Our product started giving customers automated recommendations last year, and it took a support ticket about a bad one before I actually read our tech E&O policy instead of just paying the renewal. What I found wasn't reassuring: the policy was written in 2023, before "AI feature" meant anything more than a chatbot widget, and it never once used the word "model."
Tech E&O was built for a different kind of mistake
Traditional tech errors and omissions coverage responds to a specific pattern: your software did something deterministic, it broke, and a customer lost money because of it. A missed integration, a dropped webhook, a calculation bug. The underwriting language assumes a human wrote the logic and a bug is the failure mode.
An AI feature breaks differently. The model doesn't have a bug in the traditional sense, it makes a plausible-sounding recommendation that turns out to be wrong, or it acts on stale data, or an agent takes an action a human reviewer would have caught. None of that is a "defect" in the way a claims adjuster is trained to recognize one, and that gap is exactly where founders get surprised.
The test: can you point to the clause, not just the policy?
Don't ask your broker "does this cover AI." Everyone says yes to that question because the honest answer requires reading the actual exclusions, not the marketing page. Instead, pull your policy and check for these three things directly:
- Does the definition of "professional services" or "technology services" explicitly include automated decisioning, model output, or algorithmic recommendations, or does it only describe software performing "as designed"? If a model's output is the product of probability rather than fixed logic, some carriers argue it falls outside "as designed" entirely.
- Is there an exclusion for claims arising from "training data," "data used to develop or train an algorithm," or similar language? Several tech E&O forms added this exclusion in the last two years specifically because AI claims started showing up, and it's easy to miss because it reads like boilerplate.
- Does the policy distinguish between your software recommending an action and your software (or an agent built on it) taking an action autonomously? Autonomous execution is a meaningfully different risk profile, and a policy silent on it hasn't priced for it, which usually means a claims fight rather than automatic coverage.
If you can't find language addressing at least two of these, you don't actually know what happens when an AI-related claim comes in. You're inferring coverage from a policy that predates the risk.
Where the gap actually shows up
The clearest failure mode isn't a dramatic AI disaster, it's something mundane: a customer's finance team relies on your tool's output for a decision, the output is wrong because of an edge case in the model, and they come back claiming financial loss. If your policy's professional services definition is written around "software performing as designed," a carrier's counsel can plausibly argue a probabilistic model doing exactly what it was trained to do (being wrong sometimes) was never a defect, and now you're negotiating a coverage dispute at the same time you're negotiating with the customer.
The second common gap is scope creep nobody flagged at renewal. A feature that shipped as a simple summarization tool eighteen months ago is now making pricing or eligibility recommendations, and nobody went back to tell the broker the risk profile changed. Insurers price based on what you told them your product does, not what it's grown into.
What to do this week
Don't wait for the renewal cycle. Send your current policy's professional services definition and exclusions section to your broker and ask them, in writing, whether a claim arising from an incorrect model output or autonomous agent action would be covered under the current wording, not a hypothetical AI endorsement they could sell you. Brokers can usually answer this directly if you make them look at the actual clause instead of the product name.
If the answer is unclear or no, ask specifically about a "technology errors and omissions" endorsement or rider that names AI/algorithmic output, which several carriers now offer as an add-on rather than a full rewrite. It's usually cheaper than a new policy and faster to bind before your next enterprise security review asks the question for you.
Frequently asked questions
Does a standard tech E&O policy exclude AI by default?
Not usually by name, but many older forms implicitly exclude it through language requiring software to perform "as designed," which some carriers interpret narrowly against probabilistic model output. Newer forms are starting to address AI explicitly, which is itself a signal that older ones don't.
Will cyber insurance cover an AI mistake instead?
No. Cyber insurance responds to breaches and unauthorized access to systems or data. A model giving a wrong recommendation isn't a security incident, so a cyber policy typically won't respond to that claim at all.
Do I need a separate AI liability policy?
Not necessarily yet. Most founders can close the gap with an endorsement to their existing tech E&O policy rather than buying a standalone product, unless your core offering is an autonomous agent making high-stakes decisions (financial, medical, legal) without human review.
How do I know if my product's risk profile has changed enough to matter?
If a feature now makes a recommendation or decision a human used to make, or an agent now takes an action without a person approving it first, tell your broker. That's the threshold where "as designed" language starts to matter.
Is this worth raising before my next fundraise or enterprise deal?
Yes. Increasingly, enterprise security reviews and diligence questionnaires ask directly whether AI-related liability is covered, and "I assume so" is not an answer that clears procurement.