The AI liability picture, August 2026
Briefing. Revision 1. ~1,900 words. Written 3 August 2026. Review by 1 February 2027. This piece has a shelf life. The essay it belongs to does not: There is no such thing as AI safety.
Three things changed in the last eight months that most churches and nonprofits have not heard about. All three are dated, none of them are predictions, and one of them landed yesterday.
I am not a lawyer and this is not legal advice. Every number here has a source at the bottom. Check them.
1 · Your general liability policy may no longer cover AI
On 1 January 2026, Verisk's ISO division put three new endorsement forms into circulation for commercial general liability policies. ISO writes the standard language that most American property and casualty policies are built on, so when ISO ships an exclusion it shows up at renewals fairly quickly.
The forms are CG 40 47 01 26, CG 40 48 01 26, and CG 35 08 01 26. Each one removes coverage for losses connected to generative AI. [1]
Between them they cover bodily injury, property damage, and personal and advertising injury. The wording is arising out of generative AI, which is a wide standard. And the definition of generative AI in the forms is broad, covering more or less anything that produces text, images, audio, video, or code. [2]
Carriers moved fast. Berkshire Hathaway, Chubb and Travelers asked state regulators for permission to exclude AI-related damages from general liability policies, and more than eighty percent of those requests were approved. Florida, Connecticut and Maryland approved the most. Some exclusions took effect as early as January. [3]
The industry has a name for what is ending. It calls the old situation silent AI, meaning AI risk was quietly covered under existing cyber and technology policies without anyone naming it. That is over. Coverage is now splitting across cyber, technology errors and omissions, directors and officers, and employment practices, with each line narrowing separately. The result is gaps where no single policy covers you. [4]
What to do about it. Pull your current policies and look at the endorsement schedule for anything mentioning generative AI. If you renewed after October 2025, there is a real chance this language was added without anyone talking to you about it. [5]
That is one phone call to your broker and it costs nothing. Ask two questions. Does our policy now exclude generative AI. Did anything change at our last renewal that we were not told about.
A market is forming to fill the hole. Munich Re's HSB division launched an AI liability product on 18 March 2026 aimed at small and mid-sized organizations, with standard limits of twenty-five or fifty thousand dollars and a five hundred dollar deductible, sold through partner carriers rather than directly. [1] Whether you need it is a conversation with your broker, not with me.
2 · Your board's exposure is about process, not technology
This is the part I find most useful, because it answers the objection people raise first.
The usual objection to writing an AI policy is that nobody understands these systems, so how can anyone be responsible for governing them.
The law has already dealt with that, and I want to be precise about where, because the precision matters more than the headline.
The body of law in question is Delaware's oversight doctrine, which comes from a case called Caremark and was reaffirmed in Stone v. Ritter. In March 2026 Pierluigi Matera published a paper arguing that AI does not alter that standard at all. What it alters is the evidentiary terrain: how good faith gets shown, documented, and assessed. Directors are not expected to understand how a language model produces an answer. They are expected to make a good-faith effort to design, validate, and supervise the organization's reliance on the system in light of the fact that it is opaque. The inquiry is procedural, not technical. [6]
One qualification, and it is the one most secondary coverage drops. Matera is explicit that this does not turn oversight into a negligence regime and does not make directors insurers of the technology's performance. The doctrine stays where it was, which is loyalty rather than care, and bad faith rather than imperfect outcomes. So the exposure is not that the AI made a mistake. It is a sustained or conscious failure to govern a system you chose to rely on. [6]
Read that again. The duty exists precisely because the system is opaque, and it is discharged by what you did about the opacity.
And here is the part that applies to you specifically, which I have not seen anyone say. All of the above is Delaware corporation law. Most churches and nonprofits are not Delaware corporations. Nonprofit directors in your state owe duties of care, loyalty and obedience that are analogous to this, and state attorneys general enforce them, but they are not identical and the case law is thinner. Do not walk into a board meeting saying Caremark applies to you. Say that the reasoning is where the standard for reasonable board process is being set, that your insurer and your counsel are watching it, and that nothing in it asks you to understand the technology. That claim is defensible. The stronger one is not, and someone in the room may know the difference. [Confirm with counsel how your state treats nonprofit director oversight before this goes in front of a board.]
Meanwhile the benchmark for what governing means is becoming clearer. The NIST AI Risk Management Framework looks to be following the path the NIST Cybersecurity Framework took. Over about a decade that framework became the working definition of reasonable cybersecurity practice. Regulators cited it. Courts used it to define the standard of care. Insurers used it in underwriting. [6]
And underwriters are already asking. D&O carriers have begun folding AI governance into their questions, sometimes calling it AI maturity. [8]
What to do about it. If your board has never discussed AI and there is no minute recording that it did, that is the gap. It is also the cheapest thing on this list to close. A board resolution and a dated document are an afternoon.
3 · The first real disclosure rules landed yesterday
On 16 June 2026 the European Parliament approved amendments that pushed most high-risk AI obligations out to December 2027 and August 2028. A lot of people read that as a delay and stopped paying attention.
What did not move was Article 50, the transparency section, and the enforcement powers for general-purpose AI. Both took effect on 2 August 2026. [9] [10]
What that section actually requires is ordinary. Tell people when they are talking to an AI. Mark AI-generated content so machines can detect it. Label synthetic media that shows real people. Document the human editorial control that exempts AI-assisted writing. Penalties for general-purpose AI reach fifteen million euros or three percent of global turnover. [9]
Most American churches and nonprofits are not covered by this. Two things follow anyway.
Transparency rules are where regulators start. If you want to know what American state legislatures will reach for, that is it.
And the obligations themselves are things you should probably be doing regardless. If you use an AI chat tool on your website, saying so is not a compliance burden. It is the minimum owed to someone who thinks they are talking to a person.
What to do about it. Decide now when you will disclose AI involvement in your own communication, and write the sentence you will use. If a rule arrives later, you will already have complied. If it does not, you will have been honest with the people you serve, which was the point.
What this adds up to
Not urgency, exactly. I am generally suspicious of urgency and I am not going to manufacture it here.
What it adds up to is that the cost of doing nothing went up, quietly, in three places at once, and the remedy in all three is the same and is not expensive.
Know what tools you use. Write down what you have decided. Get your board to ratify it and record the date. Ask your broker one question. Decide when you will disclose.
That is not a purchase. It is an afternoon and a phone call, and you can do all of it without hiring anybody.
The longer argument about what safety can even mean when nobody understands the system is a separate piece: There is no such thing as AI safety. This one was just the news.
Sources
All accessed 3 August 2026. Interested parties are marked. Where a claim comes through secondary reporting, the primary source is named.
[1] AI Policy Desk, "AI Insurance Exclusion Checklist 2026," 2 July 2026. https://www.aipolicydesk.com/blog/ai-insurance-exclusion-checklist-2026. For the three ISO form numbers and their 1 January 2026 date, and the HSB product launch, limits and deductible. ISO form numbers corroborated by [11].
[2] Honigman LLP, "The AI Insurance Gap and What It Means for Technology Contracts," 27 May 2026. https://www.honigman.com/the-matrix/ai-insurance-gap-what-it-means-for-technology-contracts. For the scope of the exclusions, the "arising out of" standard, and the breadth of the definition.
[3] PYMNTS, "Big Insurance Backs Away From AI Risk and Startups Rush In," 1 May 2026. https://www.pymnts.com/artificial-intelligence-2/2026/big-insurance-backs-away-from-ai-risk-and-startups-rush-in/. For the three carriers, the eighty percent approval rate, the states, and the January effective dates. PYMNTS attributes these figures to reporting by The Information. Find that report before quoting the eighty percent number in a board document.
[4] Fenwick & West, "The End of 'Silent AI'? Emerging AI Exclusions, Coverage Fragmentation, and Practical Implications for Policyholders," 15 June 2026. https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications. For silent AI, the fragmentation across lines, and the resulting gaps.
[5] Tooher-Ferraris Insurance Group, "AI Exclusions in Business Insurance: Is Your GL Policy Still Covering You?", 23 May 2026. https://toofer.com/blog/ai-exclusions-general-liability-insurance-2026/. For the October 2025 renewal observation. This is a brokerage and therefore an interested party. The point is directional and you should check your own policy, which is the advice either way.
[6] Pierluigi Matera, "Corporate Oversight in the Age of Artificial Intelligence," CLS Blue Sky Blog, 10 March 2026, summarizing "From Red Flags to Black Boxes: Corporate Oversight in the Age of Artificial Intelligence," SSRN 6161886. https://clsbluesky.law.columbia.edu/2026/03/10/corporate-oversight-in-the-age-of-artificial-intelligence/. Matera is Visiting Professor of Corporations at Boston University School of Law. Read directly for this revision. For the claim that AI does not alter the Caremark standard but changes the evidentiary terrain, for the procedural rather than technological framing, and for the explicit statement that the doctrine remains loyalty-based and does not become a negligence regime. See also Matera's summary at Oxford Business Law Blog, March 2026. Secondary coverage of the same paper appears in The D&O Diary, guest post, "AI Governance Is a Fiduciary Duty," 25 June 2026, https://www.dandodiary.com/2026/06/articles/artificial-intelligence/guest-post-ai-governance-is-a-fiduciary-duty/, which is also the source for the NIST framework's trajectory.
[7] Techné AI, "AI Governance and D&O Liability: What Every Board Needs to Know in 2026," 20 February 2026. https://insights.techne.ai/p/ai-governance-and-d-and-o-liability. For the framing that the claim is about board failure rather than system failure. Techné AI is an AI governance advisory firm and therefore an interested party. I have deliberately not quoted its adoption statistics, which are widely repeated and which I could not trace to an underlying survey.
[8] WTW, "Sarbanes Oxley and the AI governance gap: D&O insurance considerations," John M. Orr, 11 March 2026. https://www.wtwco.com/en-us/insights/2026/03/sarbanes-oxley-and-the-ai-governance-gap-d-and-o-insurance-considerations. For underwriters asking about AI maturity.
[9] Digital Applied, "The EU AI Act: What Actually Applies From August 2026," July 2026. https://www.digitalapplied.com/blog/eu-ai-act-august-2026-transparency-obligations-agency-checklist. For the 16 June vote, the deferral, Article 50 landing 2 August, the specific obligations, and the penalty figures.
[10] Gibson Dunn, "EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes," 27 May 2026. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/. Corroborating the deferral dates and confirming that 2 August 2026 remained active for Article 50, with a grace period to 2 December 2026 for machine-readable marking on systems already on the market.
[11] Insurance Journal, "Insurer Interest in AI Exclusions Growing as Risk Becomes Omnipresent," 22 July 2026. https://www.insurancejournal.com/news/national/2026/07/22/878480.htm. Verisk's own descriptions of the three endorsements.
One em dash survives in this file, inside the quoted title of source [10]. Changing it would misquote the source, so it stays.
Written by Joshua Shepherd, 3 August 2026. Revised 5 August 2026 after reading the Matera paper directly. AI helped me find and check sources. The reading is mine and the errors are mine. I build AI systems for organizations whose work runs on trust and I sell governance work, so weigh this accordingly. Nothing here is legal or insurance advice. Talk to your broker and your counsel.