Last updated: July 2026 - carrier adoption and state counts reviewed quarterly.
You remember silent cyber.
For years, commercial policies said nothing about cyber risk. No coverage grant, no exclusion, just silence. Everyone treated the question as academic until the claims landed, the courts weighed in, and carriers realized they had been covering an exposure they never priced. You know how that story ended, because you lived it: exclusions on everything, affirmative cyber coverage sold separately, and years of renewal conversations explaining to clients why the policy they'd always had didn't do what they assumed.
The same story just started again. This time the word is AI.
And this time there's a twist, because you're not just the advisor explaining the exclusion. You're also an insured whose own shop runs on the very technology being excluded.
This page breaks down exactly what changed, what each endorsement removes, what to tell your clients, and how to close the exposure inside your own walls. Bookmark it - carrier adoption is moving quickly, and I'll keep the details current as the market settles.
What is the ISO generative AI exclusion?
Effective January 1, 2026, ISO - the Verisk-owned organization that writes the standardized policy language most carriers build on - released three optional endorsements that let carriers explicitly exclude generative AI losses from standard Commercial General Liability (CGL) policies. The Big "I" flagged the rollout when Verisk announced it (IndependentAgent.com, Oct 2025).
In plain terms: where AI was silent on the CGL form, it can now be explicitly shut off. The endorsements define generative AI broadly - systems that generate text, images, audio, video, or code. That definition covers ChatGPT, Claude, Copilot, Gemini, and the AI features quietly embedded in the software your clients already use.
The three endorsements, in plain English
| Endorsement | What it excludes | Where it applies |
|---|---|---|
| CG 40 47 | Bodily injury, property damage, AND personal and advertising injury arising out of generative AI | Coverage A and Coverage B - the broad form |
| CG 40 48 | Personal and advertising injury only | Coverage B only - the narrower option |
| CG 35 08 | Bodily injury and property damage arising out of generative AI | Products/Completed Operations coverage part |
A quick translation for the renewal conversation. CG 40 47 is the full shutoff. CG 40 48 targets the coverage part where AI-generated content bites hardest - defamation, copyright infringement, misappropriation from AI-created marketing and communications - while preserving bodily injury and property damage coverage. CG 35 08 follows the exposure downstream into delivered products, which matters for any client embedding AI in what they sell.
Is the exclusion mandatory? Will it show up on renewals?
These are optional endorsements, not automatic changes to every ISO-based policy. No client should assume they have the exclusion, and no client should assume they don't. The only answer is on the endorsement schedule.
But the adoption curve is steep. Within weeks of release, carriers including W.R. Berkley, Chubb, Travelers, Berkshire Hathaway, and Cincinnati Financial had filed to adopt these endorsements or proprietary AI exclusion language of their own, and state regulators approved more than 80% of the filings (actuary.info, May 2026). Gallagher is already alerting commercial clients that the exclusion is appearing on CGL policies at renewal (Gallagher, 2026).
Because adoption is carrier by carrier and state by state, no two CGL renewals will treat AI identically this year. That inconsistency is a burden if you're unprepared. It's a differentiator if you're the agent who reads the schedule.
"Arising out of": the three words doing all the work
The endorsements trigger on losses "arising out of" generative AI. If that phrase makes you sit up, it should. Under established insurance law, "arising out of" is one of the broadest causal connectors available in policy drafting. It doesn't require AI to be the proximate cause of a loss. It requires a causal connection.
So the question in a claim isn't "did AI cause this?" It's "was AI anywhere in the chain?" A contractor's estimate built with an AI assistant. A marketing agency's campaign drafted with ChatGPT. A manufacturer's product manual generated by Copilot. If a loss traces back through any of it, the carrier holding one of these endorsements has an argument.
Your clients are not thinking about this. Most of them don't know which of their everyday tools quietly added AI features in the last two years. Which brings us to the conversation that wins accounts.
The client conversation: a renewal talk track
Here's a simple structure for getting ahead of this on every commercial renewal, and it takes five minutes:
Ask what they're using. "Before we review the renewal, quick question - where is your team using AI right now? Marketing? Estimates? Customer service? Anything built into your software?" Most clients will name two or three uses and miss five more. That's fine. You've opened the file.
Check the schedule together. Pull the renewal's endorsement schedule and look for CG 40 47, CG 40 48, CG 35 08, or carrier-proprietary AI exclusion language. Show them what's there or confirm what isn't. Either way, you've just done something their last agent never did.
Document the conversation. A dated note that you raised AI exposure, reviewed the forms, and discussed options. You know why.
Present the options. Depending on the market and the account: negotiating the endorsement, restructuring the risk, or exploring the emerging market of affirmative AI coverage and write-back endorsements that carriers are beginning to offer to fill the gap. Availability varies widely right now - which is exactly why the account needs an agent watching it.
When you run this play consistently, the AI exclusion stops being a threat and becomes the reason a prospect moves their book to you. Somewhere in your town there's a commercial account whose current agent will let this renewal pass without a word about it.
The part nobody's writing about: your agency's own E&O exposure
Now the harder conversation.
Think back to how cyber exclusions played out. When coverage gaps appeared and losses landed, the litigation didn't stop at the carrier. It found the agent. Failure to advise on a known, publicized exclusion is a classic errors and omissions fact pattern, and everything about the current moment - trade press coverage, association alerts, carrier filings - is building the paper trail that makes "we didn't know" impossible to argue in 2027.
The exposure runs in a second direction too, and this one is inside your walls. Your own team is using AI on client work right now. The Big "I" Agents Council for Technology's 2026 Tech Trends Report says 38% of agencies are very likely and another 30% somewhat likely to expand AI use this year - while 55% have no written AI use policy, 23% have one in development, and only 13% have a formal policy in place (Big "I" ACT, February 2026).
Read those numbers side by side. The industry is drawing hard liability lines around AI at the exact moment most agencies can't answer a basic question about their own operations: who is using AI, on what work, with what client data, under what rules?
You'd never let a client run that risk unexamined. Your shop deserves the same standard of advice you give.
Regulators moved before the carriers did
If the exclusions feel sudden, the groundwork wasn't. The NAIC adopted its Model Bulletin on the Use of AI Systems by Insurers in 2023, and as of the Spring 2026 National Meeting, 24 states plus D.C. have adopted it, with four states adding their own insurance-specific AI regulation (Mayer Brown, April 2026). The bulletin is principle-based, but the principles all point the same way: governance, accountability, documentation, oversight of third-party tools.
Carriers excluding on one side, regulators demanding documentation on the other. The defensible position in the middle is a governed operation with its AI use inventoried, written down, and owned.
How to close your own gap in three moves
I've stood in front of enough teams now to tell you the two instinctive responses, and both fail. Banning AI doesn't stop usage; it just drives it underground where you can't see it, govern it, or defend it. Ignoring it leaves you with the 55%. The working answer is governed use, and it comes in three moves, in order.
1. Illuminate the shadow. Before writing any policy document, find out what's actually happening. Survey your team with amnesty, not accusation: which tools, which tasks, which data.
Not long ago I ran a two-day AI training in Philadelphia for a company of fifty-some employees. Early on the first morning, we went around the room: who's using AI, and which tools? Hand after hand went up. Different LLMs, personal accounts, free tiers - all of it on company work. I watched the CEO and the CFO exchange a look I can only describe as flabbergasted. They had no idea. Not because their people were hiding anything, but because no one had ever asked.
By the time we walked through how to address shadow AI directly - the risks of non-compliance spelled out for every person in the room, a step-by-step plan laid out in front of them - those same two faces were smiling and nodding. Same company, same exposure, same afternoon. The only thing that changed was that now there was a plan.
That's the whole move. You cannot govern what you can't see, and the honest inventory almost always surprises the principal.
2. Put it in writing. A written AI use policy is the artifact that separates a defensible position from an exposed one. It doesn't need forty pages. It needs to name the approved tools, draw a bright line on client data, require human review of AI-assisted work product, and assign ownership to a person. The Big "I" ACT publishes acceptable-use templates as a starting point; the point is to have something signed and dated before renewal season, not something perfect.
3. Move client work to commercial-grade tools. Consumer AI accounts can retain and train on what your team types into them. Commercial and enterprise tiers are built not to. When client data is involved, the account tier is the difference between a managed risk and a discoverable one.
Three moves. None of them require a technologist on staff, and the first one costs nothing but honesty.
You already know how to do this
Here's what I want you to take away from all of it. Explaining exclusions, closing coverage gaps, documenting advice - this is your craft. You've done it through the cyber wave, the EPLI wave, and every hard market before this one. AI governance isn't a new discipline for you; it's the discipline you already have, pointed at your own shop first and your clients second.
The agents who treat CG 40 47 as a nuisance will spend 2027 in uncomfortable claim conversations. The agents who treat it as the opening line of a better renewal conversation are going to grow. When you've inventoried your own AI use, put your policy in writing, and walked your top twenty commercial accounts through their endorsement schedules, you won't just be protected. You'll be the most credible voice on AI in every room you're in - because you did the work before you recommended it.
If you want the framework I use to take agencies from shadow AI to a signed, defensible policy, grab the Shadow AI Governance Launchpad. And if this page helped, send it to one agency principal who hasn't looked at their own endorsement schedule yet.
Frequently asked questions
Is generative AI now excluded on all CGL policies?
No. CG 40 47, CG 40 48, and CG 35 08 are optional endorsements that carriers choose to attach. Adoption is spreading quickly, but the only way to know whether a specific policy carries the exclusion is to read the endorsement schedule.
What's the difference between CG 40 47 and CG 40 48?
CG 40 47 is the broad form, excluding bodily injury, property damage, and personal and advertising injury arising out of generative AI across Coverage A and Coverage B. CG 40 48 excludes only Coverage B - personal and advertising injury - leaving bodily injury and property damage coverage intact.
Does the exclusion apply if my client didn't know a tool used AI?
The endorsements trigger on losses "arising out of" generative AI, one of the broadest causal phrases in policy drafting. Knowledge and intent aren't the test; causal connection is. That's exactly why an AI-use inventory belongs in your renewal process.
Can clients buy back the coverage?
An affirmative AI coverage market is emerging, including write-back endorsements and standalone products, but availability, terms, and pricing vary widely by carrier and state right now. This is an active conversation to have market by market.
Does this affect my agency's own E&O policy?
Watch this space carefully. AI-specific exclusions are already spreading beyond CGL into professional liability lines, and separately, failing to advise clients about a known exclusion is itself a potential E&O exposure. Both directions matter.
What should an agency do first?
Inventory your own AI use, adopt a written AI use policy, and move client work onto commercial-grade AI accounts - then take the same conversation to your commercial clients at renewal.
