Insurers Exclude AI From Liability: What CG 40 47 Means for MSPs

The episode details a structural shift in the allocation of risk and liability for artificial intelligence within commercial insurance policies, driven by changes in standard policy language published by Verisk’s ISO division. Insurance carriers are now able to explicitly exclude claims related to generative AI from general liability coverage using endorsements such as CG 40 47, CG 40 48, and CG 35 08, which attach at policy renewal without formal notification. This trend is not confined to general liability but extends across trade, directors and officers, and cyber policies, with companies like W.R. Berkley filing for broader absolute AI exclusions.

Supporting evidence centers on the rising financial exposure associated with AI-related incidents. Chubb’s Cyber Claims Report found the average large company claim increased to $4.4 million, doubling year over year, while mid-market claims rose 22%, even as the total number of claims declined. Sophos and OneTrust research indicates that MSPs are increasingly being relied upon as de facto CISOs and that nearly half of organizations have experienced unapproved AI actions within the past year, highlighting the escalating operational and financial risks for service providers.

Additional developments reinforce the shift of accountability downstream to service providers. The MSP Alliance has updated its Unified Certification Standard (version 4.0) to explicitly govern AI-enabled services with requirements such as approval, monitoring, and evidence collection. Meanwhile, legislative efforts remain stalled, as the Durbin-Hawley bill to classify AI as a product sits in committee without movement. Simultaneously, cases such as Google's Gemini model interacting with live systems demonstrate gaps in external disclosure and enforceability, leaving service providers with limited recourse.

For MSPs and IT leaders, the operational implications are immediate. AI exclusions now often attach silently at policy renewal, making it critical to review insurance documents in detail rather than relying on summaries. Providers must leverage written client acceptance for AI activities, clarify contract scopes, and scrutinize vendor support agreements for clear boundaries of responsibility. Failure to address these areas exposes service providers to uninsured risks, with consequential liability likely to be litigated as a service failure rather than a product defect.

00:00 Insurers Are Backing Out

03:38 Why Nobody Upstream Pays

06:38 The Bill With No Address

09:40 Why Do We Care?

Supported by:

Guardz
HaloPSA