AI Agent Assurance for Your Agent Deployments
Agent Assurance Tests How Your Agent Actually Behaves across Workflows, Tools, and Actions to Catch Failures and Vulnerabilities.
npm install -g @testmuai/rook
AI Liability Insurance Is Here - Underwriters Will Price Your Agents on Evidence
AI liability insurance is here, and old policies now exclude AI. See the evidence underwriters will ask for and a 7-test scorecard for your agents.
Published on:
On 10th November, Cowbell announced a standalone AI liability policy for US businesses that operate AI agents. This covers an agent that goes outside its authorization, exposes data without authorization, or simply loops on a task and runs up costs (CFOtech).
What struck me was the underwriting. Cowbell says it looks at three things: observability, autonomy and governance.
Three weeks earlier, Gartner had told CIOs at its IT Symposium that only 1% of them had gone down the AI insurance route and another 34% were considering it (InformationWeek, Oct 2026).
Put those two facts together, and you've got my thesis for this piece. The first body to actually put an AI governance framework into practice at scale won't be a regulator. It will be the underwriter at your next renewal.
Underwriters don't price promises; they price evidence.
TL;DR
AI liability insurance covers the loss arising from an AI system failing to do what it was supposed to do. That covers hallucinations, going outside the agent's authority, and runaway costs. The standard policies are now starting to exclude AI, and the new standalone cover is underwritten on evidence (testing history, logs, permissions and independent audits). Those that can't provide that evidence will end up paying more or get no cover at all.
Does My Existing Cyber or E&O Policy Cover AI Agents?
- Silent AI cover: Does an older cyber, general liability or E&O policy that never mentions AI cover AI losses? Possibly not. Silent wording leaves AI insurance coverage ambiguous, and Verisk/ISO generative AI exclusion endorsements for general liability carry a January 2026 edition date.
- Affirmative AI cover: Is insurance for AI agents priced on promises? No. A standalone AI liability policy, or an explicit AI section in cyber or tech E&O cover, names AI failures as covered events and is priced on performance history, the agent's permitted bounds and independent checks.
- AIUC-1: Does a vendor's AIUC-1 certificate cover your deployment? No. AIUC-1, the agent standard from the Artificial Intelligence Underwriting Company, requires an accredited audit and quarterly retests, but the certificate covers the vendor's agent, not your permissions, data, prompts or integrations.
What Evidence Do Insurers Require for AI Agents?
- Insurable Agent Scorecard: The Insurable Agent Scorecard is a seven-test readiness heuristic from TestMu AI, scored 0 to 2 per test. A total of 11 or more out of 14 is underwriting-ready, and 0 to 5 points to exclusions or a very small AI sublimit. It is not a carrier's rating model.
- AI verifiability: Does a vendor's model card count as evidence? No. The Insurable Agent Scorecard gives full marks only to continuous, tamper-evident evidence you can export on demand, produced by a checker that is not the model under test.
- AI observability: Is production observability enough for an underwriter? No. Observability records what an agent did after release, while underwriters also ask whether it stays in scope, survives failures and attacks, and can be stopped, which takes pre-production testing.
- AI TRiSM: An AI TRiSM program (AI trust, risk and security management) already covers much of an AI insurance evidence pack, such as the agent inventory, authority map, test history and action logs, so one body of work can serve both the program and the broker.
- Agent Assurance: TestMu AI's Agent Assurance tests agents before release and on every change, checks each criterion against what the run actually changed rather than what the agent reported, and records separately what it could not verify.
What Is AI Liability Insurance?
AI liability insurance is coverage that will pay for losses arising out of an AI system not performing as it should. The usual scenarios that would trigger it are hallucinated outputs, biased decisions, data leaks, IP infringements and agents going beyond their permitted scope. It can be sold as a standalone policy or as a specific 'affirmative' AI section within a cyber or tech E&O policy.
Historically, AI risk has just sat as silent cover within a whole host of general liability, cyber and professional policies (not priced, not excluded). That window is closing. Here's how the three states compare.
| Silent Cover | Excluded | Affirmative Cover | |
|---|---|---|---|
| What it means | Old policy wording doesn't mention AI, so coverage is ambiguous | Policy explicitly carves AI-caused losses out | Policy explicitly names AI failures as covered events |
| Who decides if you're paid | Lawyers, after the loss | Nobody: you're not covered | Underwriter, before the loss |
| Evidence demanded | None up front | None, because there is nothing to buy | Model and agent performance, controls, logs, audits |
| Examples (2025-2026) | Legacy CGL and E&O wording | Verisk/ISO generative AI exclusion endorsements for general liability, effective January 2026 (Big "I") | Munich Re aiSure; Armilla with Lloyd's underwriters; Cowbell's AI policy (available Jan 1, 2027, per National Law Review) |
Big carriers are saying the quiet bit out loud. Chubb's Evan Greenberg said in October that AI liability is "not contemplated in casualty underwriting to date". His suggested route forward was exclusions and separate AI liability coverages (Insurance Journal, Oct 22, 2026).
Why Will It Be the Insurers Rather Than the Regulators Who Set the Bar on AI Governance?
As insurers act at every annual renewal, the strictest AI rules are still moving. The EU's Digital Omnibus on AI, Regulation (EU) 2026/1744, has pushed the obligations for Annex III high-risk AI systems back to 2nd December 2027. Annex I systems are now due to start on 2nd August 2028 (EUR-Lex).
The EU timeline has slipped. Underwriting is still on an annual clock. Your CFO will be feeling the renewal questionnaire a hell of a lot earlier than your General Counsel will be feeling an enforcement action.
The losses are absolutely real. In EY's 2025 Responsible AI Pulse of 975 C-suite leaders, 99% of organizations reported financial losses as a result of AI-related risks. Of those that did experience the risks, EY is pretty conservative in its estimate of the average loss at $4.4m (EY, Oct 2025).
The market that prices those losses is small but growing rapidly. Deloitte has projected that insurers could be writing some US$4.7bn in annual global AI insurance premiums by 2032 (Deloitte Insights, 2024).
Governance is the first thing underwriters will see. Gartner's symposium data shows that only 21% of CIOs currently have agentic AI governance in place, yet 71% anticipate deploying agentic AI within the next 12 months (InformationWeek)[1]. That's a massive number of agents going into production with nothing for an underwriter to read.
What Evidence Do Insurers Require Before Covering AI Agents?
They're asking for evidence of how the system performs over time, what it's permitted to do and who independently validated it in relation to the model itself. The public underwriting language is already very specific:
- Munich Re assesses model development pipelines and forecasts future underperformance based on historical performance data. Model quality and 'performance stability' are the factors that determine the premium (Munich Re aiSure FAQ).
- Armilla offers limits of up to $25m per organization via Lloyd's underwriters. Each policy includes an independent AI system certification and risk reporting (Armilla).
- Cowbell underwrites on observability, autonomy and governance (CFOtech).
- AIUC-1 (the agent standard developed by the Artificial Intelligence Underwriting Company) requires quarterly retests and an accredited audit, and the certificate is valid for one year. The October 2026 release of AIUC-1 included "stronger third-party testing". The AICPA is currently piloting a combined SOC 2 + AIUC-1 engagement with a full rollout expected in early 2027 (Journal of Accountancy).
Look at the pattern. All of them want history (performance over time), bounds (what the agent is capable of doing) and independence (someone other than the builder or the model itself has had a go at it). None of them are going to be happy with a vendor's model card or a dashboard screenshot.
An insurable AI agent is one whose behavior is bounded, tested over time, and independently verified, with the requisite evidence being available to hand over on demand. That's exactly what public frameworks already ask for. The NIST AI RMF Playbook asks organizations to document their test sets, the metrics used, and the tools used for testing, evaluation, validation, and verification (MEASURE 2.1) and to monitor the system's behavior in production (MEASURE 2.4) (NIST AIRC).
The Insurable Agent Scorecard: 7 Tests Underwriters Will Run on Your AI Agents
I built the scorecard below from TestMu AI's AI trust principles. Each test is phrased as an underwriter would phrase it. Score each one 0 (no evidence), 1 (partial or manual evidence), or 2 (continuous, tamper-evident evidence which you can export on demand).
To be absolutely clear: this is our readiness heuristic, not any carrier's rating model. It's designed such that the evidence you produce for it also maps to what the sources listed above are actually asking for.
The scorecard is assuming you already have the policy layer. If you don't, then you'll want to start with our guides on building an AI governance framework and running an AI audit.
For the wider evidence model, see why AI agent governance is an evidence problem. This scorecard is asking the narrower question that an underwriter would ask.
| # | Underwriter's Question | Test | What Earns a 2 | What Scores 0 |
|---|---|---|---|---|
| 1 | Is the agent's work checked by something other than the model that produced it? | Model diversity: no model checks its own work, and no single model is the only dependency | Independent verifier (deterministic assertions plus a different model where judgment is needed); a fallback model path | The agent, or the same model, grades its own output |
| 2 | Can you show what the agent did, step by step? | Evidence | Tamper-evident, human-readable record of each meaningful action, kept in your control plane | Logs live only in the vendor's console, or are not retained |
| 3 | How has it performed over time, including under failure and attack? | Continuous system testing | Versioned regression and adversarial suites run on every change and on a schedule, with trend history | One pre-launch eval, or a red-team report never re-run |
| 4 | Who decides what it can access and do? | Deployer-defined authority | Permissions defined by the company and tested as negative cases ("agent must refuse X") | Scope set by prompt wording or vendor defaults |
| 5 | Who audited it, and do they depend on the system under review? | Independent audit | Audit run by a party and tooling separate from the model and its builder | Audit uses the same model or the vendor's own scoring |
| 6 | Can a person stop it mid-task? | Containment | Tested pause/kill path with a measured time-to-stop, plus spend and loop limits | Kill switch exists on paper but has never been exercised |
| 7 | When it fails, how fast can you tell affected parties what happened? | Incident disclosure | Incident runbook that pulls evidence from #2 and #3; post-incident lessons shared | Root cause reconstructed from memory and chat threads |
Reading the score (out of 14):
- 0-5, uninsurable at a sane price. Expect exclusions or a very small AI sublimit.
- 6-10, insurable on conditions. Expect questions, sub-limits and a re-review at renewal.
- 11-14, underwriting ready. You can negotiate terms as you can prove what your agents do.
Tests 2, 4 and 6 are in line with Cowbell's observability, autonomy and governance lens. Test 3 is what Munich Re's 'historical performance data' means in practice. Test 5 is the independent certification that Armilla bundles in with their offering, and the third-party testing of AIUC-1 is also being tightened.
For EU deployers, Test 2 also maps to Article 26(6) of the AI Act, which requires deployers of high-risk systems to retain their automatically generated logs for a minimum of six months (AI Act Service Desk).
What Goes in an AI Insurance Evidence Pack?
Bring those eight items to your broker. Each one corresponds to a scorecard test.
- Agent inventory: each agent, its models and vendors, the tools it can call and the data it can reach (test 4).
- Authority map: actions permitted without approval, spend and transaction limits, escalation rules (tests 4 and 6).
- Test history: regression and adversarial results per release, with trend lines (test 3).
- Independent verification report: who checked the agent, with what, and how that entity is separate from the model (tests 1 and 5).
- Sample action logs: a couple of complete production traces showing the tool calls, the approvals and the overrides (test 2).
- Containment drill results: the final kill switch test and the time to stop as measured (test 6).
- Incident and near-miss log: root causes and fixes (test 7).
- Vendor certificates such as AIUC-1 or SOC 2, labelled as vendor evidence, not yours.
How Does the Scorecard Perform in the Really Difficult Cases?
It holds up if you keep those two ideas separate: independence is about who produces and who judges the evidence, and custody is about who holds it.
- You built the agent in-house. Independence doesn't require a second company. It just requires that the checker is not the model under test and is not being scored on the team's own success metrics. A separate verification layer with its own assertions and its own models is sufficient. Underwriters may still wish to have an external auditor for test 5, so you should plan for that as well.
- You own your evidence. That's good. TestMu's evidence principle is that evidence should end up in the customer's control plane. Owning it yourself doesn't in any way undermine independence as long as the evidence is tamper-evident and was generated by the verifier, not the builder.
- Your vendor is certified. Their AIUC-1 cert covers the vendor's agent. It doesn't cover your deployment (your permissions, your data, your prompts, your integrations). A cert is an input to your score; it's not a replacement for your score.
- Your model provider can change their terms or simply cut you off. That's a continuity risk. If your only model of choice is the one you're relying on for a key outcome, then test 1 goes to zero the moment that model is gone. You need to have a tested fallback path.
- You're a 40-person company. Tests 4 and 6 are virtually free to get going and cover two of the three triggers that Cowbell identifies (exceeding scope and runaway costs). Do that first.
Is AI Observability Sufficient to Satisfy an Underwriter?
No. Observability is about what happened after release. Underwriting is about whether you knew what was going to happen prior to release.
Production tracing is the necessary evidence for tests 2 and 7. The market is consolidating very rapidly.
On the 3rd of November, CrowdStrike signed a definitive agreement to acquire Fiddler AI to add agent observability (CrowdStrike).
But tests 1, 3, 4 and 6 are all pretty much pre-production questions. They require AI assurance in the form of repeatable tests run against the agent both prior to shipping and on every change thereafter.
The post-release scoring tells you the premium was mispriced. The pre-release assurance is what helps you avoid having that conversation.
As to how assurance, observability and evals are different, see our explainer on AI assurance.
What Happens Next? Three Predictions for AI Insurance
These are my predictions, each one linked to a trend that's already manifest in the sources above.
- By the end of 2027, agent-specific questions will be the norm in cyber and tech E&O renewals for any company that's running agents in production. The ground has already been prepared with GL exclusion endorsements coming in January 2026, a top carrier's CEO speaking about separate AI coverages and standalone AI policies now underwriting on autonomy and governance.
- Vendor certification becomes a procurement checkbox, and deployer evidence is the real driver. AIUC-1 combined with the AICPA's SOC 2 will make 'is your vendor certified?' a completely standard thing. Pricing will still be driven by your performance history, as Munich Re's language makes clear.
- Some of the flagship deployments will be on hold due to lack of evidence rather than lack of capability. Forrester is already forecasting that at least three of the well-known enterprises will either reverse a flagship AI deployment or push it back a year (Forrester Predictions 2027). Lack of evidence at renewal or during the procurement process is one potential trigger and one that's very easy to use to avoid the decision.
Where TestMu AI Fits
TestMu AI is not an insurer or a certification body, and it doesn't in any way grade the risk of its customers. It is an independent verification layer. It runs deterministic tests against your software and your agents and produces evidence (not opinions) that an auditor or underwriter can read.
- Agent Testing verifies human-to-agent systems (chat, voice, IVR, WhatsApp, video) against scripted, repeatable scenarios. That's for Tests 3, 4 and 6.
- Agent Assurance (delivered via our product Rook) tests agent-to-agent workflows prior to release where there's no human in the loop to be aware of a scope violation.
- KaneAI and Kane CLI check the web and mobile software that your agents are acting on, and the code that your coding agents write.
- HyperExecute runs those suites continuously so Test 3 has a real history rather than just a snapshot from launch day.
The design decision that really matters for insurance is that verification happens where the model happens, and evidence ends up in your control plane. In my view, testing is going to become a $65-100B market over the next 10 years.
Insurability is one of the drivers. Evidence is going from being a QA artifact to being a balance sheet asset.
The Bottom Line on AI Liability Insurance
AI liability insurance is moving AI governance from the realm of policy to priced evidence. The silent cover is being phased out, the exclusions are proliferating, and the positive cover that's replacing it is underwritten on the basis of history, bounds and independence.
Score your agents on the Insurable Agent Scorecard prior to your broker doing so. If you're under 11 then the best premium reduction available is a verification layer which confirms what your agents actually do.
Shipping agents that other agents use? Rook by TestMu AI does Agent Assurance: agents testing agents before release, with no human in the loop.
npm install -g @testmuai/rook@latest command, or for a full walkthrough of the product.Author
Asad Khan
Blogs: 5
Asad Khan is the Co-Founder and CEO of TestMu AI, with over 15 years of experience in software testing, product strategy, and leadership. Under his leadership, TestMu AI has grown into an AI-native software testing platform trusted by 2.5M+ users across 132 countries, including startups, enterprises, and Fortune 500 companies. He is a member of the Forbes Technology Council and is followed by 39,000+ professionals on LinkedIn from the software testing and quality assurance community. Before TestMu AI, Asad co-founded 360logica, a software testing company that he grew into a multi-million-dollar business before its acquisition by Saksoft. Earlier, he began his career at GlobalLogic as a Lead Engineer serving top Wall Street banks. He holds a Bachelor of Technology from JSS Academy of Technical Education, Noida.
Reviewer
Maneesh Sharma
Reviewer
Maneesh Sharma is Chief Operating Officer at TestMu AI, where he leads the company's revenue functions across go-to-market, sales, RevOps, customer success, and the partner ecosystem, driving its global expansion. He brings over 28 years of experience across product, go-to-market, and business operations. Before TestMu AI he was Managing Director and General Manager for GitHub across India and APAC, Head of Partner Sales and Ecosystem at Adobe, Chief Revenue Officer at WizIQ, and Head of Products and Solutions at SAP India. Maneesh holds an MBA from IIM Bangalore and a B.E. in Electronics and Communications from NIT Surat.
AI Liability Insurance FAQs
Did you find this page helpful?
More Related Blogs
TestMu AI forEnterprise
Get access to solutions built on Enterprise
grade security, privacy, & compliance
- Advanced access controls
- Advanced data retention rules
- Advanced Local Testing
- Premium Support options
- Early access to beta features
- Private Slack Channel
- Unlimited Manual Accessibility DevTools Tests