Does tech E&O cover an AI product that mishandles personal or patient data?
It covers part of it, and the part depends on the form. A technology E&O policy answers a client’s financial loss when your product failed to perform, which includes an AI feature that gave wrong output. It does not answer a breach of the personal or health data flowing through that feature; that is cyber and privacy liability, and for health data it turns on whether a business associate agreement covered every model in the chain. A 2026 renewal can carry an AI exclusion on any of the three. An AI vendor handling PII or PHI needs tech E&O, cyber and privacy liability on one form or three that agree, each with affirmative AI wording, at the limits its enterprise customers name.
Tech E&O, placed for AI vendors.
The combined tech E&O and cyber form, the limits enterprise customers ask for, and the AI wording to insist on.
Tech E&O, placed for AI vendorsSend us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
The detail
Coalition added an affirmative AI endorsement to its cyber policies clarifying that a covered loss caused by an autonomous AI model is covered the same as one caused by a human, and expanded affirmative AI coverage on miscellaneous professional and technology E&O in November 2025.
Coalition, "Coalition adds new affirmative AI endorsement to cyber policies"
AIUC, a San Francisco managing general agent, offers up to $50,000,000 of product liability coverage for AI vendors and their customers against losses from AI agent failures, on Beazley paper as of May 2026, underwritten on a technical certification.
The Insurer, "AI insurance MGA AIUC secures Beazley paper for liability product"
Armilla’s standalone AI liability policy, underwritten by Chaucer and others at Lloyd’s, addresses hallucinations, degrading model performance and algorithmic failure with published limits up to $25,000,000 per organization.
Reinsurance News, "Chaucer and Armilla launch new AI liability insurance product"
Amazon Bedrock is on the AWS HIPAA-eligible services list as of February 2026 and one AWS BAA covers every model reached through it; Azure OpenAI is covered under Microsoft’s DPA; Anthropic and Google sign BAAs for their API and cloud tiers and not for consumer plans.
W.R. Berkley filed an absolute AI exclusion for D&O, E&O and fiduciary liability covering any actual or alleged use of AI.
Policyholder Pulse, "AI exclusions in insurance policies: broad language, uncertain impact"
Cyber insurance for professional services and healthcare businesses typically costs $2,500 to $5,000 a year for $1,000,000 of limit in 2026.
Christensen Group, "How much does cyber insurance cost for a small business in 2026?"
What this means for you
- Three policies, one incident.An AI feature that leaks a customer’s records has failed to perform (tech E&O), exposed data (cyber), and disclosed personal information (privacy liability). Written by one carrier on a combined form, the claim is paid once. Written by three carriers who have each added different AI wording, it is argued three times first.
- PII and PHI are different laws with the same exposure.Personal information is governed by state privacy statutes, several of which now carry private rights of action with statutory damages. Protected health information is governed by HIPAA, which makes your product a business associate of every healthcare customer and requires a BAA with each of them and with the model provider behind you.
- The model provider’s BAA is part of your product.A vendor that calls a frontier model through a consumer key has no BAA upstream and cannot honestly sign one downstream. Bedrock, Azure OpenAI, Vertex AI, the Claude API and ChatGPT for Healthcare are the routes that carry one; a hospital’s procurement team will ask which you use.
- Enterprise customers now ask for AI cover by name.The certificate a bank, a hospital or a platform wants in 2026 says tech E&O and cyber at $2,000,000 to $5,000,000, and increasingly asks whether AI is covered affirmatively. A policy that is silent on AI answers a question they have stopped asking, and one with a Berkley-style exclusion answers it the wrong way.
Related questions
- What is PII insurance?
There is no policy by that name; the cover people mean is privacy liability, sold inside cyber or beside it. It answers claims that your business collected, stored, used or disclosed personally identifiable information wrongly, whether or not there was a hack, and includes regulatory defense and, where insurable, penalties. An AI product that trains on customer data, retains prompts or surfaces one customer’s information to another produces exactly this claim, and the form has to say AI is covered.
- Privacy liability, in full
- We are an AI vendor. Which policies will an enterprise customer require?
Technology E&O and cyber, usually on one combined form, at $2,000,000 to $5,000,000, with privacy liability wording included and the customer named where the form allows. Healthcare and financial customers add a BAA or a data-processing agreement and ask about the models in your chain. Vendors whose agents act inside customer systems are increasingly asked for AI-specific coverage, which is what AIUC’s $50,000,000 product on Beazley paper and Armilla’s $25,000,000 standalone policy exist to answer.
- AI liability insurance, and who writes it
- Our AI feature gave a customer bad output and they lost money. Which policy pays?
Tech E&O, if the form covers AI output. Failure to perform is its core grant and wrong output from an AI feature is a failure to perform; the only question since 2026 is whether the policy carries an AI exclusion. If the same incident exposed data, cyber responds to that half. Tell both carriers on day one. A claim reported to the wrong policy first is delayed, and one reported to neither can be denied for late notice.
- What tech E&O covers
- Does our tech E&O or cyber policy require a BAA to be in place?
The policy does not require it, HIPAA does, and the policy responds to what HIPAA does to you. A breach of PHI handled without a BAA is a violation the business caused rather than suffered, and forms that exclude knowing or willful violations can decline the penalty even where they pay the response costs. Some carriers now ask on the application whether every AI model in the product is under a BAA, and answer the question as carefully as you would a security questionnaire.
- Which model providers sign a BAA
- What does tech E&O and cyber cost for an AI startup?
A combined tech E&O and cyber policy at $1,000,000 for a small software company runs roughly $2,000 to $10,000 a year, and healthcare or financial data pushes it toward the top of that range and above. The affirmative AI endorsement is usually a modest addition. Limits of $2,000,000 to $5,000,000, which is what enterprise customers ask for, are placed with a primary carrier that writes the limit or an excess layer above the best primary, and the online platforms stop well short of them.
- How $10M cyber and $5M tech E&O get placed
Need this handled?
Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.
Written by the licensed brokers at Boring Insurance. Last updated 2026-09-24. See all guides.