Coverage Gaps and Emerging Exclusions

2.1 AI-Specific Exclusions in Modern Policies

Modern professional liability policies are adding explicit AI exclusions. The specific language varies, but the categories are consistent. Here are the exclusions appearing most frequently in 2026 renewals:

• Undisclosed AI Use Exclusion: "Coverage does not apply to claims arising from the use of artificial intelligence or automated systems that were not disclosed to the client and documented in engagement materials." This exclusion directly penalizes nondisclosure and is increasingly mandatory.
• Unverified Output Exclusion: "Coverage does not apply to errors arising from reliance on AI-generated outputs that were not subjected to independent verification or quality control prior to delivery to the client." This exclusion incentivizes verification workflows but may be interpreted strictly.
• Hallucination Carve-Out: "Coverage does not apply to errors arising from fabrications, hallucinations, or false factual statements generated by AI systems." Some policies define hallucination narrowly (only complete fabrications) while others define it broadly (any output the AI cannot explain or ground).
• Confidentiality Misuse Exclusion: "Coverage does not apply to claims arising from the unauthorized disclosure of confidential client information through the use of AI systems, cloud-based AI tools, or failure to maintain adequate data protections." This exclusion focuses on how client data enters the AI system, not just the output.
• Training & Compliance Condition: "Coverage is conditioned upon the insured's completion of annual AI competence training and documented compliance with the insured's AI use policy." This is not strictly an exclusion; it is a coverage condition. Failure to meet the condition can void coverage.

2.2 AI Security Riders and New Carrier Requirements

To offset exclusions, carriers are offering AI security riders—optional coverage that covers specific AI risks if the firm implements specified protective measures. Understanding rider requirements is essential because accepting a rider means committing to its conditions. Here is the process for evaluating and implementing a rider:

1. Audit Your Current State: Before your renewal conversation with your insurer, inventory your current AI practices: what tools do you use, what client data enters those tools, what verification do you perform, and what do you disclose to clients. Document the answers.
2. Review the Rider Requirements: When your insurer proposes an AI rider, extract the specific requirements. These typically include: (a) documenting AI tools and their permitted uses, (b) implementing minimum verification standards, (c) training requirements, (d) data protection agreements with vendors, and (e) reporting obligations to the insurer.
3. Map Requirements to Your Practices: For each rider requirement, assess whether your current practices satisfy it or require modification. Create a simple table: requirement, current practice, gap, remediation needed. Do not assume your current practices meet the standard—carriers define standards differently.
4. Implement Missing Elements Before Renewal: Identify which elements you can implement immediately (documentation, training) and which require planning (vendor agreements, system changes). Start implementation before your renewal conversation, so you can speak credibly about your compliance path.
5. Negotiate the Rider Terms: If the rider includes expensive conditions (e.g., monthly audits, third-party verification), negotiate. Some carriers will phase in requirements or offer alternatives that achieve the same risk reduction at lower cost.
6. Confirm Renewal Coverage in Writing: Once you have agreed on a rider, ensure that your renewal documentation explicitly states that coverage applies provided you comply with the rider's conditions. Get this in writing before you renew.

2.3 Hallucination Risk and Coverage Implications

One of the most confusing coverage questions is whether your insurance covers losses from AI hallucinations—situations where the AI confidently produces false information, like fake case citations, made-up dates, or fabricated facts. The answer is: sometimes, but increasingly not.

In the first generation of AI liability claims (2022–2024), courts and carriers treated hallucinations as covered errors: the attorney made an error by relying on unverified AI output, and the error caused loss, so insurance covered the loss. The insurer's position was that the attorney's failure to verify was negligence, and negligence is a covered peril. But as hallucinations became better understood as a systematic failure mode of large language models, carriers shifted their position. Now, most carriers argue that hallucinations are not covered because they result not from the attorney's negligence but from the AI system's incurable defect. This is a meaningful distinction: it means that once you know an AI system is prone to hallucination, relying on it constitutes a deliberate risk, not an honest mistake.

Coverage for hallucination losses now depends on: (1) whether your policy explicitly excludes hallucinations, (2) whether you disclosed to your client the possibility of hallucinations, and (3) whether you followed a documented verification procedure. If you implemented industry-standard verification (e.g., checking all citations, confirming all facts), then a hallucination that slips through your verification is more likely to be covered than a hallucination you did not attempt to verify. The lesson is not that hallucinations are uninsurable; it is that hallucination coverage now requires documented prevention and verification practices.

2.4 Confidentiality Breaches and UPL Exposure

Confidentiality breaches are the fastest-growing class of AI-related insurance claims. They arise when client data fed into an AI system is inadvertently disclosed, when an AI system retains data after use, or when an AI system is hacked. These breaches trigger two insurance issues: cyber liability coverage (for the breach itself) and professional liability coverage (for your breach of client confidentiality under ABA Model Rules).