Is Insurance Becoming the De Facto Regulator of Artificial Intelligence?
Artificial intelligence is often discussed as a challenge for lawmakers and government regulators. Yet insurance may be creating another form of oversight outside the traditional regulatory system.
A recent RAND report, The Insurability of Artificial Intelligence, examines how insurers are responding to risks created by the expanding use of AI. These risks include misinformation, privacy violations, intellectual property disputes, discrimination, fraud, defective products, and failures involving autonomous systems.
The report finds that insurance carriers have not adopted a uniform approach. Some are offering coverage for particular AI risks, while others are introducing broad exclusions. Many policies remain silent about AI-related losses, leaving organizations uncertain about whether existing coverage will apply when an incident occurs.
This uncertainty matters because insurance does more than compensate an organization after a loss. Insurers can also influence behavior before a loss occurs. Coverage conditions, underwriting questions, exclusions, premiums, and required safeguards can all affect whether and how an organization deploys a particular technology.
An emerging example can be found in the Artificial Intelligence Underwriting Company, or AIUC. In its announcement, “Series A to Build the Confidence Infrastructure for Frontier AI” the company describes an approach that combines standards, independent audits, certification, and insurance. Its AIUC-1 standard evaluates AI agents against risks such as hallucinations, jailbreaks, and data leakage.
AIUC compares this developing model to the historical relationship among insurers, safety standards, and Underwriters Laboratories. The comparison is noteworthy, although the future of AI oversight may not follow precisely the same path. Artificial intelligence presents risks across many industries and multiple lines of insurance, making it considerably more difficult to evaluate than a single physical product.
Still, the connection among certification, risk controls, and access to insurance raises an important question. If organizations must satisfy particular AI standards to obtain affordable coverage, those standards may begin to influence business decisions even when they are not legally required.
That would not make insurers government regulators. It would, however, give them a meaningful role in determining which AI systems are considered acceptable risks and what safeguards organizations are expected to adopt.
As artificial intelligence becomes more deeply embedded in business operations, regulation may not come only from statutes, agencies, and courts. It may also emerge through contracts, coverage decisions, technical standards, and the practical requirements of managing risk.
If insurance becomes necessary for responsible AI deployment, could insurers ultimately exercise as much practical influence as lawmakers over how artificial intelligence is used?