Primary module
AI-D&O
AI Directors and Officers Liability
- Who brings the claim
- Shareholders, regulators and others who allege the board mishandled AI
- Typical allegations
- AI-washing, failed oversight of AI systems and misleading statements about AI
Coverage
AI Liability Coverage for Management and Professional Lines
Mayflower Specialty writes AI liability coverage in four modules: AI Directors and Officers Liability (AI-D&O), AI Employment Practices Liability (AI-EPL), AI Professional Liability (AI-E&O) and AI DIC Excess. Coverage is available as a modular primary policy or as a difference-in-conditions layer over the program a company already carries, on a claims made and reported form and A- (Excellent) AM Best rated paper.
The four modules
- AI-D&O: AI-washing, failed oversight of AI systems and misleading statements about AI
- AI-EPL: Discrimination by screening and ranking tools, and dismissals based on AI scores
- AI-E&O: Hallucinated or inaccurate output, model errors and drift, and mistakes by AI agents
- AI DIC Excess: AI claims that fall outside the current D&O, EPL or E&O wording
- Paper
- A- (Excellent) AM Best rated
- Capacity
- Backed by global reinsurers
- Policy form
- Claims made and reported
- Investors
- Clocktower Ventures, Antler
Approach
The Principles Behind the Coverage
Mayflower's coverage starts from the position that a company should know whether its insurance answers an AI claim before the claim arrives, and the four principles below follow from it. Each one is something a buyer can check against the policy and the application.
Definition
Silent AI is the uncertainty that arises when an insurance policy neither covers nor excludes losses caused by artificial intelligence. Whether such a policy responds to an AI claim is left to argument after the loss, which is why insurers are now adding explicit AI exclusions or affirmative AI coverage.
Definition
Affirmative AI coverage is insurance wording that names claims arising from artificial intelligence and addresses them expressly, so that the answer to an AI claim is set out in the policy rather than argued over after a loss.
Affirmative by Design
Many D&O, EPL and E&O policies were written before generative AI and say nothing about it, which leaves AI claims to be argued over after a loss, and some insurers now exclude AI at renewal. Mayflower's modules name AI exposure and address it deliberately, subject to the policy terms.
Underwritten on Your Governance
Underwriting is based on how a company actually runs AI: how decisions are made, monitored, documented and escalated. The application asks about the controls a company already has, so the governance work it has done is what the underwriter reviews.
Three Lines, Written for How AI Fails
The modules follow the three lines where AI claims land: D&O for the board's duty to oversee the AI systems it relies on and to describe them accurately, EPL for automated hiring and workforce tools, which are already drawing collective actions, and E&O for AI-enabled products and services that cause a client a loss. AI DIC Excess carries the same approach over a program a company already has.
Rated Paper and Specialist Claims Handling
Coverage is written on A- (Excellent) AM Best rated paper backed by some of the world's largest reinsurers, it is placed through the buyer's broker, and claims are handled by a specialist claims administrator. The result is a conventional insurance policy that a board and its advisers can review like any other policy in the program.
Modules
The Four Modules
Each module is written for the claims AI creates in one part of a company's liability. The first three are primary modules; AI DIC Excess sits over the program a company already carries.
Primary module
AI-EPL
AI Employment Practices Liability
- Who brings the claim
- Applicants, employees and civil rights agencies
- Typical allegations
- Discrimination by screening and ranking tools, and dismissals based on AI scores
Primary module
AI-E&O
AI Professional Liability
- Who brings the claim
- Clients, customers and other third parties
- Typical allegations
- Hallucinated or inaccurate output, model errors and drift, and mistakes by AI agents
Layer
AI DIC Excess
- Who brings the claim
- Any of the above, when the existing policy excludes AI or is silent on it
- Typical allegations
- AI claims that fall outside the current D&O, EPL or E&O wording
The Four Modules Compared
The table sets out who faces each kind of AI claim, what each module is built for and how it sits next to the D&O, EPL and E&O cover a company already has.
| Module | Who faces the claim | AI claims it is built for | How it sits next to existing D&O, EPL and E&O |
|---|---|---|---|
| AI-D&O, AI Directors and Officers Liability | Directors and officers, and often the company itself | Securities and derivative claims alleging AI-washing or failed oversight, and other claims over the company's use, oversight or disclosure of AI | A primary module alongside the existing D&O program, or AI DIC Excess over the D&O tower |
| AI-EPL, AI Employment Practices Liability | The company as an employer, and sometimes individual managers | Discrimination and other employment claims arising from AI used in hiring, promotion, discipline and other workforce decisions | A primary module alongside the existing EPL policy, or AI DIC Excess over it |
| AI-E&O, AI Professional Liability | The company that delivered the AI-enabled product or service | Claims by clients and third parties over inaccurate or hallucinated output, model errors and mistakes by AI agents | A primary module alongside existing technology or professional E&O, or AI DIC Excess over it |
| AI DIC Excess | The same parties as the underlying D&O, EPL or E&O claim | AI claims that the underlying D&O, EPL and E&O policies are silent on or exclude | Sits over the existing D&O, EPL and E&O policies and keeps them in place |
Who is insured, and on what terms, is set out in each policy. All four modules are liability coverage, designed to sit beside a cyber policy rather than replace it.
A common question
Don't We Already Have Cyber for That?
Cyber insurance responds to security events, while AI liability coverage is written for the decisions and output of AI systems, so the trigger, the harm and the defense all differ. A company that uses AI in decisions, products or client work should expect to need both, because the two policies are designed to sit beside each other.
Cyber
A Security Event
Unauthorized access, a data breach or ransomware, where the company failed to protect its systems or data.
AI liability
An AI Decision or Output
A model's decision, recommendation or answer harms a person, a customer or a business, with no breach required.
Structure
A Primary Module or a DIC Layer
Mayflower's coverage can be bought in two ways, and the choice depends mainly on whether the gap is in one line or several and on whether the company wants to keep its current program as it is.
Option A
A Modular Primary Policy
Choose one or more of AI-D&O, AI-EPL and AI-E&O, each written for AI claims in its line and bought alongside the existing program. This suits a company whose AI exposure is concentrated in one or two lines, such as an employer using AI in hiring.
Apply for one or more modulesOption B
AI DIC Excess Over the Existing Tower
Keep the current D&O, EPL and E&O policies and add a difference-in-conditions layer written to respond where they are silent on AI or exclude it. This suits a company whose program is otherwise sound apart from its AI wording.
How AI DIC Excess worksWhy now
Three Forces Moving AI Exposure Onto Balance Sheets
AI exposure is reaching insurance programs through regulators, courts and insurers at the same time, and each of the three is documented below with a dated source. Together they make the next renewal the practical moment to check how a program treats AI.
Regulators
Regulators are applying existing law to AI and adding rules of their own. The SEC settled its first AI-washing cases in March 2024, and employers already face rules on AI hiring tools in New York City, Illinois and California, with Colorado's rules and the EU's high-risk obligations for employment following in 2027.
Sources SEC press release 2024-36, March 18th 2024 (opens in a new tab)NYC Department of Consumer and Worker Protection (opens in a new tab)Epstein Becker Green, September 1st 2026 (opens in a new tab)Colorado General Assembly, SB 26-189 (opens in a new tab)Regulation (EU) 2026/1744, Official Journal (opens in a new tab)
Litigation
Shareholders, applicants and clients are bringing claims over AI. Cornerstone Research counted 15 AI-related securities class actions in the first half of 2026, and in May 2025 a federal court conditionally certified a nationwide age discrimination collective over AI screening in Mobley v. Workday.
Sources Cornerstone Research, July 29th 2026 (opens in a new tab)Civil Rights Litigation Clearinghouse, Mobley v. Workday (opens in a new tab)
Insurers
Insurers are writing AI out of existing policies. Verisk's ISO generative AI exclusions for general liability took effect in January 2026, and W. R. Berkley has introduced an “absolute” AI exclusion for D&O, E&O and fiduciary liability.
Sources Big “I” Virtual University summary of the Verisk filing (opens in a new tab)Hunton Andrews Kurth, May 2025 (opens in a new tab)Insurance Journal, August 17th 2026 (opens in a new tab)
72%
S&P 500 companies that flagged AI as a material risk in 2025 annual reports, up from 12% in 2023
15
AI-related securities class actions filed in the first half of 2026, on pace to nearly double the 2025 total
2,100+
Court decisions worldwide involving AI-hallucinated content, as of October 2026
Coverage gaps
Where Existing Policies Leave AI Exposure
The matrix shows how typical existing policies tend to treat six AI claim scenarios, and which Mayflower module is written for each. A policy that usually responds today can stop responding once an AI exclusion is added at renewal.
- Usually responds
- Depends on wording
- Unlikely to respond
- Mayflower module written for it
| AI claim scenario | Typical D&O | Typical EPL | Typical E&O | CGL and cyber | Mayflower module |
|---|---|---|---|---|---|
| Shareholders sue the directors after the company overstated what its AI can do | Usually responds: A core D&O claim, unless an AI exclusion has been added | Unlikely to respond: Not an employment claim | Unlikely to respond: Not a claim about services to a client | Unlikely to respond: No injury, property damage or security event | Mayflower module written for it: AI-D&O, Subject to the policy terms |
| Applicants allege that an AI screening tool rejected them because of their age | Unlikely to respond: Employment claims usually sit with EPL | Depends on wording: A core EPL claim, but AI and vendor wording varies | Unlikely to respond: Not a claim by a client | Unlikely to respond: Discrimination sits outside CGL and cyber | Mayflower module written for it: AI-EPL, Subject to the policy terms |
| A client loses money after relying on an AI-drafted report that cited sources that do not exist | Unlikely to respond: Professional services exclusions usually apply | Unlikely to respond: Not an employment claim | Depends on wording: Responds if the AI work is a covered service and AI is not excluded | Unlikely to respond: A financial loss with no security event | Mayflower module written for it: AI-E&O, Subject to the policy terms |
| An AI agent acting for a client carries out the wrong transactions | Unlikely to respond: Not a management liability claim | Unlikely to respond: Not an employment claim | Depends on wording: Turns on the services definition and any AI wording | Depends on wording: Cyber may respond only if an attacker caused the error | Mayflower module written for it: AI-E&O, Subject to the policy terms |
| A regulator investigates the company's public statements about its AI and names the CEO | Depends on wording: Cover for investigations varies by wording | Unlikely to respond: Outside the scope of EPL | Unlikely to respond: Outside the scope of E&O | Unlikely to respond: Outside the scope of CGL and cyber | Mayflower module written for it: AI-D&O, Subject to the policy terms |
| Renewals add an absolute AI exclusion to the D&O, EPL and E&O policies, and an AI claim follows | Unlikely to respond: Removed by the exclusion | Unlikely to respond: Removed by the exclusion | Unlikely to respond: Removed by the exclusion | Unlikely to respond: Not built for management or professional claims | Mayflower module written for it: AI DIC Excess, Subject to the policy terms |
This is a general guide to typical wordings rather than a reading of any particular policy. Whether a policy responds depends on its exact wording, its endorsements and the facts of the claim.
Scenarios
Claim Scenarios by Industry
AI claims look different in every industry, but most land on the board, the employer or the professional, so each scenario below is paired with the module written for it.
These scenarios are hypothetical, and whether a policy responds depends on its wording and the facts.
| Industry | Hypothetical scenario | Module written for it |
|---|---|---|
| Financial services | An investment platform describes its portfolio engine as AI-driven, and shareholders sue when a report shows it runs mostly on fixed rules. | AI-D&O |
| Healthcare technology | Shareholders bring a derivative suit alleging the board never asked for reports on an AI triage feature that a regulator later questions. | AI-D&O |
| Retail | Applicants over 50 allege that a vendor's resume-screening tool screened them out by graduation date, and name the retailer in a collective action. | AI-EPL |
| Logistics | Warehouse workers dismissed on the basis of an AI productivity score allege that it penalized disability-related breaks. | AI-EPL |
| Professional services | A client sues a consulting firm after acting on an AI-drafted market study that cited sources that do not exist. | AI-E&O |
| Software | An AI contract-review feature misses automatic renewal clauses, and a customer claims for renewals it could no longer cancel. | AI-E&O |
| Payments | An AI agent authorized to issue refunds pays out duplicates across a merchant client's accounts, and the client sues for the loss. | AI-E&O |
| Any industry | A D&O renewal adds an absolute AI exclusion, and a securities claim over the company's AI disclosures follows. | AI DIC Excess |
Policy form
The Policy Form: Claims Made and Reported
Every Mayflower module is written on a claims made and reported form. The terms below explain what that means in practice; the policy itself sets out the exact conditions.
From the application notice
“The policy applied for covers only those Claims first made against an Insured during the Policy Period or any applicable Extended Reporting Period. Defense costs reduce and may exhaust the Limit of Liability and are subject to the Retention.”
Source Mayflower AI Liability Supplemental Application (2026)
What Claims Made and Reported Means
A claims made and reported policy covers a claim only if it is first made against the insured during the policy period, or any extended reporting period, and is reported within the period the policy requires. A claim reported late can fall outside cover even if the events behind it happened while the policy was in force.
Defense Costs and the Limit
Defense costs reduce and may exhaust the limit of liability and are subject to the retention. That matters for AI claims in particular, because class actions and regulatory investigations can be expensive to defend whatever their outcome, so it is a good idea to set the limit with defense costs in mind.
Retroactive Date and Prior Acts
The application asks for a proposed retroactive date, which sets how far back the acts behind a claim can have taken place. A company moving cover from another program should raise its existing retroactive date with its broker early, so that AI systems already in production are not left in a gap.
Underwriting
What the Application Asks, Section by Section
Mayflower underwrites on the applicant's AI governance, so the supplemental application walks through the areas below and the underwriter reviews the controls a company has already built, such as an oversight body, an AI system inventory, bias testing and an incident plan. It is a good idea to gather the documents in Section X before starting, because they answer many of the questions in the earlier sections.
Section I
Applicant information
Who the company is, where it operates and which modules it is applying for.
Section II
AI systems overview
How many AI systems are in production, how deeply they are integrated and how material their decisions are.
Section III
AI governance
Frameworks, oversight bodies, board reporting, human oversight and named accountabilities.
Section IV
Data governance
Data lineage and quality, bias and fairness testing, privacy and training data provenance.
Section V
System operations and monitoring
System criticality, fallbacks, drift monitoring, release practices and override logging.
Section VI
AI incident response
Incident plans, detection, tabletop exercises, complaints, appeals and root-cause analysis.
Section VII
Regulatory environment and compliance
The AI rules that apply, external audits, ISO/IEC 42001 status and regulatory history.
Section VIII
Claims and loss history
AI and management liability claims, known circumstances and prior declinations.
Section IX
Prior and current insurance
The existing D&O, EPL and E&O program, the proposed retroactive date and expiration dates.
Section X
Required documentation
ACORD applications, loss runs, financials, the AI governance policy and an AI system inventory.
Section XI
Applicant representation and warranty
Signed by the Chairman, CEO, CFO, President or General Counsel.
Who it is for
Who the Coverage Is For
Mayflower writes coverage for businesses and their brokers, and the supplemental application is explicit about where its appetite ends. A company that falls outside it is better served by knowing early, so both lists are set out here.
- Companies whose use of AI could lead to claims against their directors and officers, against them as employers or against their products and services
- Companies whose D&O, EPL or E&O policies have added an AI exclusion or are silent on AI, which is the case AI DIC Excess is written for
- Brokers placing AI liability coverage for clients like these
Where Mayflower Is Not the Answer
- First-party security losses such as breach response, ransomware or business interruption, which belong with cyber insurance
- Individuals and consumers, since the application is written for businesses
The supplemental application lists uses of AI that are outside Mayflower's underwriting appetite:
- Autonomous weapons or military targeting
- Social scoring or mass surveillance
- Biometric identification in public spaces
- Real-time emotion inference in workplace or educational settings
- Deepfake generation without disclosure
Predictive policing and criminal sentencing applications are considered only on bespoke terms.
How to buy
How to Buy the Coverage
Mayflower places coverage through brokers, and a company or its broker can start the application online. The steps are the same whichever modules a company chooses.
Bring In Your Broker
The usual route is through the broker who handles the company's D&O, EPL and E&O program, because the AI modules sit alongside or over that program.
Apply Online
The online application mirrors the supplemental application, saves progress and can be completed by the company or its broker. Completing it does not bind coverage.
Send the Documents
Underwriting asks for five documents with the application, listed below. They can be attached in the online application or emailed to the underwriting team.
Hear From Underwriting
Mayflower's underwriting team responds within 48 hours, and information submitted with the application is held in confidence.
Documents underwriting asks for
- Completed ACORD application(s) for the applicable coverage lines
- Three years of loss runs for D&O, EPL and E&O
- Most recent annual financial statements or audited financials
- AI governance policy or responsible AI framework
- AI system inventory (systems, use cases and data types)
FAQ
Questions About the Coverage
What does AI liability insurance cover?
AI liability insurance is written to pay for defending and resolving claims that arise from a company's use of AI, subject to the policy terms. Mayflower's modules are written for claims against directors and officers (AI-D&O), employment claims over AI hiring and workforce tools (AI-EPL), client claims over AI-enabled products and services (AI-E&O), and AI gaps in an existing program (AI DIC Excess).
Can I buy one module on its own?
The supplemental application lets a company apply for one or more of the four modules, so a company can start with the module that matches its main exposure, such as AI-EPL for an employer that uses AI in hiring. Underwriting reviews the company's AI governance whichever modules are chosen, and the broker can advise on combining them.
How does AI DIC Excess differ from a primary module?
A primary module is a policy written for AI claims in one line, such as AI-D&O. AI DIC Excess sits over the D&O, EPL and E&O policies a company already has and is written to respond where they are silent on AI or exclude it, which keeps the existing program and its insurers in place.
What does claims made and reported mean?
A claims made and reported policy covers a claim only if it is first made against the insured during the policy period, or any extended reporting period, and is reported within the period the policy requires. A claim reported late can fall outside cover even if the events behind it happened while the policy was in force.
Do defense costs reduce the limit?
Defense costs do reduce the limit on Mayflower's policies: the application states that they reduce and may exhaust the limit of liability and are subject to the retention. Because AI class actions and investigations can be costly to defend, it is a good idea to set the limit with defense costs in mind.
Which uses of AI are outside Mayflower's appetite?
According to the supplemental application, applications involving autonomous weapons or military targeting, social scoring or mass surveillance, biometric identification in public spaces, real-time emotion inference in workplace or educational settings and deepfake generation without disclosure are outside Mayflower's underwriting appetite. Predictive policing and criminal sentencing applications are considered only on bespoke terms.
Further reading
Guides for Buyers and Brokers
- Fundamentals guideWhy Companies Using AI Need AI Liability InsuranceAI liability insurance is written to pay for defending and resolving claims that arise from a company's use of AI, such as a customer harmed by wrong output, an applicant screened out by a biased tool or an investor misled about the company's AI. Companies need it because their D&O, EPL, E&O and cyber policies were written before these exposures existed, and insurers have begun adding AI exclusions to them.Read the guide
- Coverage guideSilent AI and the New AI Exclusions in D&O, E&O, EPL and CGL PoliciesSilent AI is the uncertainty that arises when an insurance policy neither covers nor excludes losses caused by artificial intelligence. Insurers are now resolving it with AI exclusions, including ISO general liability endorsements effective January 2026 and at least one far broader exclusion in D&O and E&O forms, so each renewal should be read for new AI wording and affirmative cover bought where it is removed.Read the guide
- Buying guideHow Underwriters Assess AI Risk, and How to Prepare an AI Liability ApplicationUnderwriters price AI liability on three things: how much harm the company's AI could do to people and their finances, how well the company governs and monitors it, and its claims history. Preparing an inventory of AI systems, a written governance policy and evidence of testing before applying gives the underwriter what it needs and can improve terms.Read the guide
Coverage
Find Out Where Your Program Leaves AI Exposure
Apply online for one module or several, or talk to the team about how the coverage would sit with the program you already carry.
Placed through brokers on A- (Excellent) AM Best rated paper. Completing the application does not bind coverage.