Cyber is the cleanest proxy for AI liability. Here are some graphics to help understand this:
ISO created CG 21 06 in 2014, carving out electronic data for major lines of business. A few major law suits tested this, Lloyds creates Y5258 which then forced the market to either affirm or exclude, and now Cyber is a $15B line. AI could be on the same trajectory, except with more water surging toward the levee: Chatbots, hiring tools, agents galore. We've already got some major cases that are public (Air Canada, Mobley v Workday, EEOC v iTutorGroup), but we don't have the coverage-breaking one yet. Another subtle difference is that the exclusions have already happened: ISO CG 40 47 / 40 48 / 35 08 from Jan 2026. Right now we think we're in the silent phase, but it may not be as slow as cyber.
This silent part will decay in a predictable manner: silent, unpriced, Excluded, Contested, Affirmative.
Cyber spent between 8-10 years going from product creation to the forms' creation; AI is basically there in three years. Now, we got the major AI labs essentially asking for a liability pass as they look to slow the industry's progress. Scott Bessent says there will be no federal pass on liability. "The best way to guarantee safety is that the creators are liable for what they build and generate." No federal facility is going to come plug the levee like TRIA after 9/11. He further said that the agents involved in Hugging Face aren't to blame. That is a great indicator of where coverage will be needed. The liability is going to be recognized in the labs (vendors), whoever is using their products, or both. These companies are probably already buying GL, E&O, cyber and D&O that may or may not be priced with this much risk in mind...
So with the federal government passing on development and the labs not slowing down, how long before the basin is full?
- Nourse Fox 9.22.2026
