Skip to main content
Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button
AI Exclusions Won't Void Your Whole PolicyPolicy Exclusions
5 min readFor Cyber Insurance Buyers & Brokers

AI Exclusions Won't Void Your Whole Policy

Contractors are worried that generative AI exclusions might invalidate their entire commercial insurance program. This fear is understandable given how quickly these exclusions have spread, 2,369 are already in force across 49 states and the District of Columbia. However, the myths about these exclusions are creating more risk than the clauses themselves.

These myths persist because the rollout happened fast, the policy language is technical, and most contractors don't have dedicated risk managers to interpret ISO forms. When Insurance Services Office published six standard AI exclusion forms in July 2025, carriers started filing them within a month. By February, monthly supporting filings peaked at 413. That speed left little time for brokers to educate clients, allowing misconceptions to take root.

Here's what these exclusions actually say, and what they don't.

Myth 1: The exclusion voids your entire policy if you use AI anywhere

Reality: The exclusion applies to claims arising from generative AI use, not to your entire coverage program.

The broadest ISO form, CG 40 47, removes coverage for bodily injury, property damage, and advertising injury claims that arise out of generative AI. This is a claim-specific trigger, not a policy-wide invalidation. If you use AI to generate a cost estimate on one project and an unrelated claim arises from a job where you used no AI, that second claim remains covered under your Commercial General Liability policy.

The confusion comes from the phrase "arising out of." Under CG 40 47, a claim only needs a connection to generative AI, the AI use doesn't have to be the sole cause. So if you used AI for one estimate on a project and a later claim emerges from that work, the exclusion could apply even though AI touched only a fraction of the job. It's a broad interpretation, but it's not the same as losing all coverage the moment you open ChatGPT.

Myth 2: Standalone AI coverage will appear soon

Reality: No admitted standalone product currently exists to replace the excluded AI exposure for contractors.

When ISO addressed cyber risk in standard CGL policies, the market responded with Stand-Alone Cyber Policies. Businesses could buy back the coverage they lost. The AI exclusion rollout is following the same structural pattern, but the follow-on product hasn't materialized.

The Trades Coverage report that identified the 4,078 state-level exclusion records found zero admitted standalone products for contractors that cover generative AI liability. You can't transfer this risk through an insurance purchase right now, at least not in the admitted market. Non-admitted markets may offer something, but coverage will be inconsistent and expensive.

This isn't a temporary delay. Silent cyber took years to resolve, and that was for a risk category the industry already understood. Generative AI liability is newer, less predictable, and harder to model. Expecting a robust AI liability market to emerge in the next six months is unrealistic.

Myth 3: Only high-tech contractors need to worry about this

Reality: The exclusion appears across the standard commercial lines that every contractor carries, and AI use is spreading fast.

Of the 4,078 exclusion records identified, 3,955 involve coverage lines contractors and small businesses commonly carry: Commercial General Liability, umbrella and excess, commercial package, businessowners, and errors and omissions. This isn't confined to tech E&O or cyber policies. It's in the core coverage your clients renew every year.

AI use isn't limited to software-forward firms anymore. ServiceTitan's 2026 Commercial Specialty Contractor Industry Report found that 38% of contractors now report measurable business impact from AI, up from 17% in 2025. The most common applications were cost estimating (24%) and bid management (22%), tasks that every contractor performs. If your client is using AI to speed up takeoffs or generate project proposals, they're in scope.

Myth 4: You'll know if the exclusion is on your client's policy because the carrier will flag it

Reality: Policies renewed since August 2025 may carry one of the ISO forms or a carrier-drafted equivalent, and most contractors won't notice unless you check.

Large construction companies have risk managers who monitor state insurance filings. At smaller contractors, that job falls to the broker, and right now, most brokers aren't checking. Every state except Minnesota has at least one exclusion record, so geography isn't a filter. If your client renewed a CGL, umbrella, or businessowners policy in the past year, assume the exclusion is present until you confirm otherwise.

The Trades Coverage data covers admitted-market SERFF filings and Florida I-File records, meaning exclusion activity across non-admitted markets is likely even wider. Don't wait for the carrier to highlight the change in a renewal summary. Pull the policy forms and look for CG 40 47, CG 40 48 (advertising injury only), or CG 35 08 (completed operations). Carrier-drafted equivalents may use different form numbers but will include similar "arising out of generative AI" language.

Myth 5: If there's no coverage, contractors should just stop using AI

Reality: Abandoning AI isn't a viable risk management strategy when 38% of contractors are already seeing business impact from it.

Telling a contractor to stop using AI for cost estimating because their insurance won't cover AI-related claims is like telling them to stop using email because of phishing risk. The operational advantage is too significant, and competitors who use AI will underprice and outbid those who don't.

The better approach is to treat AI use as an uninsured exposure that requires operational controls. Validate AI-generated estimates against manual checks, document the human review process, limit AI use to non-critical design decisions, and maintain records that show where AI was and wasn't used on each project. If a claim arises, you'll need to demonstrate whether AI contributed to the loss, and that requires documentation you create before the claim happens.

What to do instead

Pull your clients' current policies and identify which ISO forms are attached. If CG 40 47 is present, you're dealing with the broadest exclusion. Map out where your client is using generative AI, estimating, design, bid management, project scheduling, and document those applications. Then build a process for validating AI outputs with human review and create a record of that validation.

For new business, ask underwriting whether the exclusion can be removed for clients who don't use AI, or whether a narrower form like CG 40 48 can replace the broad version. Some carriers may negotiate, especially for clients with low AI adoption. For clients who rely heavily on AI, start exploring non-admitted markets now, even if coverage is limited. Waiting for an admitted product to appear is not a strategy.

Most importantly, stop assuming someone else is handling this. If your client is a small or mid-sized contractor, you're the one who needs to explain what "arising out of generative AI" actually means, and what it doesn't.

Promotional banner for the Penetration Report Template Kit

You Might Also Like