AI Agent Insurance 2026: 51 Requirements, $25M Limits

A support agent refunded an order inside its authority, then the customer disputed the reason. The tech E&O policy was silent on AI, and the adjuster had no professional error to point at.

💡 What You Will Learn

A support agent refunded an order inside its authority, then the customer disputed the reason. The tech E&O policy was silent on AI, and the adjuster had no professional error to point at.

📜 Table of Contents

• 1. Each legacy policy is missing one piece
• 2. The four routes you can actually buy
• 3. What the 51 requirements check
• 4. Running the incident history on a real agent
• 5. Three numbers before you buy
• 6. Four documents you can assemble in 30 days

A support agent refunded an order inside its authority. The order belonged to the customer, the amount sat under the cap, every tool call was logged. Three days later the customer said the reason was invalid and asked for compensation. The tech E&O policy came out, and its wording neither affirms nor excludes AI. The adjuster tried to fit it under "error in professional services," but the agent is not a professional and never was.

What follows is organised around what an underwriter actually asks for: where the three traditional policies fall short, what each of the four available routes requires, what the 51 requirements in AIUC-1 are checking, and a real incident-history export pulled from a production agent's logs.

1. Each legacy policy is missing one piece

Run five real loss scenarios through the policies most companies already carry, and none of them were designed for the case where the agent made its own decision and got it wrong.

Cyber only recognises someone breaking in, and an agent doing what it was permitted to do badly is not a break-in. Tech E&O is triggered by a professional's error, and with no professional in the loop, that is exactly where the claim argument lands.

2. The four routes you can actually buy

The easiest route is the last one and the easiest to buy wrongly. Armilla hands prospects three questions to send a broker verbatim: does the policy affirmatively cover AI-related claims; does the tech E&O contractual liability exclusion leave your customer indemnities uninsured; and who decides that AI caused a loss. The third matters most. If the wording is silent on causation, the carrier decides at claim time.

3. What the 51 requirements check

The standard was written by AIUC with more than a hundred Fortune 500 CISOs. Its 51 requirements break into 130 controls, 65 mandatory and 65 optional, across data and privacy, security, safety, reliability, accountability and society. The technical evaluation runs over five thousand adversarial simulations. Schellman became the first accredited auditor, ElevenLabs the first certified company, with its backed policy placed in February 2026.

For a single self-built agent, reliability and security are the two pillars that move the price: how hallucinations are measured, how tool calls are restricted, how far injection defence goes. Both share one property the other pillars lack, which is that logs can prove them.

4. Running the incident history on a real agent

The third document underwriters ask for is incident history, and "we have monitoring" is not an answer. They want a raw log someone else can recompute. Method: seven rotated log files, 188,799 lines, spanning 2026-10-18 to 2026-11-05, aggregated by error type and retry attempt:

re.search(r'API call failed \(attempt (\d)/(\d)\).*?error_type=(\w+)', line)

The last two rows matter. Spread over 14 days, 683 events read like steady noise at 49 a day. In reality 28 October carried 240, 3 November 146, and 23 October 113, so three days held seventy-three percent of the total. An average error rate makes an underwriter underprice the tail, and the claims land in the tail.

Three attempts at a 2.94-second median means a single call can hang for about 18 seconds before it is declared dead. If the front end times out at 10 seconds, users see more failures than the log records.

5. Three numbers before you buy

Write down the probability p of a payable claim within a year, the severity L of one event, and the annual premium P. Expected loss is p times L. If P sits well above it, raising the retention or narrowing the agent's authority is cheaper. If P sits close to it, what you are buying is defence costs and regulatory investigation cover, and tech E&O usually will not respond there.

6. Four documents you can assemble in 30 days

System description and authority boundary, one page: which tools the agent can call, the per-transaction cap, which actions need human confirmation.

Governance record: who can change prompts, who can change permissions, whether changes leave a trace.

Incident history export: the table format above, with raw logs so it can be recomputed.

Remediation record: how often the same failure class recurred, what changed, how long it stayed closed.

Of the four, the second is easiest to fake and the first one an underwriter will probe. If the person who edits permissions also edits prompts, the accountability column is empty.

None of this is insurance advice, and the wording of the policy governs. If you do go to market, send the broker the two tables above instead of describing the deployment on a call.

Related: the one attack class that still moved money in 60 runs, 398-byte credentials that tell you which agent did it, what agent observability actually instruments, evaluation metrics and incident rates.