The Underwriter Did the Inventory You Skipped
Buying AI coverage outsources the one governance step you were supposed to own first.
Earlier this week I wrote that the insurance market has named who owns your AI risk, and the name is yours, the deployer’s. That is the half of the story that fits in a headline. This is the half that should keep a board awake, because it is quieter and it has already happened.
When you buy an AI liability policy, the underwriter has to price it. To price it, they have to know what AI you run, where it touches a consequential decision, and what stands between the model and the outcome. So before they quote you, they inventory your AI and score its risk. They ask which systems are in production, which ones face customers or regulators, what the human review step is, what gets logged, and who is accountable when it is wrong. Then they turn that into a number and put capital behind it.
Read that sequence again, because there is something uncomfortable in the order of operations. The first complete inventory of your AI exposure, the first honest assessment of the gap between what your systems do and what your governance controls, may not be produced by your risk team, your CISO, or your board. It may be produced by an outside party that is betting money against you, and keeping the map.
That is the move worth naming. Not that insurance is bad. That in buying it, most companies will outsource the first act of governance to the one party whose interests are not aligned with theirs.
The inventory is not paperwork. It is the governance.
There is a habit of treating an AI inventory as a compliance chore, a spreadsheet someone fills in before an audit. That gets the causality backwards. You cannot govern what you have not named. The act of listing every place AI touches a decision, and writing down who owns each one, is not preparation for governance. It is governance, in its first and most load-bearing form. Everything downstream, the review steps, the escalation paths, the logging, depends on that list existing and being owned inside the company.
When the underwriter builds that list for you, you get a version of the artifact without the thing that made it valuable. You learn your number. You do not build the capability. You hold a map drawn by someone who will use it to price your failure, not to prevent it. And you still do not have, inside your own walls, a named person who can stand in front of a regulator and say: I own this decision, here is how it is controlled, here is the record.
That last sentence is the whole game, and it is the thing no policy contains.
What coverage settles, and what it cannot
A policy settles a loss. When the AI-driven decision goes wrong and someone is harmed, the policy, if the claim is covered and not excluded, pays money. That is real value and I am not waving it away. But walk the failure forward past the payment. The regulator opens an inquiry and asks who approved the output that broke the rule. The board asks who was accountable for the system. The customer, and eventually a court, holds your company to what your AI did, exactly as a tribunal held Air Canada to its chatbot. At none of those tables does the check from your carrier answer the question being asked. The question is about ownership of a decision. Insurance is about ownership of a cost. They are different objects, and only one of them can be handed to someone else.
This is the error the premium invites you to make. It is designed, honestly, to feel like resolution. You had an exposure, you paid, the exposure is handled. But you handled the accounting for the exposure. The exposure itself, the ungoverned decision running in production, is exactly where it was before you wrote the check. You are now insured against its cost and no better governed against its occurrence.
The premium is a score. Read it as one.
Treat it as a governance score issued by a party that cannot be spun. Your vendor wants to sell you capability. Your team wants to report progress. The underwriter wants to be paid correctly for real risk, which means their assessment of your AI governance is the least flattering and most reliable one you will get. A high premium is not only a cost to negotiate down. It is a reading. It says the distance between the AI you run and the control you have around it is large, and here is what that distance is worth in dollars.
The companies that get this right treat the quote as a mirror and go do, internally and before the renewal, the work the underwriter was about to do for them. Inventory the systems. Name an owner for each consequential decision. Put a human review step where the output is high-consequence. Record what the system did and why. Not mainly to lower the premium, though it will, but to hold the thing the premium cannot: the accountability the claim will eventually demand a name for.
Because the sequence only runs one of two ways. Either you inventory your AI and decide who owns each decision it makes, or an insurer does it first, prices your gap, and hands you a policy that pays for the failure while leaving the ownership exactly where it always was, unassigned and now running at scale.
The underwriter is not your governance function. They are a signal that you need one, arriving with a number attached and a map you should have drawn yourself.
AI operates. You own the decision. Including the decision to let your underwriter be the first to find out where your AI actually lives.
Fellowship Intelligence defines and installs the governance this piece describes: named ownership for every consequential AI decision, in place before the underwriter or the regulator prices its absence. The entry point is a Diagnostic that maps where AI touches decisions across your organization and who is accountable for each one. It is $500, credited in full toward a Decision Brief signed within 30 days.
Sources:
McKinsey, State of AI (Nov 2025) — the 88% / 78% figure: https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
ISO / Verisk exclusions (CG 40 47/40 48/35 08) — Verisk issuer note · Gallagher explainer · CG 40 48 form PDF
Carriers filing exclusions — Financial Times · InsuranceNewsNet
Mayflower & Hadron program — Business Wire · Reinsurance News
Moffatt v. Air Canada, 2024 BCCRT 149 — CanLII full decision
Walters v. OpenAI (GA, May 19, 2025) — Loeb & Loeb · Cleary Gottlieb