How Underwriters Assess AI Risk, and How to Prepare an AI Liability Application

Underwriters price AI liability on three things: how much harm a company's AI could do to people and their finances, how well the company governs and monitors that AI, and its claims history. Most of that evidence comes from the application, so applying with an inventory of AI systems, a written governance policy and evidence of testing gives the underwriter what it needs to quote and can improve the terms offered.

How Do Underwriters Assess AI Risk?

Underwriters assess AI risk by estimating how likely a company's AI is to cause a claim and how large that claim could be, using three kinds of evidence: exposure (what the AI does and to whom), controls (the governance, testing and monitoring around it) and history (past incidents, claims and regulatory inquiries).

Mayflower writes affirmative AI coverage (cover that names AI expressly) for directors and officers (AI-D&O), employment practices (AI-EPL) and professional liability (AI-E&O), plus an AI DIC Excess layer over an existing program, and it underwrites all four on the applicant's AI governance; the coverage overview explains each module.

Mayflower's application measures exposure along two lines. Integration depth runs from assistive systems that only recommend to fully autonomous systems that make binding decisions with no human review, while decision materiality measures what an error costs the person on the other end. The application takes the highest level of each across all of a company's systems, because one autonomous system making high-stakes decisions drives the exposure for the whole program.

Human oversight largely decides where a system sits on integration depth, because it determines how far an error can travel before anyone sees it.

Scale matters too: a chatbot answering product questions and a model screening every job applicant carry different levels of risk, so a company should count the decisions each system makes and the people they affect before the underwriter asks.

What Does an AI Liability Application Ask?

An AI liability application asks about nine areas: the applicant, its AI systems, AI governance, data governance, operations and monitoring, incident response, regulation and compliance, claims history and current insurance. The sections below follow Mayflower's AI Liability Supplemental Application and explain what each area tells an underwriter and why it matters to a claim.

Applicant Information

The applicant section establishes who is insured and how large the exposure could be: each entity, its industry, revenue, headcount and ownership, the limit requested and where the AI operates. Ownership matters most for AI-D&O, because public companies carry securities-claim exposure; investors filed 15 AI-related securities class actions in the first half of 2026, which Cornerstone Research said put such filings on pace to nearly double the 2025 total ^[1].

Geography matters because the EU AI Act reaches companies outside the EU whose AI output is used there ^[2]. It is best to list every subsidiary that deploys AI, since an entity left off the application may be left off the policy.

AI Systems

The AI systems section defines what is being insured: a schedule of every production system with its function, how it was built or sourced, its integration depth and its materiality, plus the company's role as user, provider or developer, its generative AI guardrails, its model vendors and any AI agents (systems that take actions on their own).

Customer-facing generative AI draws attention because a company can be held to what its AI tells customers; in Moffatt v. Air Canada, decided on February 14th 2024, a British Columbia tribunal held the airline liable for its website chatbot's wrong advice on bereavement fares ^[3]. Agents that can change data or make payments draw closer questions: in July 2025 an AI coding agent on Replit deleted a user's production database during a code freeze, and the data came back only through a manual rollback ^[4].

Mayflower's application incorporates this schedule into any policy issued, so it should be complete and should describe the transaction limits and approval gates on every agent.

AI Governance

Governance questions test whether anyone is accountable for AI risk: the framework adopted, the committee that oversees AI and when it last met, how often the board hears about AI risk and whether policies, development standards, model documentation, vendor management, change control and named owners exist.

Board oversight carries weight because most large public companies now disclose AI as a risk: 72% of S&P 500 companies reported AI-related risks in 2025, up from 12% in 2023 ^[5]. A company that has disclosed AI as a risk but cannot show minuted board oversight of it is more exposed to the shareholder derivative and securities claims that AI-D&O is written for.

Public statements count too: on March 18th 2024 the SEC settled charges against two investment advisers over false and misleading statements about their use of AI, with $400,000 in combined penalties ^[6]. The committee charter, the minutes and the company's public statements about AI should all tell the same story.

Data Governance

Data governance questions cover lineage (where data comes from), quality, bias testing, sensitive data such as health, biometric, children's and employee records, privacy compliance, retention and training-data licensing. Each maps to a type of claim: training data used without a license invites intellectual property suits, and untested hiring models invite discrimination claims. Biometric data collected in Illinois can draw liquidated damages under the Biometric Information Privacy Act (BIPA) of $1,000 for each negligent violation and $5,000 for each intentional or reckless one, or actual damages if greater ^[7].

In Mobley v. Workday, a federal court in California let disparate-impact claims, which allege that a neutral practice disproportionately harms a protected group, proceed against the vendor of AI screening tools in July 2024. In May 2025 the court preliminarily certified a nationwide collective action for applicants aged 40 and over on the age claim, and the case was still being litigated as of this writing ^[8]. Any system that shapes decisions about people therefore needs scheduled, documented bias testing.

Operations and Monitoring

Operations questions ask how critical the AI is and how the company would notice it failing: criticality tiers, dependence on a single model provider, tested fallbacks, drift monitoring with alerts to a named owner, staged rollouts and logged human overrides. Models drift as the data they see changes, so monitoring is what keeps an accurate system accurate, and logs are the evidence a defense team needs.

IBM's 2025 Cost of a Data Breach report found that 13% of organizations reported breaches of AI models or applications and that 97% of those reported having no AI access controls in place ^[9]. That is why an application is stronger when it shows who can change a model, who is alerted when it misbehaves and how long its logs are kept.

Incident Response

Incident questions test whether the company can find, contain and learn from an AI failure: a tested AI-specific response plan, detection methods, reporting channels, human review for people affected by AI decisions and root-cause tracking. A generic IT incident plan does not satisfy Mayflower's application, because AI fails in its own ways, through hallucination (confident but false output), biased outcomes, prompt injection (hidden instructions that override a system's rules) or poisoned training data.

The application also asks for internal AI incidents and near-misses over the past 24 months and treats a material understatement as a misrepresentation, so an honest count with a note of what was fixed serves the applicant better than a clean record it cannot defend.

Regulation and Compliance

The regulation section maps the rules that apply: EU AI Act classification, US state AI laws, sector rules, external audits, ISO/IEC 42001 status and any AI-related regulatory inquiry in the past 3 years. Rules on AI in employment show how specific these obligations already are: since January 1st 2026, Illinois has made it a violation for employers to use AI that has a discriminatory effect in employment decisions, or to fail to give notice that they use AI in those decisions ^[10].

New York City has enforced a rule since July 5th 2023 that an automated employment decision tool must have had a bias audit within 1 year before it is used ^[11]. The EU AI Act's high-risk obligations, which cover areas including employment, now apply from December 2nd 2027 after a 2026 amendment postponed them ^[12]. An applicant that has mapped each system to the rules that govern it presents a smaller and more predictable risk, so the mapping is worth finishing before the application is filled in.

Claims History and Current Insurance

The claims section covers 3 years of AI-related claims, regulatory actions and complaints, any D&O, EPL or E&O claim, known circumstances that could produce a claim, and any coverage that has been declined, canceled or non-renewed. It also asks for the current or expiring D&O, EPL and E&O program, including the proposed retroactive date, before which acts that later lead to a claim are not covered.

These answers carry extra weight on a claims made and reported form, which covers a claim only if it is first made during the policy period and reported within the time the policy requires. A new policy of this kind generally does not respond to circumstances the company knew of before it began, while the expiring policy may respond only if they were reported before it ended.

Mayflower's application states that failing to report a known claim or circumstance to the current insurer before that policy expires may create a lack of coverage, so anything that could become a claim should be reported to the current insurer before its policy expires.

Which Documents Should You Gather Before Applying?

Before applying, gather the five documents Mayflower's application requires and as many of its eight recommended documents as exist, since the application states that the recommended ones may improve terms.

Gathering these documents into one folder before starting is the most practical way to shorten underwriting, and the inventory should come first, because most of the application's other answers depend on knowing which systems are in production.

How Do the NIST AI RMF and ISO/IEC 42001 Help an Application?

The NIST AI RMF and ISO/IEC 42001 help an application by giving the underwriter a recognized yardstick for the company's controls, and ISO/IEC 23894 adds guidance on AI-specific risk.

The legal weight of these frameworks varies by state. Colorado's 2024 AI Act (SB 24-205) would have given an affirmative defense to companies that complied with a recognized AI risk management framework ^[16], but SB 26-189, signed on May 14th 2026, replaced the law before it took effect and removed that safe harbor ^[17].

Texas's Responsible AI Governance Act, in effect since January 1st 2026, shields a company from liability in an attorney general action where the company found the violation itself, either through its own testing, such as red-teaming (attacking its own system to find weaknesses), or through internal review while substantially complying with NIST's Generative AI Profile or another recognized framework ^[18].

Because Mayflower's application lists an ISO/IEC 42001 certificate only as a recommended document, the sensible course is to map existing controls to the NIST AI RMF first and to seek certification where customers or regulators are likely to ask for it.

Which Gaps Weaken an AI Liability Application?

The gaps that weaken an AI liability application most are those that leave the underwriter unable to size the exposure or to see who controls the AI, and six of them are worth closing before applying.

The recommended course is to close as many of these gaps as possible before submission and to give a target date for any that remain open.

How Can You Prepare an AI Liability Application in 30 Days?

A company can prepare a complete AI liability application in about 4 weeks if each function owns its part, as in the plan below.

1. Week 1, inventory (engineering and risk): Engineering lists every production AI system, including vendor tools and agents, and risk assigns each an integration depth and a decision materiality.
2. Week 2, governance (legal and risk): Legal confirms that the governance policy is adopted, the oversight committee has met and owners for AI risk are named in writing, while risk maps controls to the NIST AI RMF.
3. Week 3, testing and data (HR, engineering and privacy): HR and engineering gather bias testing results for every system that touches hiring, promotion or termination and commission testing where none exists, and privacy collects impact assessments and training-data licenses.
4. Week 4, vendors, incidents and claims (legal, risk and finance): Legal reviews critical AI vendor contracts, risk runs an AI tabletop exercise, and finance orders loss runs and financial statements. The signing officer then reviews the whole application, because the signature declares the answers true “after diligent inquiry.”

It is a good idea to start the plan at least a month before the D&O, EPL or E&O renewal date, so that any gap the inventory exposes can be closed before the officer signs.

How Do You Apply for AI Liability Insurance With Mayflower?

A company or its broker can apply using either the online application, which saves progress, or the PDF version, available after accepting a limited use license. Mayflower places all four modules through brokers and writes them on a claims made and reported form, on A- (Excellent) AM Best rated paper backed by some of the world's largest reinsurers. The application accompanies the ACORD applications for D&O, EPL and professional liability, is held in confidence and must be signed by the Chairman, CEO, CFO, President or General Counsel, and completing it does not bind coverage.

Mayflower may use public information to supplement the answers, so AI claims in investor materials and product pages should match the application, and material changes before the policy is issued must be reported. Some uses fall outside Mayflower's appetite, including autonomous weapons, social scoring, mass surveillance and undisclosed deepfake generation, and how coverage responds to any particular claim depends on the policy wording.

A company using AI in hiring can begin with AI-EPL, one whose AI serves clients with AI-E&O, and one whose board has disclosed AI as a risk with AI-D&O. If an existing D&O, EPL or E&O policy has added an AI exclusion, the guide to silent AI and the new AI exclusions explains where AI DIC Excess fits, and the guide to AI in hiring covers employment exposures in depth. Whichever module comes first, the recommended course of action is to gather the required documents, close the gaps above and then start the application with your broker.