Insurers Are Becoming the Real AI Regulators, and Their Questionnaires Will Arrive Before the Law Does

The most consequential AI rule most American companies will face in the next two years is not a statute. It is an endorsement on an insurance policy. In January 2026, Verisk's ISO forms made standard generative AI exclusions available for commercial general liability policies. By mid-2026, according to a review of state filings published by law firm Reed Smith and Haven Safety AI and reported by Insurance Business on September 16, 2026, 2,369 generative AI exclusion records were in force in insurers' state policy filings across 49 states. W. R. Berkley, Chubb, Travelers, Berkshire Hathaway and AIG had all filed to adopt the ISO forms or their own equivalents by April 2026.

Meanwhile, federal AI legislation is stalled, the most ambitious state law was rewritten before it took effect, and Canada's federal AI bill died with the prorogation of Parliament in January 2025. Regulation is arriving slowly and unevenly. Underwriting is arriving every twelve months, at renewal.

The thesis of this piece: for most US and Canadian companies, the insurance renewal, not a regulator, will set the first enforceable AI controls. The chief risk officer, general counsel and CISO should build the evidence underwriters will ask for now: an AI inventory, human oversight on consequential actions, testing records, an incident process and vendor indemnities. A gap in cover is a gap in the AI strategy, and it should be treated as one.

The Law Is Stalled; the Policy Wording Is Not

Start with the law, because its absence is what gives insurers the role.

In the United States, Congress has not passed a general AI statute, and the federal effort has focused on stopping state laws rather than writing a national one. The Senate voted 99 to 1 on July 1, 2025 to strip a ten-year moratorium on state AI laws from the budget reconciliation bill. President Trump's Executive Order 14365 of December 11, 2025 directed the Attorney General to set up a task force to challenge state AI laws in court. A House discussion draft published in June 2026, the Great American AI Act, would preempt state AI development laws for three years, but it has not been introduced as a bill.

The states are uneven. Colorado's AI Act, the broadest US law aimed at high-risk AI decisions, was delayed to June 30, 2026 and then repealed and replaced before it ever took effect. Its successor, SB 26-189, signed on May 14, 2026 and effective January 1, 2027, drops the original risk-management program and impact assessments in favor of notice, explanation and human-review rights for consequential automated decisions. California's SB 53, signed on September 29, 2025, applies to developers of frontier models, not to the companies that deploy them. Texas's Responsible AI Governance Act took effect on January 1, 2026 with a narrow set of prohibited uses. In Canada, the proposed Artificial Intelligence and Data Act died in January 2025, and Bill C-36, introduced in June 2026, carries rules on automated decisions inside a privacy bill rather than a standalone AI law.

Insurers do not wait for legislation. They price exposure as it appears, and AI exposure has been appearing in the claims data. A Gallagher Re study counted a 978 percent increase in AI-related lawsuits between 2021 and 2025, as reported by Insurance Journal on July 22, 2026. Cornerstone Research and the Stanford Securities Class Action Clearinghouse counted 15 AI-related securities class actions in 2024, 16 in 2025 and 15 in the first half of 2026 alone. Those first-half 2026 cases were 13 percent of core filings but accounted for 385 billion dollars, 73 percent, of the disclosure dollar loss index, the clearinghouse's measure of alleged investor losses.

The response has come in three forms.

Standard exclusions. Verisk's ISO unit filed three optional generative AI endorsements in July 2025, effective January 2026. CG 40 47 excludes bodily injury, property damage and personal and advertising injury arising from generative AI under a commercial general liability policy. CG 40 48 excludes only personal and advertising injury. CG 35 08 excludes bodily injury and property damage arising from generative AI under the products and completed operations coverage part. The forms define generative AI broadly: "a machine-based learning system or model that is trained on data with the ability to create content or responses, including but not limited to text, images, audio, video or code." The Insurer reported in July 2026, from a review of about 10,000 regulatory filings, that more than 60 property and casualty insurance groups had made AI exclusion filings: about 41 to adopt an exclusion and about 20 to delay adoption. It reported separately that Verisk was weighing further exclusions aimed at agentic AI.

Absolute exclusions in management lines. W. R. Berkley introduced an AI exclusion for directors and officers, errors and omissions and fiduciary liability policies that law firm Hunton described in May 2025 as the first so-called "absolute" AI exclusion in specialty liability coverage. As quoted by Hunton, it removes cover for any claim "based upon, arising out of, or attributable to" any "actual or alleged use, deployment, or development of Artificial Intelligence." The Financial Times reported in November 2025 that AIG, Great American and W. R. Berkley had sought regulatory approval for AI exclusions; AIG said it had "no plans to implement them at this time."

New questions. The exclusions get the headlines. The questions do the regulating. Aon's September 2026 guidance for professional-services firms on what professional indemnity and E&O underwriters care about distills their concern into one line: "Who checks the AI, and how rigorously?" Paul Figliozzi of broker Howden told Business Insurance in April 2026: "We're certainly seeing a lot more diligence from D&O insurers in underwriting meetings, looking to understand what risk management controls are being implemented within the AI governance framework."

A company that cannot answer those questions will pay more, accept an exclusion or lose the cover. That is enforcement, and it arrives on a fixed date every year.