New AI Exclusions Are Landing on General Liability, Not Cyber

If your business renews its general liability policy this year, there may be a new paragraph in it about artificial intelligence.

In July 2025, Verisk filed a set of new endorsements for the ISO commercial general liability program, with a proposed effective date of 1/1/2026. In Verisk's words, the filing "will provide insurers with additional underwriting flexibility via new, optional endorsements designed to address GenAI liability exposures." The same filing separately introduced mandatory cyber war endorsements. Nothing about the AI endorsements happens to your policy automatically. Whether you are affected depends on what your carrier chose to attach.

What caught our attention is which policy these sit on. This is general liability, the policy most businesses already carry. It is not a separate cyber security insurance policy.

What the Forms Do

Law firm Olshan Frome Wolosky, writing in the Legal Intelligencer in May 2026, identified three forms and what each one reaches. Per Olshan: CG 40 47 is the broadest, excluding both Coverage A, which is bodily injury and property damage, and Coverage B, which is personal and advertising injury. CG 40 48 is narrower and excludes only Coverage B. CG 35 08 applies only to products and completed operations.

Olshan also quotes how the forms define the technology: "a machine-based learning system or model that is trained on data with the ability to create content or responses, including but not limited to text, images, audio, video or code."

Hold that definition next to what your team actually does. This is about work your business produces with AI and sends out the door. Marketing copy a model drafted. A recommendation, a spec, a scope of work assembled with AI help that later causes harm to somebody. That is the territory of a general liability claim.

The exposure these forms are written around is work produced with AI, not a break-in. Read against the forms themselves, though, the language reaches injury arising out of generative AI, and how far that reaches is exactly what carriers have not settled. Ask your broker what the form on your policy says, not what the category is called.

General Liability Was Never Your Cyber Policy

If a business has been treating general liability as its cyber coverage, an AI endorsement is not what changed that. Broad-form data breach losses have generally sat outside the standard GL form since ISO introduced its electronic-data and access-or-disclosure exclusions, and Olshan's caution cuts both ways: do not assume your own policy responds, and do not assume it does not. That is a question for your broker with the actual forms in hand.

Across our own clients, smaller businesses generally do not carry cyber insurance at all, and general liability is the extent of the file. For those businesses, a new AI exclusion is not the largest gap.

Why Exclusions Get Written

Verisk's Joe Lam described what exclusions do for an underwriter: "Without exclusions to allow underwriters a level of stability to accept a risk, you run into a situation where they might just walk away from the risk. So exclusions are very essential in the marketplace."

What Carriers Have Actually Adopted

Alana McMullin, a partner at Lathrop GPM, told Insurance Journal in July 2026: "Insurers are still evaluating their options in real time, so we don't know yet what each insurer is going to do in regard to AI exclusions or how broad their exclusions are going to be, or necessarily what lines of coverage are going to contain these exclusions."

Olshan's read points the same direction. Not all carriers have adopted these forms, but policyholders "should be prepared to see these exclusions move more towards the industry standard." Olshan adds a caution that cuts the other way too: policyholders "should not assume that they do not have coverage under their existing policies for AI-related liabilities." An exclusion you have heard about is not an exclusion on your policy, and a policy without one may still respond.

If you sell professional services and your people use AI to produce the deliverable, Olshan notes that errors and omissions carriers are scrutinizing that work as well. That is a second policy to look at.

The Moment This Matters Is Renewal

Renewal is when the forms on your policy get set for another term, so that is the moment to ask. Bring these questions to whoever handles your insurance:

• Was anything added to this policy addressing generative AI, and if so, which form number?
• Does it apply to Coverage A, Coverage B, or products and completed operations?
• Is the premium different from last year, and did the coverage change along with it?
• Is there cyber coverage anywhere in this file, or is general liability all of it?
• If AI is used in the work this business delivers to customers, what does the errors and omissions policy say about it?

The last two are worth asking even if your carrier attached nothing at all.

What We Can Actually Help With

We do not sell insurance and we will not tell you what your policy covers. That answer belongs to your broker and your carrier. What we can do is the technical half: document where AI is already running inside your business, which systems produce work that leaves the building, and where your data actually lives. Those are the facts the coverage conversation depends on, and they are hard to answer from memory in a renewal meeting.

If that is a conversation worth having before your renewal, book a free strategy call.