A decision made by an employee leaves an audit trail. There are emails, an approval under a name, a job title defining their signing authority. If that decision later produces a claim, the insurer can trace it. An AI agent works nothing like that. It can read a prompt, query an internal database, call an outside tool, hand a task to another agent, and then issue a payment or a customer message. Reconstructing how it got there means pulling records from disconnected systems designed for other purposes.
Those reconstruction problems define a significant, unpriced risk for the insurance industry. According to an analysis from Underwriting the Agent Economy, as much as 90% of the industry's exposure to AI agent risk sits in what the market calls silent coverage - latent exposure inside cyber, D&O, general liability, and technology E&O policies written before agents existed. Once an AI-generated answer causes a loss, the argument shifts from whether the answer was wrong to whether anyone can prove what happened.
The missing claims file
Two legal cases offered early warning. In Moffatt v. Air Canada, a passenger relied on bereavement-fare advice from the airline's chatbot. The tribunal held Air Canada responsible because the chatbot was part of its website. Wolf River Electric's case against Google concerns an AI Overview that told searchers the Minnesota solar installer was being sued by the state attorney general. Wolf River says the error cost it contracts; Google denies it.
An AI agent that pulls data, changes systems, and passes work along creates a much longer chain to untangle. "A claims trail in pieces" is the problem, say analysts. The insurer needs the version of the model that was running at the time, the instructions given to the agent, and the info it pulled in. Companies hold pieces of this: prompts and outputs at the model platform, access records with the security team, approvals sitting in workflow software. No single system has produced a claims file.
It gets worse. By the time a claim is investigated, the model under review is likely several versions old. A new model has gone live, the system prompt has been edited, permissions have expanded, and routine retention rules will have cleared older logs. Regulators are pressing insurers on the same gap in their own AI use. The EU AI Act treats risk assessment and pricing systems in life and health insurance as high-risk, with requirements on logging and traceability. In the U.S., the National Association of Insurance Commissioners is piloting an AI Systems Evaluation Tool with a dozen states.
Pricing what nobody can see
The underwriter pricing that deployment before anything breaks is almost as blind. The information that would help is generated then thrown away. An employee rewrites a wrong answer before it reaches a customer. A permission check refuses an action. Correction rates climb after a model update and settle again. The business fixes each item and moves on - and the insurer prices the risk from a questionnaire.
"Underwriters are more confident about this than the companies they cover," the paper finds. Nearly half of the underwriters in the Lloyd's Market Association's AI loss scenarios survey think their policyholders manage AI risk adequately. Meanwhile, Deloitte's January survey on enterprise AI found only one business in five had mature governance for autonomous agents. A company that found and fixed a weakness can still expect tighter terms, more questions at renewal, or a higher premium for admitting it.
Insurance has met this pattern before. Nuclear insurers offer premium differentials up to 40% for engineering safety reports. Cyber insurers discount by as much as 25% when a policyholder can evidence its security posture. An AI agent deployment able to produce its operating record should be worth the same discount.
Where the record fails
A record only helps if someone can work through it. Claims files tend to hold the opening prompt and the final answer. Everything in between, where the failures happen, gets lost. A submissions process that summarizes or indexes the record before review carries the same flaw.
An AI agent that refuses a request at the first prompt will often agree by the tenth, according to the report's own testing. An insurer will want more than "the model did it" - and whether the business can actually show what's there at time of loss will be decided the day the agent goes live.
Why this matters for insurance pros
For claim handlers and loss control teams, this is an opportunity: the insurer that standardizes data extraction and prompt retention for clients leaves the field to the rest. For insurance professionals, including those deepening commercial lines knowledge through AI for Insurance discussions and data literacy investments, the pressure to price AI risk against a backdrop of missing information is the industry's core competence under address.
The one fix that makes sense is to treat AI agent deployment as engineered, audit-ready infrastructure, not as a chat widget. If generated logs get recorded, retained, and made easily reviewable, one small availability port for investigative claims disappears. That's the difference between a risk the market can price and a distribution chain nobody has yet seen all the way through.
Your membership also unlocks:
