Five kinds of loss. Where cover begins and ends.

Indemnity for direct financial loss, to the insured or a third party, caused by factually incorrect, fabricated or unsupported output from an AI agent working inside an insured workflow, with defence costs where the output is cited as the proximate cause.

Scope. Contract errors, financial miscalculations, incorrect advice, fabricated citations, invented references in regulated filings.

Where it stops. Deliberate misuse, unapproved model substitutions, and output released without the human review the policy required.

Third party liability for the unauthorised disclosure of personal or commercially sensitive data by an AI agent, including prompt injection, training data exposure and cross tenant contamination in multi agent deployments.

Scope. Regulatory claims, data subject claims under Article 82 of the GDPR, notification costs, forensic investigation, and credit monitoring where the law requires it.

Where it stops. Leakage after a failure to apply a published vendor security patch, breaches that start outside the agent's perimeter, and known vulnerabilities left unresolved.

Liability for claims that AI-generated output infringes copyright, a trade mark, a design right or a database right. It matters most to operators whose agents produce customer-facing content, code, images or technical documentation.

Scope. Defence and indemnity for infringement claims, reasonable settlement and mitigation costs, and both direct and vicarious liability.

Where it stops. Reproduction of protected material on the operator's instruction, and models the operator knew were trained on unlicensed data.

Indemnity, where the law allows it, for administrative fines imposed under the AI Act and the GDPR, with legal defence throughout the regulatory process. Article 99 of the AI Act and Article 83 of the GDPR set the ceilings.

Scope. Supervisory investigations, notice of intent proceedings, defence counsel, technical expert witnesses and corrective action planning.

Where it stops. Intentional breach, any system prohibited under Article 5 of the AI Act, and fines the member state's law does not allow to be insured.

Cover for claims that arise when an AI agent, acting within its authorised scope, executes a transaction, a decision or an external action that causes loss. This is the core cover for operators whose agents act on customers, systems or markets, and the one the revised Product Liability Directive, Directive (EU) 2024/2853, brings closest.

Scope. Faulty transactions, misrouted instructions, autonomous commitments, errors in agent to agent contracting, and wrong approvals in automated workflows.

Where it stops. Actions outside the agent's certified scope, deployments without the audit records the schedule requires, and circumvention of approval gates.