The underwriting gap

Somewhere in the first quarter of this year, a quiet change propagated through commercial insurance renewals. New exclusion endorsements — generative-AI-specific, with form numbers like CG 40 47 and CG 40 48 — began attaching to standard commercial general liability and errors-and-omissions policies. The effective date for many of them was January 1, 2026.

Most companies did not notice. The exclusions arrived in renewal packets, in the dense middle sections where endorsements live. Brokers flagged them or did not. Risk managers read them or did not. And the companies deploying AI agents into their operations kept deploying, on the assumption that if an agent made a consequential error, the existing coverage would respond the way it always had.

That assumption is now wrong. If one of those endorsements is attached, a claim tied to an AI agent's mistake may simply fall outside the policy. The errors-and-omissions coverage that would have responded to a human employee's comparable error does not necessarily respond to the agent's. The protection is still in the binder. The binder just has a new hole in it.

The split in the market

The insurance market has divided into two tracks, and the distance between them is the story.

On the first track, standard carriers are excluding AI. The logic from their side is not mysterious. An AI agent does not behave like a human employee. Its error modes are different — it can be confidently wrong at scale, wrong in ways that correlate across a portfolio of policyholders, wrong at machine speed before anyone reviews the output. Actuarial models built on human error rates do not price that risk. So the standard market has, for now, declined to.

On the second track, specialist insurers are building affirmative AI liability products. Dedicated coverage for hallucinations, model drift, autonomous transaction errors, regulatory defense costs. Munich Re has a product. AXA XL has one. A cluster of newer entrants — Armilla, Testudo, Counterpart, others — are underwriting AI-specific risk as their core business. This market is real, growing, and priced like a new category: carefully, with a lot of questions.

The questions are the interesting part.

What the underwriters ask

A company applying for AI-agent liability coverage in 2026 will encounter an underwriting process that looks less like a renewal and more like a diligence call. The specialist carriers want to know things that most deployment teams have never written down.

What does the agent do, exactly. What systems can it touch. What is the consequentiality threshold — which of its actions can cause real harm without a human seeing them first. Who reviews its output, and with what authority to stop it. What happens when it is wrong, and how would you know. What is logged, and for how long.

These are governance questions. They are also, increasingly, insurability questions. The carriers writing affirmative AI cover have converged on a common underwriting posture: they will price the risk, but only if the deployment can demonstrate that someone is actually minding it. An agent with no documented oversight is, from an underwriter's chair, an unquantifiable exposure. An agent with a named reviewer, a defined escalation path, and an audit trail is a risk they can model.

Which means the oversight layer has acquired a second job. It was already the operational control. It is now also the insurance application.

The gap most companies are standing in

The uncomfortable position in 2026 is the middle. The company's standard E&O policy has the new exclusion attached — whether the company has read it or not. The company has not purchased specialist AI cover — because the deployment was framed as a productivity tool, not an insurable risk. And the agent is running, consequential and all, in the gap between the two.

This is not a hypothetical configuration. It is the default one. The carriers attaching exclusions vastly outnumber the carriers writing affirmative cover, and the buyers of AI agents vastly outnumber the buyers of AI liability policies. The gap is where most enterprise AI currently lives.

Closing it does not require choosing a side of the market. It requires treating the oversight layer as what it has quietly become: a prerequisite for coverage, not an optional hygiene measure. The company that can document named review, defined thresholds, continuous monitoring and a complete audit trail can shop the specialist market with a real application. The company that cannot is asking an underwriter to take their word for it.

Underwriters do not take words. They take evidence.

Evidence is an architecture

This is the part that tends to surprise the teams scrambling to retrofit. The evidence the insurance market wants cannot be produced after the fact. It is generated by the deployment's architecture, continuously, or it does not exist.

A named reviewer attached to every consequential decision — that is evidence. A documented threshold separating routine output from reviewed actions — evidence. An audit trail that can reconstruct who approved what, when, and with what context — evidence. A correction loop where reviewer interventions feed back into the agent's behavior — evidence, and the kind underwriters particularly like, because it demonstrates that the oversight layer improves the thing it oversees.

None of this is new as an idea. It is how h.work's attended-agent model has always worked: every specialist paired with a named, credentialed expert whose review is the control, every correction becoming training signal, every action logged. What changed is the external pressure. A year ago, the audit trail was a diligence nicety. Now it is the document your coverage depends on.

The insurance market, without intending to, has produced the cleanest external validation of the attended thesis yet. It has looked at the spectrum of AI deployments and priced them accordingly: unattended agents are an exclusion, attended agents are an underwritable risk. The market is not making a philosophical claim about human oversight. It is making an actuarial one. Oversight changes the loss profile.

The renewal question

The practical test arrives at renewal. Somewhere in the packet is a form number worth finding — CG 40 47, CG 40 48, CG 35 08, or the carrier's own variant. If it is there, the coverage question is already open whether or not anyone has asked it.

The follow-up is simple to state and harder to answer: if the agent errs tomorrow, which policy responds. If the honest answer is "none" or "we assume the existing one," the gap is already underfoot. If the answer is a specialist policy, the next question is the underwriter's — show us the oversight — and the answer to that one lives in the deployment, not in the application.

The companies that will find this easy are the ones that built the oversight layer before the market asked for it. Everyone else is about to learn that insurability, like accountability, is an architecture. It cannot be stapled on at renewal time.