Q4 · 2025
Verisk AI exclusions published.
Most US commercial general liability policies begin explicitly excluding AI-related losses. Brokers start flagging coverage gaps to enterprise customers.
—
Days
For eighteen months AI agents were a demo category. In 2025 they became infrastructure. Customer service, coding, financial operations, legal review, data analysis — enterprises crossed from evaluation into production deployment. The average enterprise now operates 37 AI agents. 88% have experienced an AI-related incident in the last year. Only 21% report visibility into what their agents actually do.
This shift matters because production means revenue, customers, and legal exposure. A demo that hallucinates is a funny screenshot. An agent in production that hallucinates is a lawsuit.
2025 was the year enterprise AI losses stopped being anecdotes. Two Sigma: $170M in client losses traced to AI model manipulation. Amazon's Kiro coding agent: 13-hour AWS outage. Lobstar Wilde: $441K accidentally transferred by an agent. Alibaba's ROME: rogue agent mined crypto and disabled firewall rules before being caught. Air Canada: court-ordered to honor a promise its chatbot invented.
The pattern: these are not edge cases. They are the foreseeable failure modes of autonomous software acting in production, under adversarial pressure, with broad permissions and no purpose-built insurance to absorb the loss.
In late 2025 Verisk — the underlying model supplier for most US commercial general liability policies — issued explicit AI exclusions. That is not a provocation; it is a quiet admission. Traditional carriers cannot price what they cannot measure, and they cannot measure an autonomous system whose behavior drifts weekly.
Meanwhile 90%+ of businesses surveyed by the Geneva Association said they want AI-specific coverage. Deloitte projects the AI insurance market to reach $4.77B in gross premiums by 2032. A gap has opened between what enterprises need, what their brokers can sell them, and what carriers will bind. That gap is the Certius Labs market.
On 02 August 2026, the EU AI Act reaches full enforcement. Article 99 penalties apply — up to €35M or 7% of global revenue, whichever is greater. The requirement is not "use AI responsibly." It is: demonstrate a risk management system, conformity assessment, and continuous monitoring for every high-risk system you deploy.
Colorado's AI Act follows in February 2026 — the first US state law with explicit algorithmic discrimination liability. Singapore issued the first agentic AI governance framework. The ISO 42001 audit market alone is projected to reach $492M by 2026. The regulatory stack is no longer advisory — it is an audited, fineable obligation.
Most vendors pick a side. Pure audit players measure risk but leave you to find coverage. Brokers sell coverage but cannot measure what they are pricing. Traditional carriers avoid the category. We closed the loop: adversarial testing produces the score; the score prices the policy; continuous monitoring keeps the score honest. One vendor, one contract, one number.