Insurance companies are quietly becoming America's most powerful AI regulator, and they're regulating by withdrawal. State insurance commissioners have approved more than 80 percent of carrier requests to exclude AI-related damages from corporate insurance policies, according to a report from the Center for Strategic and International Studies (CSIS) published in September 2026. For most American businesses, an activity that cannot be insured is effectively prohibited, making this regulatory shift potentially more consequential than any legislation Congress has passed.

Why Can't Insurance Companies Price AI Risk?

The insurance industry has used the same framework to evaluate emerging risks for over four decades, known as the Berliner test. According to a 2025 assessment by the Geneva Association, generative AI currently fails outright on three of the nine criteria and is under strain on five more. The most fundamental problem is information asymmetry: insurance carriers cannot see which AI models their clients are running, what applications they're using them for, how those systems are governed, or whether claimed risk controls actually exist.

Without this visibility, insurers cannot price the two classical problems that plague insurance markets: moral hazard (when someone takes more risks because they're insured) and adverse selection (when high-risk customers are more likely to buy insurance). Every other insurability failure becomes easier to repair once this information gap is fixed, but none of these problems will resolve themselves quickly on their own.

How Long Does It Take Insurance Markets to Mature?

The cyber insurance market offers a cautionary tale. It took roughly 20 years to mature, and it never developed the verification infrastructure that would have allowed underwriters to discipline risk rather than merely price it. AI deployment is moving on a much faster timeline, and the absence of insurance could pose an even greater barrier to adoption than cyber insurance did.

The stakes are high. When insurance withdrawal happened in other sectors, it had dramatic real-world consequences. In 2012, the United States and European allies used financial sanctions to cut off access to maritime protection and indemnity insurance for ships carrying Iranian crude oil. Without insurance, tanker ships could not unload their cargo at major ports, and Iranian oil exports plummeted. More recently, in 2026, insurance withdrawal was a major factor in the economic impact of the U.S.-Iran conflict; P&I war-risk cover was removed for the Strait of Hormuz on March 5, making the economic risk too high for shipowners to use the route even if they could find willing sailors.

Steps to Rebuild Insurable AI Deployment

The CSIS report proposes four recommendations to address the insurability crisis, each tied to existing institutional models:

• Federal AI Incident Database: The federal government should build a two-tier AI incident database at the National Institute of Standards and Technology (NIST), modeled on aviation's Aviation Safety Reporting System. This is the least expensive recommendation and the foundation for the other three, as it would provide the loss-frequency and loss-severity data that all insurance pricing requires.
• Insurance Commissioner Coordination: The National Association of Insurance Commissioners should convene a federal-state working group before the current wave of AI exclusion templates hardens into a second generation of policy forms, preventing the exclusions from becoming permanent industry practice.
• Federal Catastrophic Backstop: Congress should prepare a layered, Price-Anderson-style federal backstop for catastrophic, correlated AI losses that the private market cannot absorb, similar to the nuclear insurance framework that has worked for decades.
• Independent Verification Organizations: Governments should license independent verification organizations (IVOs) and accelerate the auditable risk-assessment standards they verify against, directly addressing information asymmetry and converting AI underwriting from guesswork into engineering discipline.

None of these steps requires importing the European compliance model or the Chinese state-carrier model, according to the CSIS analysis. Together, they would convert insurance from an accidental brake on American AI adoption into what insurance has historically been for every transformative technology since steam: an accelerator and one of the most effective safety regulators the United States has.

What's the Broader Policy Implication?

AI insurance policy is a form of AI industrial policy, and one that the United States needs to take seriously if it wants to maintain global leadership in the AI race. The current insurance withdrawal is happening largely out of public view, attracting a fraction of the attention paid to AI legislation, but it will likely matter more than most legislation. When insurance works well, it creates a virtuous circle: companies adopt effective governance practices and risk mitigation technologies to lower their premiums, those practices become industry standards, and overall adoption accelerates as more firms find the technology safer, cheaper, and better understood.

The current trajectory is moving in the opposite direction. While most enterprise liability policies are currently assumed to have blanket coverage for AI activities, insurers appear poised to exclude some or all AI uses from the next round of renewals, viewing AI risks as too broad, diverse, and obscure to price correctly. If this happens, AI adoption in the United States will undoubtedly slow as companies find AI deployment uninsurable and therefore unattractive.

The insurance industry's quiet retreat from AI risk represents a critical juncture for American technology leadership. Unlike regulatory frameworks that require legislative action and public debate, insurance exclusions can spread rapidly through industry practice, potentially creating a de facto prohibition on AI deployment before policymakers fully grasp what is happening.