What Policyholders Need to Know

• Deepfakes and misinformation dominate reported generative-AI incidents, accounting for 84% of the cases analyzed by RAND.
• Insurers are splitting three ways — some exclude AI losses, some sell specific coverage, while most policies remain silent.
• The bigger insurance threat may be accumulation risk, where one AI flaw, attack or shared provider could trigger losses across thousands of companies at once.

By Samuel López | USA Herald

CALIFORNIA - Artificial intelligence is spreading through American businesses faster than the insurance industry has decided who pays when something goes wrong.

That is the central problem identified in a new RAND Corporation study examining hundreds of AI incidents, lawsuits, state laws and insurance filings. The findings suggest AI is becoming an unusual insurance problem because it does not behave like one traditional peril.

Think of fire insurance. A building burns, investigators determine what happened, damages are calculated and the applicable coverage can usually be identified.

AI can be very different.

One defective or manipulated system might produce a defamatory statement, expose private information, infringe copyrighted material, authorize the wrong payment and create a cybersecurity breach — potentially touching several insurance policies from the same event.

RAND examined 713 publicly reported generative-AI incidents. Of those, 599 — 84% — involved misinformation or deepfakes. Hallucinations and factual errors appeared in 215 incidents, harmful-content problems in 92, and agentic or autonomous failures in 84. Because incidents can fall into multiple categories, those percentages overlap rather than adding neatly to 100%. RAND Corporation

That distinction matters, because the available data does not show that AI hacking alone is driving most of the reported harm. Instead, misleading information and synthetic media dominate the incident record, while security vulnerabilities, prompt injection, compromised models, AI-enabled fraud and autonomous-system failures create another growing layer of risk. RAND specifically identifies inadequate safeguards and malicious attempts to gain control of AI systems among the mechanisms capable of producing losses. RAND Corporation

The courtroom picture looks different.

RAND reviewed 249 U.S. generative-AI lawsuits and found 150 — roughly 60% — centered on intellectual-property or AI-training disputes. Privacy and surveillance, fraud, product liability, discrimination and other claims made up smaller portions of the litigation examined. RAND Corporation

Insurance companies, meanwhile, have yet to settle on a common approach.

Verisk/ISO developed generative-AI exclusion language in January 2026 addressing bodily injury, property damage and personal and advertising injury. RAND notes that ISO standardized forms appear in more than 80% of U.S. property-and-casualty policies, although the report also cautions that it does not know how many carriers have actually adopted the new AI exclusions.

Berkley has gone further in certain specialty policies, according to RAND, excluding claims connected broadly to AI use, deployment or development — including AI-generated communications, deficient AI policies and training, AI-enabled products, regulatory violations and even company representations about its AI capabilities.

Other insurers see opportunity instead of something to wall off.

RAND reports that Munich Re provides coverage addressing issues including model underperformance, hallucinations, bias, privacy violations and intellectual-property losses. AXA XL expanded certain coverage involving data poisoning and copyright-related claims, while Coalition has addressed AI-system failures and AI-enabled fraudulent transfers, including deepfakes. Specialized providers including Testudo, Armilla and AIUC have developed AI-specific products; AIUC offers limits of up to $50 million and expressly addresses some losses caused by AI agents.

But the most important category may be the policies that say nothing.

RAND found that most carriers remain silent on AI. Silence is not necessarily an exclusion. If an AI-related loss otherwise satisfies an existing policy's insuring agreement and no exclusion applies, a policyholder may argue that coverage exists.

But silence is not a guarantee either.

It is similar to discovering after an accident that your insurance policy was written before anyone had contemplated the machine that caused it. The policy still exists, but lawyers may end up arguing over whether old definitions were ever intended to cover the new event.

RAND warns that coverage can turn on the exact policy wording, theory of liability, characterization of the loss and interaction between exclusions and definitions written before today's AI risks emerged.

Then comes the risk that should concern insurers most — accumulation.

Imagine thousands of businesses using the same outside accountant. One accountant makes one mistake, and thousands of companies receive the wrong financial statements simultaneously.

AI creates a technological version of that problem.

RAND identifies five ways losses could spread across insurers; a common vulnerability exploited across AI systems; dependence on shared models or infrastructure; AI increasing the scale of cyberattacks; a court ruling or regulatory action suddenly creating liability across many companies; and slow, difficult-to-detect degradation in model performance. RAND Corporation

That creates an insurance paradox.

Cover more AI risk and businesses have greater protection — but insurers accumulate more potentially correlated exposure. Exclude more AI risk and insurer exposure falls, but the economic burden moves back to businesses and consumers. Leave the policy silent and neither side may know the answer until a major claim lands.

RAND recommends an industrywide AI Coverage Notice so businesses can clearly see what is covered, excluded or left unresolved, along with standardized incident reporting and insurer stress-testing for large, correlated AI losses.

For businesses already using AI, the practical lesson is simple: having cyber, E&O, D&O or general liability insurance does not automatically answer the AI question.

The policy language does.

Read RAND's full report The Insurability of Artificial Intelligence

About the Author

Samuel López is a reporter and news correspondent for USA Herald who has reported for the publication since 2022. López is also a seasoned legal professional with more than two decades of experience analyzing state and federal litigation, complex liability issues and insurance-related matters. That legal and insurance background informs his reporting on emerging AI liability, policy exclusions, corporate risk and the developing disputes over who ultimately pays when new technology causes real-world harm.

Keep Reading Beyond the Headlines

If this report gave you information you were not finding in the usual coverage, get USA Herald's reporting delivered directly to you. Subscribe to the USA Herald newsletter for investigative reporting, legal and insurance analysis, emerging technology coverage and national-security stories that go beyond the daily news cycle.

👉 Follow USA Herald on X: @RealUSAHerald