If your AI prices or sells insurance, two regulators are watching.Founded by a software developer who runs an AI app.
We insure insurtechs that use AI in underwriting, pricing, claims or distribution, whether they are a licensed agency app, a managing general agent or a software vendor to insurers, with the E&O that fits which of those you are. The insurance regulator reaches vendors through the insurer’s contract.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O runs an app with an AI coach of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, owns and runs TrainRec, a fitness app with a built-in AI coach, and has placed insurance for AI apps. Insuring his own taught him how an underwriter reads a model. Personal guidance from an AI reads more like the work of a professional than like software, technology E&O forms commonly exclude bodily injury, and not every form will add it back. So whether your app answers money, health, hiring or farming questions, the gap between what it says and what the policy covers gets read by someone who has had to close it for his own product.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What insurtech businesses actually need.
Technology E&O for a vendor to insurers
Claims from an insurer customer that your model, data or workflow failed, was biased or could not be explained to a regulator, and cost them money.
Without it — The insurer’s contract usually asks you to indemnify it for a regulatory finding, and tech E&O may only pay what the law would make you owe. Check that promise against the policy before signing.
Professional liability
Covers the advice, the drawing, the diagnosis. The work itself, rather than someone getting hurt on your premises.
Without it — An app that sells or recommends insurance is doing an agent’s job, and an agent’s errors and omissions form answers the claim that it advised the wrong coverage and a loss went uninsured. Software forms may exclude insurance services.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — Applications hold health, driving, property and financial details, and claims files hold worse. Response costs, notification and privacy lawsuits sit under cyber, and a carrier customer will ask for a stated limit.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — A market conduct exam (an insurance department’s review of how a company treats customers) or a letter from a department can land on you directly if you hold a license or authority to quote and bind for an insurer. Check whether regulatory response is paid.
Crime & employee dishonesty
Theft by your own staff, funds transfer fraud, and the dishonesty bond a home care contract will ask you for by name.
Without it — Customer payments, claim payments and commissions pass through insurtech systems. Fraud and theft of that money is a crime claim, and tech E&O is not written for it.
What the regulators actually wrote down.
The NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by the NAIC Executive Committee and Plenary on December 4, 2023, and reminds insurers that decisions supported by AI systems must comply with insurance laws on unfair trade practices and unfair discrimination.
NAIC Model Bulletin, Use of Artificial Intelligence Systems by Insurers (adopted December 4, 2023) · checked 2026-11-01
The model bulletin is addressed to insurers, expects each one to maintain a written program for the responsible use of AI systems, and says its program should cover AI systems used in product development, marketing, underwriting, rating and pricing, claim administration and fraud detection, whether the insurer built them or a third-party vendor did.
NAIC Model Bulletin, Use of Artificial Intelligence Systems by Insurers (adopted December 4, 2023) · checked 2026-11-01
The model bulletin says an insurer’s program may include contract terms with third parties that give the insurer audit rights and require the third party to cooperate with regulatory inquiries, and says a regulator may ask for an insurer’s contracts with AI and data vendors, including terms on representations, warranties, data sourcing and cooperation with regulators.
NAIC Model Bulletin, Use of Artificial Intelligence Systems by Insurers (adopted December 4, 2023) · checked 2026-11-01
The NAIC’s implementation map, current as of April 1, 2026, lists 25 jurisdictions under adopted states (24 states and the District of Columbia, with Nebraska shown as an issued guidance document), and lists California, Colorado, New York and Texas separately as having insurance-specific regulation or guidance.
NAIC, Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (status as of April 1, 2026) · checked 2026-11-01
Colorado’s SB21-169, signed July 6, 2021, bars insurers from using external consumer data sources, algorithms or predictive models in ways that unfairly discriminate on listed protected bases, and directs the insurance commissioner to adopt rules requiring insurers to disclose their data sources and keep a risk management framework.
Colorado General Assembly, SB21-169, Protecting Consumers from Unfair Discrimination in Insurance Practices · checked 2026-11-01
Colorado Regulation 10-1-1 (3 CCR 702-10) took effect November 14, 2023 for life insurers, and says that when an insurer uses third-party vendors the insurer remains responsible for meeting every requirement, including producing whatever documents the Division asks for, while allowing the vendor to supply those documents to the Division directly on the insurer’s behalf.
Colorado Division of Insurance, Regulation 10-1-1, 3 CCR 702-10, Sections 5(B) and 10 · checked 2026-11-01
New York’s Insurance Circular Letter No. 7 (2024) tells insurers that they retain responsibility for understanding any AI systems or external data used in underwriting and pricing and may not rely solely on a third party’s claim of non-discrimination, and says they should have vendor standards and, where appropriate, contract terms giving audit rights and cooperation with regulators.
The NAIC’s Producer Licensing Model Act says a person shall not sell, solicit or negotiate insurance in a state unless licensed for that line of authority, defines “negotiate” to include offering advice directly to a purchaser about the benefits, terms or conditions of a particular contract, and bars paying a commission to a person who is required to be licensed and is not. States adopt their own versions, so the exact wording varies.
NAIC, Producer Licensing Model Act (#218), Sections 2(K), 2(M), 2(N), 3 and 13 · checked 2026-11-01
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Most common
A user is recommended the wrong coverage and a loss goes uninsured
Covered by Insurance agents professional liability (agent E&O)
It is an agent claim wearing a software costume. Tech E&O can exclude insurance services, and an unlicensed app has a worse problem than coverage, because selling without a license is itself the violation.
Common
A carrier customer says your pricing or underwriting model was unfairly discriminatory
Covered by Technology E&O, plus the carrier’s indemnity in your contract
The insurer faces the regulator and passes the cost to you. Policies can carve out contractual liability and regulatory fines, so a demand shaped like a regulatory finding may be only partly covered.
Common
A regulator asks for your model documentation through your carrier customer
Covered by Mostly no policy, unless it pays for regulatory response
The cost of assembling data lineage, validation and audit reports is time and counsel, and few small-company policies treat that as a covered claim until a suit appears.
Less common, severe
An AI claims tool denies or underpays a valid claim
Covered by Technology E&O for the vendor, the insurer’s own program for the insurer
The policyholder sues the insurer, and the insurer may turn to the vendor. Whether your policy answers depends on how tightly it defines claims from your customer and what it says about automated decisions.
Common
Policyholder data is breached
Covered by Cyber, first-party response and privacy liability
A carrier will often require a stated cyber limit before it connects to you. Know the limit and whether it includes regulatory defense before the contract asks.
What our insurtech clients ask us.
What will the underwriter ask an insurtech?
Whether you sell insurance, price it or sell software to those who do. Whether the AI decides or recommends, and whether a person signs off. Which states you are licensed in, which models and data you rely on, how you test for bias and drift, what your carrier contracts promise, your logs, your revenue and user count, and prior claims.
Which NAICS codes does this page cover?
Software and hosting codes are 513210 Software Publishers, 541511 Custom Computer Programming Services and 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. Insurance codes include 524210 Insurance Agencies and Brokerages, 524291 Claims Adjusting, 524292 Pharmacy Benefit Management and Other Third Party Administration of Insurance and Pension Funds, and 524298 All Other Insurance Related Activities.
What is the NAIC AI model bulletin?
A model the NAIC adopted on December 4, 2023 that states can issue to their insurers. It reminds them that decisions made or supported by AI must follow insurance laws on unfair trade practices and unfair discrimination, and expects a written AI program, including governance, testing and oversight of vendors. It is a model, so each state decides whether and how to issue it.
Does the NAIC bulletin apply to us if we only sell software to insurers?
It is addressed to insurers, not vendors. It reaches you through the insurer: the bulletin lets an insurer ask for audit rights and cooperation with regulators in your contract, and lets a regulator ask to see that contract. Expect your customers to pass those duties down. The guide goes through what to have ready.
How many states have adopted it?
The NAIC’s own map, current as of April 1, 2026, lists 25 jurisdictions as adopted, which is 24 states plus the District of Columbia, with Nebraska shown as a guidance document. California, Colorado, New York and Texas appear separately because they have their own insurance rules. States change, so check the map for the states you serve.
What does Colorado require?
Colorado’s SB21-169, signed July 6, 2021, bars insurers from using outside data, algorithms or predictive models in ways that unfairly discriminate, and directed rules requiring disclosure and a risk management framework. The rule, Regulation 10-1-1, took effect November 14, 2023 for life insurers and has since been amended. It keeps the insurer responsible for its vendors, who may deliver documents to the regulator on its behalf.
What did New York say about AI vendors?
In Insurance Circular Letter No. 7 of July 2024, New York told insurers that they remain responsible for any AI or outside data they use in underwriting and pricing, that they cannot rely only on a vendor’s promise of non-discrimination, and that vendor contracts should give audit rights and cooperation with regulators. A vendor selling into New York should expect those questions.
Does an app that recommends insurance need a license?
Generally, a person who sells, solicits or negotiates insurance must be licensed in the state, and the NAIC model defines negotiating to include advising a buyer about a particular contract’s terms. States adopt their own wording, so ask an insurance lawyer about each state. The practical insurance point is that a licensed agent app needs agents E&O, and an unlicensed one may not be insurable for the activity.
Tech E&O or agents E&O, which one do we need?
It depends on what you do. Sell or recommend coverage to the public and you are an agent, so agents E&O is the core policy. Sell models, data or workflow to insurers and you are a vendor, so tech E&O is. Many insurtechs do both, such as a managing general agent with its own platform, and need the two policies written to fit.
We act as a managing general agent. Does that change it?
Yes. If you underwrite or bind for an insurer under delegated authority, meaning the insurer lets you quote and bind on its behalf, the insurer will want its own E&O limit and proof of your controls, and the contract usually lets it audit you. Your AI underwriting tool is then the insurer’s regulatory problem and your contractual one. Share the carrier agreement with us before you answer an application.
Does the policy cover wrong AI output, or exclude it?
Read it, because some 2026 forms carry generative AI exclusions or limits, and your customers’ policies may too. Ask whether a model update, a vendor model you call, or an automated decision changes the answer, and ask for the wording in plain terms rather than a verbal assurance.
A carrier wants us to indemnify them for regulatory findings. Is that insurable?
Partly. Tech E&O often pays liability you would have under the law without the contract, and may carve out liability you assumed only by contract. Fines are often excluded outright. Send us the indemnity clause before you sign, so the promise and the policy match.
Our app was built with an AI coding tool. Does it matter to underwriters?
It changes the questions, not the liability. A carrier customer holding policyholder data will ask whether the code was reviewed and tested before launch, and your customer contract is with you. Answer the application as true on the day you sign.
Does contingent bodily injury matter to an insurtech?
Rarely. It covers an injury someone says came from relying on your output, which is the health and fitness app problem and the reason our flagship app page leads with it. An insurtech loses money, not bodies, unless it also gives safety or health advice. If it does, add it. The guide explains the grant.
We have policyholders outside the US. Does the insurance follow?
Not automatically. Many tech E&O policies only promise to defend claims brought in the US or Canada, and foreign insurance regulators are a separate matter from the NAIC. Tell the insurer where policyholders are before you launch.
What does fitness have to do with it?
Our founder owns a fitness app with an AI coach, and what he learned placing it carries over. An underwriter reads personal guidance more like a professional than like software, whatever the subject. The fitness page is where that argument is written out in full.
Where do the other AI app industries sit?
Finance, legal, hiring and health apps each have a different harm and a different policy fight. The hub lists every industry page.
Guides on insurtech.
- NAIC AI Model Bulletin for VendorsWho the NAIC AI model bulletin binds, how it still lands on a vendor through the insurer’s contract, which states have adopted it, what Colorado and New York add, and what to have ready before a carrier customer asks.
- Insurance for an App Launching WorldwideAn app store launch puts your app in front of users in dozens of countries on the first day. Your tech E&O may only defend claims filed in the US or Canada, and your cyber policy has to handle European privacy rules, where health and fitness readings are a special category of data.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.