the chain. The liability is not the prediction; it is the action, and the contracts most banks signed in the last 18 months were written for predictive AI.

What exists today, and what it costs

Armilla offers affirmative coverage for companies developing and deploying generative AI and AI agents, underwritten by Lloyd's, with limits up to $25 million. Coverage includes AI model error liability for financial loss suffered by third parties arising from AI model underperformance such as errors, inaccurate outputs, and hallucinations, as well as AI model output liability for legal claims including breach of confidentiality, trade secrets, defamation, libel, and slander.

Munich Re's aiSure, powered by Mosaic, uses defined performance thresholds with quick, measurable payouts, with threshold-based or warranty-backed triggers linked to measurable underperformance, drift, calibration, or prediction error. These products exist. They are narrow, expensive, and capacity-constrained. Market capacity and claims precedent remain limited.

Business leaders express both enthusiasm and anxiety about AI, with 60% admitting they intentionally slowed implementation due to concerns over potential errors and malfunctions, and 87% identifying AI-related vulnerabilities as the fastest-growing cyber risk in 2025, reflecting a growing trust gap between C-suites and consumers, and between procurement teams and vendors.

At-Bay has been active in the technology sector and their Tech E&O appetite extends to AI-driven companies, with underwriters asking more specific questions about AI use cases at application, particularly for healthcare and financial services applications, and pricing accordingly; companies with documented bias testing and model monitoring practices tend to fare better. The pricing signal is clear. If you have governance in place, you can get coverage. If you do not, you cannot, or the premium is prohibitive.

The decision in front of the buyer

99% of companies plan to put agents into production but only 11% have done so due to implementation challenges related to data, governance and security, with 48% of organizations citing governance concerns and 30% flagging privacy issues. The statistic is usually read as an execution problem. It is also an insurance problem. The 11% that deployed did so knowing they were carrying uninsured or underinsured tail risk.

Many banks are under pressure to scale and move beyond pilots, but 2026 will demand robust, enterprise-level strategies, governance, and a disciplined approach to return on investment; agentic AI offers breakthrough potential, but only if supported by AI-ready data. Deloitte's 2026 Banking & Capital Markets Outlook notes AI implementation across banks remains throttled by brittle and fragmented data foundations, mounting compliance demands, outdated legacy systems, and internal resistance to change, with many AI initiatives stuck in isolated proofs of concept marked by weak governance, duplication, and uneven impact; the industry is not short on ambition, it is short on execution.

The buyer's calculus is this. The vendor contract caps liability at $120,000. The bank's Tech E&O policy has a sub-limit of $5 million for AI-related claims, a $250,000 deductible, and an endorsement that excludes fully autonomous actions unless a human reviewed the output within 60 seconds. The agent you are deploying will process 1,200 AML alerts per day, escalate 18%, and execute account restrictions in 4% of cases without human touch until the weekly review cycle. The model risk assessment tiered it as high materiality. Legal wrote a memo noting the indemnity is capped and the insurance is conditional. The business case assumes 22% cost reduction in the compliance function by Q3 2027.

You can add a $10 million standalone AI liability policy at $340,000 annual premium with a coverage trigger tied to documented governance failures, or you can accept the gap and rely on the vendor's balance sheet. The vendor is venture-backed, pre-profitable, and has $47 million in disclosed funding. If a claim exceeds the cap, the recovery is a lawsuit against a startup whose assets may not cover the judgement.

SR 26-2, issued on 17 April 2026, keeps machine-learning models in scope and leaves generative and agentic AI outside, with a footnote stating non-generative, non-agentic AI models are in scope while generative and agentic AI are outside it and governed through the bank's broader risk management and governance practices. The regulatory guidance is clear. Agentic AI is not a model under SR 26-2. It is technology risk, vendor risk, operational resilience, and AI governance, all at once. Banks need to treat AI model risk management in 2026 as a routing problem before treating it as a validation problem, deciding which AI systems fall inside traditional model risk management, which require a broader AI governance process, and which trigger separate legal duties.

The contract you sign today defines the liability you carry tomorrow. The insurance you do not buy is the gap the board will ask about when the agent makes its first expensive mistake. There is no AI-specific rule, and nothing new can realistically bind before 2029; your existing rules are the AI rules. The question is whether you are comfortable operating under rules written before agentic workflows existed, with insurance products that exclude what those workflows actually do.

Tarry Singh is the founder and CEO of Real AI (realai.eu), an enterprise AI advisory and deployment firm working with global enterprises on production agent systems, model risk, and AI sovereignty strategy. He also leads Earthscan (earthscan.io) for Energy AI, and is a founding contributor to the EU-funded HCAIM and PANORAIMA programmes for responsible AI education across European universities. He writes at tarrysingh.com.