Insurance, Indemnities and Liability When AI Causes Loss
When an AI system causes harm, someone must pay. The question is: who? This depends on contracts, insurance, and law. Boards need to understand how liability flows through the organisations involved in building and using AI.
Liability typically flows through a chain. A customer harmed by an AI decision might sue the company that deployed the system. The company that deployed it might sue the model provider or the integration partner. The model provider might claim the customer misused the model. Contracts determine who bears the financial burden at each stage.
Traditional Liability and AI Systems
Product liability law says a company is liable if a product is defective or unsafe. If a company sells a product (including software or services) that harms the customer, the customer can sue for damages. Traditional defect means the product does not work as described or does not meet safety standards for its intended use. With AI systems, the question of what “defect” means is still being worked out.
If an AI hiring system discriminates against a protected class, is that a defect? Most legal experts would say yes. The system does not work as described if it was described as non-discriminatory but is. So the company is liable. If an AI lending system provides credit to someone who cannot repay, is that a defect? This is less clear. The system might be working correctly in the sense that it predicts some customers will default; if users misinterpret that prediction, is it a defect? These questions are still being litigated.
Contract law is clearer. A company can write a contract that limits its liability. For instance, a software company might sell a model with a clause that says: “The model is provided as-is with no warranty of fitness for purpose, and the provider’s liability is limited to the amount the customer paid.” Customers often accept these terms because there is no alternative. But this contract only protects the vendor, not the customer. It does not prevent the customer from being sued.
Insurance for AI
Errors and omissions insurance (E&O) is the standard product for professional services and software vendors. E&O insurance covers claims that the provider’s negligence or errors caused harm to the customer. AI-specific policies are now emerging. These cover harm caused by AI system failures, including discrimination claims, and privacy breaches.
A company that deploys high-risk AI should have insurance. But insurance does not prevent the harm; it pays for it after the fact. A company with insurance for hiring discrimination might pay £2 million in damages if its AI system is found to discriminate. The insurance covers the cost, but the company also faces regulatory fines, legal fees, and reputational damage.
Insurance is expensive for high-risk uses. A company using AI in medical decisions, lending, or employment might pay tens of thousands of pounds per year for coverage. The insurance company will demand evidence of governance and risk management. They will ask: do you audit the system for bias? Do you have a rollback plan? Do you monitor performance? Companies without good governance find insurance unavailable or prohibitively expensive.
Contractual Indemnification
Indemnification is a contractual commitment by one party to cover losses incurred by another. If Company A buys a model from Company B and promises to indemnify Company B against all claims related to the model, then Company A absorbs the liability. This is common when a customer integrates a third-party model into its own application: the customer uses the model in ways the vendor did not anticipate, so the customer bears the liability.
Indemnification clauses are often one-way: the model provider indemnifies the customer against claims that the model itself is defective, but the customer indemnifies the provider against claims that the customer misused it. The balance depends on negotiating power. A large customer might negotiate mutual indemnification or liability limits. A small customer using a commercial API typically gets the vendor’s standard terms.
A board should know what indemnities the company has given and received. If the company has agreed to indemnify a model provider against all AI-related claims, that is a large exposure. If the company is using a model with a clause saying the vendor is not liable for discrimination, the company bears the full discrimination risk.
The Gap: Acts of AI
There is currently a gap in liability law: who is liable when an AI system does something wrong, but no one has acted negligently? For instance, if a model trained on historical data learns historical discrimination, and that model discriminates against a minority group, who is liable? The model vendor built the model honestly and tested it. The customer deployed it properly. But the system discriminates because it learned discrimination from historical data.
In this scenario, liability would likely fall on the organisation that deployed the system, because they are responsible for the decisions the system makes. But the vendor bears some responsibility for releasing a model trained on biased data without warning of that bias.
This gap means that AI governance, and in particular, the discipline of bias testing before deployment, is not just good practice; it is essential protection against liability. A company that can show it tested an AI system for bias before deploying it, and discovered discrimination, can defend itself better than one that deployed without testing. Conversely, a company that deploys without testing and later discovers the system discriminates has a weak defence.