When a chatbot misses a crisis, the claim is bodily injury and the law is new.Founded by a software developer who runs an AI app.
We insure therapy chatbots, mood trackers, AI journaling and teletherapy marketplaces with technology E&O that can address self-harm claims, plus cyber for the most sensitive data a user shares, and we read the state AI therapy laws alongside the policy.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O runs an app with an AI coach of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, owns and runs TrainRec, a fitness app with a built-in AI coach, and has placed insurance for AI apps. Insuring his own taught him how an underwriter reads a model. Personal guidance from an AI reads more like the work of a professional than like software, technology E&O forms commonly exclude bodily injury, and not every form will add it back. So whether your app answers money, health, hiring or farming questions, the gap between what it says and what the policy covers gets read by someone who has had to close it for his own product.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What mental health app businesses actually need.
Technology E&O with contingent bodily injury
Claims that your app’s response was wrong or missing, including injury or death after a user relied on it or after it failed to respond to a crisis, once contingent bodily injury is added.
Without it — Self-harm is bodily injury, which tech E&O forms exclude. Ask for the grant by name and read how the policy defines bodily injury, since some forms only mention emotional distress separately.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — What a user types to a therapy app is among the most sensitive data there is. Sharing it with an advertising or analytics tool without consent can be a reportable breach on its own, and the FTC’s BetterHelp order began exactly there.
Professional liability for clinicians you employ
Care given by licensed therapists your company employs or contracts, such as a teletherapy practice behind the app.
Without it — If real clinicians deliver care through your platform, their negligence is a malpractice claim, and the platform can be named alongside them.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — Read the professional services and health service exclusions before assuming a certificate means anything for a claim about advice given to a user.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — A state regulator, an attorney general or an investor asking how the product handles crisis is a management question, and D&O is the policy for it.
What the regulators actually wrote down.
Illinois Public Act 104-0054, the Wellness and Oversight for Psychological Resources Act, took effect on August 1, 2025 and bars any individual, corporation or entity from providing, advertising or offering therapy or psychotherapy services to the public in Illinois, including through Internet-based artificial intelligence, unless a licensed professional conducts them.
Illinois Public Act 104-0054 (HB 1806, Wellness and Oversight for Psychological Resources Act), enrolled text and bill status · checked 2026-11-01
Under the Illinois Act a licensed professional may not allow AI to make independent therapeutic decisions, directly interact with clients in therapeutic communication, generate treatment plans without review and approval, or detect emotions or mental states, and may use AI to assist with a recorded or transcribed session only after written notice and consent.
Illinois Public Act 104-0054 (HB 1806, Wellness and Oversight for Psychological Resources Act), enrolled text and bill status · checked 2026-11-01
The Illinois Department of Financial and Professional Regulation can assess a civil penalty of up to $10,000 per violation under the Act, after a hearing.
Illinois Public Act 104-0054 (HB 1806, Wellness and Oversight for Psychological Resources Act), enrolled text and bill status · checked 2026-11-01
Nevada AB 406 bars an AI provider from making available in Nevada an AI system specifically programmed to provide a service that would be the practice of professional mental or behavioral health care if a person provided it, and from representing that an AI system can provide such care or is a therapist, counselor, psychiatrist or doctor; violations carry a civil penalty of up to $15,000 per violation. These sections took effect July 1, 2025.
Nevada Assembly Bill 406 (83rd Session, 2025), enrolled text · checked 2026-11-01
Nevada AB 406 also bars a provider of mental or behavioral health care from using AI in connection with providing care directly to a patient, allows AI for administrative support such as scheduling, billing and notes, and requires the provider to independently review the accuracy of AI-generated reports and notes.
Nevada Assembly Bill 406 (83rd Session, 2025), enrolled text · checked 2026-11-01
Utah H.B. 452 regulates a “mental health chatbot,” defined as generative AI that engages in conversations similar to those with a licensed therapist and that the supplier represents, or a reasonable person would believe, can provide mental health therapy or help manage or treat mental health conditions. It took effect May 7, 2025.
Utah H.B. 452, Artificial Intelligence Amendments (2025 General Session), enrolled copy · checked 2026-11-01
Utah H.B. 452 bars a supplier from selling or sharing a Utah user’s individually identifiable health information or user input with a third party (with exceptions), requires clear disclosure that the chatbot is AI and not a human, restricts advertising inside the conversation, and lets the Division of Consumer Protection fine up to $2,500 per violation.
Utah H.B. 452, Artificial Intelligence Amendments (2025 General Session), enrolled copy · checked 2026-11-01
Utah H.B. 452 gives a supplier an affirmative defense in a licensing action if it created, maintained and filed with the Division a written policy covering, among other things, licensed therapist involvement in development and review, pre-release and regular testing, protocols to respond in real time to acute risk of physical harm, and putting user safety ahead of engagement metrics or profit.
Utah H.B. 452, Artificial Intelligence Amendments (2025 General Session), enrolled copy · checked 2026-11-01
The FTC announced on March 2, 2023 that BetterHelp would pay $7.8 million, used for partial consumer refunds, and alleged it shared consumers’ email addresses, IP addresses and health questionnaire information with Facebook, Snapchat, Criteo and Pinterest for advertising despite promising privacy; the Commission finalized the order on July 14, 2023.
Federal Trade Commission, FTC to Ban BetterHelp from Revealing Consumers’ Data (March 2, 2023) and final approval (July 14, 2023) · checked 2026-11-01
The FTC says makers of health apps, connected devices and similar products must comply with its Health Breach Notification Rule, and that a breach includes sharing users’ identifiable health information without their consent.
Federal Trade Commission, Complying with FTC’s Health Breach Notification Rule (business guidance), 16 CFR Part 318 · checked 2026-10-23
In Garcia v. Character Technologies the court held in an order filed May 21, 2025 that a Florida deceptive trade practices claim could proceed in part because the complaint alleged characters labeled “Psychologist” or “Therapist” purported to be licensed mental health professionals; the order assumes the complaint’s allegations are true at that stage.
Garcia v. Character Technologies, Inc., No. 6:24-cv-1903 (M.D. Fla.), Order on motions to dismiss, Doc. 115 (filed May 21, 2025) · checked 2026-11-01
On at least one major insurer’s technology E&O form, contingent bodily injury is not available as a carve-back to the bodily injury exclusion, so the coverage has to come from a market that offers it.
Kevin Kelsey, agency placement experience (technology E&O form, insurer not named) · checked 2026-10-29
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Less common, severe
A user in crisis relies on the chatbot, or gets no help from it, and is harmed
Covered by Technology E&O with contingent bodily injury
Tech E&O forms usually exclude bodily injury, and general liability often excludes professional or health services. A disclaimer helps the defense and does not stop the claim being filed.
Common
A state regulator says the app provides therapy it is not licensed to provide
Covered by Technology E&O or D&O, only if regulatory defense is included
Illinois, Nevada and Utah now regulate AI in therapy directly. A fine itself may be excluded, and the cost of answering the inquiry is what a form with regulatory defense would pay.
Common
User conversations or mood data are shared with advertisers
Covered by Cyber, first-party response and privacy liability
No hacker is needed for this one. The FTC announced a $7.8 million order against a teletherapy company over data sharing. Some cyber forms exclude claims from data you collected or shared unlawfully.
Less common, severe
A therapist matched through your marketplace harms a client
Covered by The therapist’s own malpractice policy, with your tech E&O or professional liability behind it
The therapist carries the malpractice. The marketplace can still be named for how it vetted, matched or supervised, and it should know which of its policies answers that.
What our mental health app clients ask us.
Does tech E&O cover a user who hurts themselves after using our app?
Often not, unless the policy says so. Technology E&O is written for financial loss and most forms exclude bodily injury, which includes self-harm and death. Contingent bodily injury is the grant that lets E&O answer an injury caused by your app’s output, and it is not on every form. Read the definition of bodily injury, the grant and any sublimit together.
Is a missed crisis or emotional harm counted as bodily injury?
It depends on the form, so read the definition. Many define bodily injury as injury, sickness or disease, and some add mental anguish or emotional distress separately. A claim involving self-injury or death is squarely what the exclusion is aimed at, while a claim for distress alone may be argued either way. Do not rely on a reading you have not seen in the wording.
What does the Illinois law on AI therapy require?
Public Act 104-0054, signed August 1, 2025, bars anyone from offering therapy or psychotherapy in Illinois, including through Internet-based AI, unless a licensed professional conducts it. A licensed professional cannot let AI make therapeutic decisions, talk to clients in therapy or detect emotions, and needs written consent for AI on recorded sessions. The state can fine up to $10,000 per violation.
What does Nevada AB 406 say about AI and mental health care?
In effect from July 1, 2025, it bars an AI provider from offering a system specifically programmed to provide what would be professional mental or behavioral health care, and from representing that an AI system can provide it or is a therapist, counselor or doctor. Civil penalties run up to $15,000 per violation. It also bars providers from using AI in direct patient care and requires them to review AI-generated notes.
What does Utah HB 452 require of a mental health chatbot?
It applies to generative AI that holds therapist-like conversations and that the supplier represents, or a reasonable person would believe, can provide or help manage mental health conditions. Since May 7, 2025 it requires disclosure that the user is talking to AI, limits advertising in the conversation and bars sharing user input with third parties. Fines run up to $2,500 per violation, and a filed safety policy gives an affirmative defense in a licensing action.
Do those laws mean we cannot offer a wellness or journaling feature?
Not by themselves. Nevada turns on representations and on a system specifically programmed to provide care a licensed person would give. Utah turns on what the supplier represents or a reasonable person would believe. How your app describes itself, and what its chatbot actually does, decides which side you are on, so the marketing copy is part of the risk. Have a lawyer read it against each state where you have users.
Are we regulated by the FTC if HIPAA does not apply?
Probably, for the data. The FTC’s Health Breach Notification Rule reaches health apps, and a breach includes sharing identifiable health information without consent. In 2023 the FTC announced a $7.8 million order against BetterHelp, alleging it shared email addresses, IP addresses and health questionnaire answers with advertising platforms despite promises of privacy. Your cyber policy should answer regulatory defense, not just hackers.
What will the underwriter ask a mental health app?
What the chatbot says and decides versus suggests, how it detects a crisis, and what happens next: a 988 or crisis-line referral, an escalation to a human, and who answers at night. Then which model sits underneath, whether chats are logged, age gates, user counts, revenue, states served, whether licensed clinicians review the content, how you describe the product in marketing, and prior incidents. A bot that gives personal guidance reads more like a professional than like software.
Our app only tracks mood and does journaling. Is it riskier than a wellness app?
It can be lower risk than a chatbot, since the app mostly records and does not respond. The risk returns the moment it replies with advice, an AI summary or a nudge, and the data question never goes away. Describe to the insurer exactly what the app says back to the user.
We run a teletherapy marketplace. Who carries what?
Each therapist carries their own malpractice insurance, and the platform needs tech E&O, cyber and, depending on how much it directs the care, professional liability of its own. A marketplace can still be named in a claim for how it screened, matched or supervised a therapist. Ask whether you require therapists to prove coverage and whether your policy responds when they do not have it.
Does the output of an AI model that says something wrong change the insurance picture?
Yes, because some forms limit or exclude claims from generative AI in endorsements you may not have read. Ask whether wrong AI output is covered in plain words, whether the grant for bodily injury reaches it, and how a hallucinated medical claim is treated. A court allowed a claim about therapist-labeled characters to go forward in Garcia v. Character Technologies, so what a bot says it is can matter.
Which NAICS codes does this page cover?
App and platform companies usually sit in 513210 Software Publishers, 541511 Custom Computer Programming Services or 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. If clinicians deliver care through the product, the operating company may fall under 621330 Offices of Mental Health Practitioners (except Physicians), 621112 Offices of Physicians, Mental Health Specialists or 621420 Outpatient Mental Health and Substance Abuse Centers. Use the code for what you earn revenue from.
We are a clinic that also built an app. Which page is ours?
If clinicians are the core of the business, start with the clinic page, which covers care delivery, abuse claims and licensing. The app then needs the tech and cyber coverage described here, and the two should be read together so neither policy points at the other.
How is this different from a fitness or wellness app?
A fitness app’s injury is a physical one from following a plan. Here the injury is self-harm or a missed crisis, state law now regulates what a therapy chatbot may do, and the data is more sensitive. The same contingent bodily injury grant is central, but a regulator can arrive before a plaintiff does.
We built it with AI coding tools. Does that matter?
It changes the questions more than the policy. Insurers ask who reviewed the code and the security settings before the app held sensitive conversations, and for a mental health product that review is the first thing a buyer asks.
We have users outside the US. Does our insurance follow?
Not automatically. Many tech E&O policies only promise to defend claims brought in the US or Canada, and health data from Europe is a special category under the GDPR. Check where claims may be brought and which states you serve before launch.
Where can I see the other industries you insure AI apps for?
The hub lists the AI app pages by industry. Each explains the claim that industry produces and the policy that is supposed to answer it.
Guides on mental health app.
- Bodily Injury vs Contingent Bodily InjuryGeneral liability pays for injuries you cause by accident, and E&O pays for money lost to your mistakes. An injury caused by a mistake in your app, software or advice falls between them, and contingent bodily injury on the E&O is how that gap is closed.
- Insurance for an App Launching WorldwideAn app store launch puts your app in front of users in dozens of countries on the first day. Your tech E&O may only defend claims filed in the US or Canada, and your cyber policy has to handle European privacy rules, where health and fitness readings are a special category of data.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
- AI Medical Scribe LiabilityAn AI scribe drafts the note and the clinician signs it. Here is who the medical boards and state laws hold responsible, how recording consent and a HIPAA agreement fit in, and what the practice’s malpractice policy and the vendor’s tech E&O each answer.
- Companion Chatbot LawsuitsWhat the Garcia ruling and the Raine complaint say, described strictly as holdings and allegations, followed by how product framing, the bodily injury exclusion, contingent bodily injury, abuse exclusions, minors and the duty to defend work for a companion or chatbot app.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.