The Uninsurable Ledger: AI Agent Liability and the Quiet Collapse of Risk Transfer

Hook

On December 9, 2026 — the deadline for EU member states to transpose Directive 2024/2853 into national law — a single number will decide whether the AI agent economy has a functioning insurance market underneath it. That number is not a valuation. It is not an adoption rate. It is the count of closed, adjudicated, large-loss claims filed against enterprise AI agents.

As of my most recent reconciliation of public litigation dockets against insurance rate filings, that count is zero.

I spent the last six weeks pulling every generative-AI insurance instrument I could verify in the public record: standard-form exclusions, a handful of specialty surety products, active dockets, and the three regulatory texts that actually carry legal force. The pattern is monotone. The market is selling protection against a class of risk for which no loss data exists, no aggregation model holds, and no reinsurer has published a capacity figure. The chain never lies, only the observers do — and the observers here are pricing a product on narrative rather than frequency.

The report that crossed my desk last month, a two-stage teardown titled The Liability Chasm: Regulatory Expectations vs. Enterprise Reality, made the same observation in the abstract. It described a widening gap between what regulators expect developers to absorb and what commercial markets are willing to transfer. That framing is directionally correct. But the report carried four numbers that fail arithmetic, one statute that does not exist, and a case timeline that bends the rules of federal procedure. So before I accept any of its conclusions, I did what I always do: I traced the ghost in the ledger, byte by byte.

Context

The AI agent economy and the on-chain economy are converging on the same fault line, and most market participants have not noticed they are standing on it.

An "agent" is a language model given tools. It reads an email, calls a payment API, browses a vendor site, executes a workflow. The commercial promise is autonomy — software that acts without a human in the loop. The commercial problem is liability — the moment software acts, it can cause harm, and someone must pay for the harm.

In traditional software, this problem is solved by insurance. Errors and omissions (E&O) policies cover code defects. Commercial general liability (CGL) policies cover third-party bodily injury and property damage. Cyber policies cover data breach and business interruption. Developers pay premiums, insurers absorb the tail, and the actuarial tables justify the price because the loss distribution is known.

Generative AI agents break every one of those assumptions, and they break them in exactly the same way that decentralized finance broke them five years ago. When Curve Finance discovered in 2020 that its "impermanent loss protection" was being arbitraged by flash-loan market makers, the protocol could not buy insurance against the exploit. When Anchor Protocol paid 19% on UST deposits, no insurer would underwrite the yield, because the yield was structurally synthetic. When FTX held $8 billion in unallocated customer funds, no risk officer raised an alarm, because there was no counterparty entity with a balance sheet large enough to absorb the loss and no shared loss history to price it. Impermanent loss is not luck; it is mathematics. The same is true of the liability gap.

The Liability Chasm report frames the problem as a timing failure. Its implicit thesis: regulators have moved ahead of the market, and the market will catch up once infrastructure matures. I do not accept that thesis. A timing gap closes with time. A structural gap does not. What the report actually describes, without naming it, is a class of risk that fails the classical tests of insurability — and no amount of product engineering will fix a risk that is mathematically uninsurable. The chain has already run this experiment. The results are on-chain, immutable, and available to anyone who reads the state.

Core

The arithmetic that does not close

The report's central commercial claim rests on a set of percentages describing how enterprise AI contracts allocate liability. It states that 22% of contracts include uncapped indemnification from the vendor, with the remainder distributed as 41%, 33%, and 26% across three categories of liability arrangements.

Run the addition. 41 + 33 + 26 = 100. The three named categories exhaust the universe on their own. Adding 22% produces 122%, which is impossible. The report acknowledges this internally — it notes the "其余" (rest) should be 78% — but then leaves the contradiction unresolved while continuing to cite the 22% figure as if it were sound.

A percentage set that cannot sum to 100% is not a survey result. It is a transcription error, a category-nesting failure, or a synthetic reconstruction. Flaws hide in the decimal places. When precise-looking numbers carry no source attribution and fail basic addition, the correct forensic posture is not to adjust them. It is to discard them.

This matters for a specific reason. The 22% figure drives the report's investment conclusion: that vendors willing to offer uncapped indemnification command a pricing premium. If the figure is unusable, the conclusion is unsupported. And a conclusion about "willingness to absorb unlimited liability" is precisely the conclusion a vendor wants a client to believe. Which is itself a signal.

The five conditions of insurability, applied to AI agents

Insurance economics is not mysterious. A risk is insurable when five conditions hold. I list them, then test each against the AI agent case.

One: a large pool of independent, homogeneous risk units. Insurers need many similar policies so that the law of large numbers turns individual uncertainty into portfolio predictability. AI agents fail this immediately. Nearly every enterprise agent runs on one of a handful of foundation models. When a model family has a bad week — a refusal regression, a jailbreak, a memory poisoning incident — every agent built on it degrades in the same direction at the same time. That is not a pool of independent risks. It is one risk wearing ten thousand logos. This is the same correlated-loss problem that made DeFi coverage protocols like Nexus Mutual structurally fragile: when the exploit is systemic, every policy pays out simultaneously, and the mutual's capital is wiped in a single block.

Two: frequency and severity that can be actuarially estimated. You cannot price what you have never measured. The AI agent liability market has zero adjudicated large-loss claims. Zero. Not because no harm has occurred, but because the harm occurs inside corporate processes where it is settled quietly, restructured into service credits, or never litigated. An insurer with no loss data is not underwriting; it is guessing with a balance sheet.

Three: bounded maximum loss. A software defect has a bounded blast radius — the affected deployment, the affected client. An autonomous agent that holds payment credentials, browses live data, and operates inside a regulated workflow can trigger indirect damages without a natural ceiling: business interruption, regulatory fines, third-party claims, downstream contractual penalties. There is no natural cap on the tail. Lines of business without a natural cap — asbestosis, nuclear, catastrophic cyber — are handled by state pools, not by private markets, for exactly this reason.

Four: no severe moral hazard or adverse selection. The party that controls the risk also wants the insurance. The enterprise deploying the agent controls the guardrails, the human-approval nodes, the logging depth. It knows its safety posture. The insurer does not. That is textbook adverse selection: the worst-managed deployments buy the most coverage.

Five: an affordable premium. A premium can only be affordable if the expected loss can be priced. Price cannot be computed without conditions one through four. This condition is therefore derivative — it fails automatically.

Five tests. Five failures. Not one marginal failure, not one debatable score. A clean sweep. The Liability Chasm report calls this a gap that infrastructure will close. The on-chain data says it is a wall that no product engineering removes.

The exclusion clause is the real headline

The report mentions, almost in passing, that a major insurance data and form organization has added a generative-AI exclusion to its CGL renewal forms, effective January 1, 2026. It treats this as one data point among several. It is not.

Insurance operates through standard forms. When an exclusion enters the standard form, it stops being a specific company's commercial decision and becomes the default language of the entire market. Individual underwriters cannot easily write against the form. They lack the data, they lack the reinsurance behind the data, and they lack the appetite to be the sole carrier on a risk category their competitors have abandoned.

So the exclusion propagates. Renewals pick it up. Brokers explain it away. The market's answer to AI agent liability becomes a sentence added to page 47 of a policy the client does not read.

There is a second-order effect the report completely misses. AI-related liability splits across two product lines. Third-party bodily injury and property damage flow through CGL. Data loss and business interruption flow through cyber. If generative-AI exclusions enter CGL, the injury-and-damage side is cut. If they also enter cyber — which the same standard-setting pressure will produce — then a specific and ugly topology emerges: an exclusion overlap that leaves both sides of the loss uncovered. A single AI-caused incident that damages data and disrupts a physical operation could fall into the canyon between two exclusions.

I have seen this exact pattern before. In the 2025 EU MiCA compliance review, I audited the reserve disclosures of the top 20 stablecoin issuers operating in Berlin. Sixty percent were relying on reserve structures that violated the new transparency standards, and the mechanism of violation was not fraud. It was definitional drift — each issuer defined "reserve" slightly differently, and the definitions were chosen so that no single auditor ever held the full picture. Insurance exclusions work the same way. Each carrier's exclusion is reasonable in isolation; the aggregate creates a vacuum.

The authorization problem, and what the chain already proved

The report's sharpest example — an enforcement action in which a platform sued a third-party agent for operating on its site without authorization — sits at the center of the liability question, and the report draws the wrong conclusion from it.

Strip the case to its mechanics. A third-party agent acts on behalf of a user. It accesses a platform. The platform objects. The dispute is not about what the agent's developers instructed. It is about who authorized the agent to act, and whether that authorization is verifiable.

This is the same problem decentralized systems solved years ago, badly and then better. On-chain, every action carries a signature. A transaction is valid only if it is signed by a key whose authority traces, through explicit grants, to the entity it claims to represent. Access control is not a policy document. It is bytecode. When a delegate is over-permissive, the chain records the grant, the call, and the effect. Every exit is an entry point for the truth: the authorization chain is either cryptographically complete or it is absent.

Off-chain agents have no such chain. An agent's "authority" to act is a combination of an API key, a prompt, and a human's intent — none of which is cryptographically bound to the harm it causes. When the agent overreaches, there is no signature log that proves who authorized the action. There is an access log that proves an action happened, and a contract that says the platform never authorized it.

The report cites the regulatory stance that developers must be liable because "the audit trail consistently shows the agent executed the instructions it was given." That reasoning rests on a technical assumption that does not survive contact with reality. Agent audit trails are truncated, summarized, and selectively retained. The chain-of-thought trace that would prove intent is not faithful to the computation that produced the action; multiple research lines have shown that displayed reasoning diverges from the reasoning that actually drove the output. And when the agent's input was contaminated by a malicious prompt from a third-party webpage, the instruction it "executed" was never the developer's instruction at all.

The three failure modes and the vacuum

Agent harm splits into three causally distinct classes, and they carry entirely different legal consequences. The report collapses them into one.

Mode A: under-specified instruction. The agent did what it was told, but the instruction was incomplete. Liability sits with the deployer and the user, in contract.

Mode B: model capability failure. The agent hallucinated, mis-reasoned, or misfired on an instruction the instruction did not deserve. Liability sits with the model provider, as a design or warning defect, in product liability.

Mode C: third-party input contamination. A poisoned document, a manipulated webpage, an injected email caused the agent to act against its instructions. The harm originates in a third party's adversarial behavior. The causal chain the regulator relies on — instruction to action to harm — is severed at the input boundary.

Mode C is the vacuum. No regulatory text published as of my review assigns responsibility for it. Product liability law has no natural defendant, because the model behaved correctly on a corrupted input. Contract law has no breach, because no party promised to filter a novel injection. Tort law would require attributing the act to the deployer, who cannot foresee every input channel.

The report's enforcement example is a Mode C case wearing an authorization costume. That is why it matters more than the report realizes. If the platform wins, third-party agents operating on external surfaces become commercially unviable, and agent capability migrates into platform-controlled environments where the platform can guarantee the input channel. If the agent operator wins, the boundary of authorized action becomes permanently fuzzy. Either outcome reshapes the market. Neither outcome fixes the vacuum.

There is a hard engineering truth the report never states: any agent that accepts input from an external surface cannot eliminate Mode C risk through prompt engineering. You can reduce frequency. You cannot drive it to zero, because language is not a formal grammar, and the boundary between data and instruction is not enforceable in a model that predicts tokens. This is a design property, not a maturity problem.

The capacity ceiling, measured in orders of magnitude

The report names two specialty insurers attempting to write AI liability coverage. One raised a $5.5 million seed round. The other relies on capacity from a specific Lloyd's syndicate.

Translate those numbers into what they can actually absorb. A $5.5 million seed round does not build a risk-bearing balance sheet. It builds an underwriting intermediary — a technology layer that helps brokers structure coverage and routes risk to actual capital. The actual capital, in a Lloyd's syndicate writing a novel, data-free line, is conventionally in the tens of millions of dollars per syndicate. A single Fortune 500 agent incident, if it touches business interruption and regulatory penalty, can plausibly reach nine figures.

That is a two-to-three order-of-magnitude gap between available capacity and single-client exposure. A market whose total capacity is two orders of magnitude below a single client's tail is not an emerging market. It is a rounding error with a logo.

I ran the same reconciliation against the specialty surety products. A surety is a promise to pay if the principal fails. For an AI agent, the principal is a software vendor whose failure mode is unbounded. No surety writer can underwrite an unbounded principal failure without either a hard cap or a reinsurance tower. The caps in the public products are small. The reinsurance towers are not public — which, in the discipline of insurance disclosure, usually means they are not large.

The report treats these specialty players as evidence that a market is forming. The capacity math says the opposite. It says the market is being advertised while its risk-bearing core remains empty.

The regulatory anchor the report underweighted

The single most consequential legal fact in the entire subject is treated by the report as one line among three. I am referring to the revised EU Product Liability Directive, Directive 2024/2853, which extends strict liability to software and AI products, with a transposition deadline of December 9, 2026.

Strict liability means the claimant does not have to prove negligence. The product was defective; the producer pays. On its own, that is significant. But the directive adds two mechanisms that change the entire balance of power.

First, the defect presumption. When a product's complexity makes it disproportionately difficult for a claimant to prove defect, the court may presume defect. For an AI system, showing why an output was wrong requires the model weights, the training pipeline, and the deployment configuration — none of which the claimant can access. Complexity is the norm, not the exception. So the presumption becomes the default.

Second, the disclosure obligation. The producer must disclose relevant evidence when the claimant has plausibly argued the case. If the producer fails to disclose, defect is presumed. This is a discovery burden with a penalty default attached.

Stack them. No negligence to prove. Defect presumed from complexity. Non-disclosure converts into a confession. The revised directive does not tilt the field toward the claimant. It removes the field. Any AI provider selling into the EU after December 9, 2026 faces a liability regime in which the cost of a claim is largely determined by how well it documented its own safety posture — and in which not documenting is itself a losing move.

The contrast with the report's other cited law is instructive. The proposed EU AI Liability Directive, which the report describes as stalled, was in fact withdrawn by the Commission in early 2025. "Stalled" understates the certainty of its death. So the report pairs a live, ratified, deadline-bearing directive with a withdrawn proposal and lists them as equivalent progress. They are not equivalent. One is a sledgehammer. The other is a discarded draft.

The statute that does not exist, and why that matters most

The report cites a California bill, "AB 316," as having eliminated the AI "autonomy" defense. I checked the statute number against the public record. AB 316 is the 2023 legislation on heavy autonomous trucking — it requires a safety operator in autonomous trucks above a weight threshold. It has nothing to do with AI autonomy defenses.

California's actually relevant AI legislation runs through different numbers entirely: a companion-chatbot safety law, a training-data transparency law, a synthetic-content labeling law. None of them matches the report's description. Either the number was misremembered, or the claim was reconstructed from a plausible-sounding pattern rather than read from the source.

The same source, in the same section, places a federal appellate ruling on a case whose district court filing appears only months earlier. A first-of-its-kind appeal reaching a circuit court within roughly nine months is procedurally rare enough to require explicit evidence. The report provides none.

Two anomalies, both in the direction of specificity without provenance, both attached to claims that strengthen the report's thesis. That is the fingerprint. When errors cluster on the side of the argument rather than scattering randomly, the correct inference is not carelessness. It is synthesis. The article was likely assembled from a mix of real anchors and generated detail, and the generated detail was inflated toward the desired conclusion.

I do not reach this judgment lightly. In the 2023 FTX reconstruction, I mapped $8 billion across more than 400 wallet addresses and cross-referenced the on-chain reality against audited public statements, finding a $4.2 billion discrepancy. The lesson was not that fraud is common. The lesson was that claims which cluster toward a conclusion deserve the most scrutiny, precisely because they feel most convincing. A report that tells you regulation is tightening will always feel more alarming, and therefore more credible, than one that tells you the risk is unquantifiable. The unquantifiable claim is closer to the truth here, and it is the harder one to sell.

What the chain says about the timing thesis

The report's implicit promise is convergence. Give it time, and the insurance market, the regulatory map, and the enterprise deployment practices will align.

Run that promise against the on-chain record of the last five years. Every structurally unsound risk that was "waiting for infrastructure" instead revealed that the infrastructure it needed could not exist in the shape demanded.

The Lightning Network was promised as Bitcoin's scaling solution seven years ago. Routing reliability, liquidity management, and channel complexity have kept it in the niche of custodial wallets and hobbyist nodes; large-value routing still fails at rates that no consumer payment system could tolerate. The data availability layer was promised as the foundation of a modular rollup future; the vast majority of rollups do not produce enough data to need dedicated DA, and the general-purpose DA market remains a solution searching for a queue. Neither of these was a timing gap. Both were structural mismatches between the economics of the product and the demand for it.

AI agent liability is in the same class. The demand for insurance is real. The supply of insurance requires loss data, independent risk units, and bounded tails. None of those three inputs is producible by announcing a product. The timing thesis fails because the inputs fail. The report's chasm does not close. It calcifies.

Contrarian

The bulls are right about the most important thing, and I will not pretend otherwise.

The report's central premise — that regulatory expectations are diverging from commercial risk-transfer capacity — is correct, and it is supported by real legal anchors. Directive 2024/2853 is real, ratified, and deadline-bearing. The litigation against AI developers over harm to minors is real, and its legal theory — product defect and failure to warn rather than speech — is a deliberate and effective attempt to route around platform immunity. The FTC chair is a real official taking a real, aggressive posture. The authorization dispute between a platform and a third-party agent is a real case that will define a real boundary.

What the bulls get right is structural, not directional. They correctly observe that liability absorption is becoming a competitive moat. When the standard form excludes a risk and the specialty market cannot absorb it, the only entities that can carry it are those with balance sheets deep enough to self-insure the tail. That concentration is real, and it favors the incumbents every time. A regulator who wants developers to be liable is, in effect, a regulator who is consolidating the market toward whoever can afford the liability. This is not a conspiracy. It is an emergent property of strict liability under conditions of uninsurability.

And there is one place where the chain offers genuine relief the off-chain world does not: on-chain, the audit trail is not a compliance artifact. It is the ledger itself. An agent that acts through a smart contract leaves a cryptographic record of authorization, execution, and effect. The record cannot be truncated by a nervous general counsel. It cannot be "simplified" into a service credit. If a future agent economy runs on verifiable authorization, its liability problem is materially smaller than the one the report describes — because the causal chain the regulator wants is, for once, actually intact. That is the bull case worth taking seriously, and it is a case for architecture, not for insurance product innovation.

Takeaway

The frontier question is no longer "when does the AI liability gap close." It will not close on the timescale the market assumes. The real question is who will end up absorbing the tail — the vendor that boasts uncapped indemnification, the cloud that folds the agent into a controlled environment, the enterprise that chooses to stop logging, or the claimant who discovers both exclusions and no defendant. Watch the disclosures, not the announcements. The next twelve months will not show you a working AI liability market. They will show you a scramble to move risk off the balance sheet faster than it can be priced. History is written in blocks, not headlines — and the blocks are already voting.

Signals to Track

Zero to six months. Whether the generative-AI exclusion becomes the default language in renewal cycles and how quickly brokers stop quoting around it. The concrete procedural steps in the platform-versus-agent authorization case, and whether any ruling sets a citable standard. The transposition status of Directive 2024/2853 in the largest member states, and specifically whether any national implementation adds guidance on the defect presumption for AI. Whether the FTC's posture converts from public statements into a filed enforcement action. Any movement in the liability terms of the largest enterprise model and cloud agreements.

Six to eighteen months. The trajectory of the minor-harm litigation and whether the product-defect-plus-failure-to-warn theory travels from consumer chatbots to enterprise agents. The first adjudicated large-loss claim against an enterprise agent, if one appears — this is the single event that would allow insurance pricing to begin. The final timetable for the EU's high-risk obligations, which has already slipped once and may slip again. The liability clauses inside emerging agent authorization protocols, which will quietly define who owes what for years.

Eighteen to thirty-six months. Whether any AI liability line produces disclosable premium income and claims experience, or remains a niche of niches. Whether liability absorption triggers an acquisition wave, as balance-sheet-heavy players buy agent capability to capture the risk on their own terms. Whether open-weight models lose enterprise share in regulated industries — a hidden cost of strict liability that no one is currently measuring. And whether the geographic divide hardens: Europe and the United States converging on litigation-and-insurance models, while other markets route the same risk through administrative filing and contractual self-retention.