The Agentic Liability Gap: Why Your Insurance Policy Is Now Obsolete

I have spent the last year watching a quiet but consequential shift in the commercial insurance market: carriers are rewriting policy language to explicitly exclude losses caused by autonomous AI agents. If you run a startup that deploys agentic systems—software that plans, executes, and adapts without a human approving every step—you need to understand that the safety net you think you have is being pulled out from under you, clause by clause.

This is not a hypothetical risk. It is a structural one, and it demands a structural response.

How We Got Here

Traditional technology errors and omissions (E&O) and general liability policies were drafted for a world where software behaved deterministically and humans made the decisions that mattered. An engineer wrote code, a human reviewed outputs, and liability flowed through a relatively linear chain of causation. Insurers priced that risk based on decades of actuarial data about human error, system downtime, and discrete software defects.

Agentic AI breaks that model. An agent that autonomously negotiates a contract, executes a trade, provisions infrastructure, or interacts with a customer is making probabilistic decisions in real time, often chaining multiple tool calls and third-party API interactions together without a human in the loop. When something goes wrong, the causal chain is murky, the decision was not explicitly coded by any engineer, and the loss may have cascaded across systems in ways no underwriter anticipated.

Insurers do not like ambiguity. Where they cannot model risk, they exclude it. That is exactly what is happening now.

The Exclusions Are Already Here

Several major carriers have begun introducing or signaling AI-specific exclusionary language in technology E&O, cyber, and professional liability policies. The mechanisms vary, but the pattern is consistent: losses arising from autonomous decision-making systems, or from AI outputs not subject to meaningful human review, are being carved out of standard coverage. Some policies now require insureds to affirmatively disclose the use of autonomous agents, failing which claims can be denied for misrepresentation on the application.

For founders, this creates what I call the agentic liability gap: the widening space between the risks your company is actually taking on and the risks your policy actually covers. You may be paying premiums for protection that no longer applies to your core product.

Why This Matters More for Startups

Larger enterprises have risk committees, dedicated general counsel, and the balance sheets to absorb uninsured losses. Startups rarely have any of these. A single agentic failure—an agent that over-executes a trade, leaks sensitive data through an unanticipated tool call, or makes a representation to a customer that triggers a regulatory violation—can be existential for a company with twelve months of runway.

Compounding this, institutional investors, enterprise customers, and acquirers are increasingly asking diligence questions about AI governance before they sign checks or contracts. A founder who cannot answer basic questions about how agent decisions are logged, reviewed, and constrained is signaling immaturity in exactly the area that now carries the most tail risk.

From Insurance Reliance to Governance Infrastructure

The strategic response is not to find a carrier willing to underwrite agentic risk at any price—though that market will eventually mature. The immediate response is to build governance infrastructure that reduces the probability and severity of agentic failures in the first place, and that creates a defensible, auditable record when failures occur.

I advise founders to treat this as a core product and legal workstream, not a compliance afterthought. Several practices should be considered baseline, not aspirational:

• Decision logging at the action level. Every consequential action an agent takes—every API call, every transaction, every external communication—should be logged with the inputs, the model version, and the reasoning trace available to the system at that moment.
• Explicit authority boundaries. Agents should operate within hard-coded permission scopes. If an agent can access a capability, that capability should be enumerated, justified, and reviewed on a cadence, not assumed from the architecture.
• Human checkpoints calibrated to severity. Not every action needs human sign-off, but high-severity or irreversible actions should require it. The threshold for what counts as high-severity should be a documented, versioned policy, not a judgment call made in the moment.
• Incident response protocols specific to agent behavior. Your existing security incident response plan was not built for an agent that makes thousands of micro-decisions per hour. You need a separate playbook for detecting, halting, and remediating agentic drift.
• Vendor and model accountability mapping. If you are building on top of third-party foundation models or orchestration frameworks, you need contractual clarity on where their liability ends and yours begins.

Audit-Readiness as a Competitive Advantage

I want to be direct about why this matters beyond risk mitigation: audit-ready governance is becoming a commercial differentiator. Enterprise buyers, particularly in regulated industries, are starting to require evidence of agentic governance as a condition of procurement. Founders who can produce clean logs, documented authority boundaries, and a coherent incident response history will close deals that founders who cannot will lose. This is the same dynamic we saw with SOC 2 a decade ago—what began as a defensive compliance exercise became a sales enabler.

The insurance market's retreat from agentic risk is not a temporary pricing anomaly. It is a rational response to genuine uncertainty, and it will not reverse until actuarial data catches up with deployment, which could take years. In the interim, the founders who treat governance as infrastructure rather than paperwork will be the ones who survive the first wave of agentic failures with their companies, their capital, and their credibility intact.

The question is no longer whether your insurance covers agentic failure. It is whether your governance can prove you did everything reasonable to prevent it.

That proof is now the real policy you need to underwrite.