An AI Chatbot Gave One Customer Bad Advice. Three New Insurance Forms Decided Whether the $42,000 Claim Was Covered.

8 min read · Last updated November 9, 2026

Starting with CGL policies that renewed on or after January 1, 2026, a standard commercial general liability policy can exclude bodily injury, property damage, and personal and advertising injury claims connected to generative AI through one or more of three ISO endorsements. This is the new AI liability coverage gap, and it applies whether the business built the AI tool itself or bought it from a vendor.

In this article

• What the AI liability coverage gap actually excludes
• Why a vendor’s AI tool doesn’t dodge the exclusion
• Whether other business insurance fills the gap
• What to check on your own renewal
• Frequently asked questions

Imagine a business owner named Desmond Achterberg, who runs a twelve-person marketing agency. His team built and still manages an AI-powered chat widget for a restaurant client. The widget told a customer the restaurant offered a loyalty discount it never had, the customer felt singled out and humiliated, and a $42,000 demand letter followed within weeks.

Desmond’s agency carries its own CGL policy, separate from the restaurant’s, because his agency built and operates the widget on the client’s behalf. That policy renewed in March 2026, carrying a form his broker had never flagged by number: CG 40 47.

What the AI liability coverage gap actually excludes

ISO’s parent company, Verisk, introduced three optional generative-AI exclusion endorsements for CGL policies, effective January 1, 2026. Insurance Business magazine, reporting on the filings, describes the broadest of the three plainly: “it removes coverage for bodily injury, property damage, and personal and advertising injury arising from generative AI.” That form is CG 40 47.

The other two forms narrow the cut. CG 40 48 “removes advertising injury only,” per the same reporting, leaving bodily injury and property damage coverage untouched. CG 35 08 targets a different coverage trigger entirely: products and completed operations, the part of a CGL policy that answers for harm caused by something the insured made or sold after it left their hands.

MoneyGeek’s review of the filings, citing Pillsbury attorneys writing in Policyholder Pulse, puts the trigger language in plain terms: the exclusion “requires only a causal connection to the excluded activity, not direct or sole causation.” A business does not need generative AI to be the only cause of a loss for the exclusion to apply. It only needs to be connected to it.

Form	What it removes	What it leaves untouched
CG 40 47	Bodily injury, property damage, and personal and advertising injury connected to generative AI	Claims with no generative-AI connection at all
CG 40 48	Personal and advertising injury connected to generative AI	Bodily injury and property damage
CG 35 08	Products and completed operations connected to generative AI	Ongoing-operations bodily injury and property damage

Neither Verisk nor ISO publishes the forms’ full filed text to the public, which is standard for ISO programs. The language above is drawn from trade-press reporting that reviewed the actual filings, the accepted workaround this site uses whenever an ISO form isn’t freely linkable.

Why a vendor’s AI tool doesn’t dodge the exclusion

A natural assumption is that the exclusion only reaches a business that built its own AI system, not one that simply bought a chatbot from a vendor. That distinction does not clearly exist in the exclusion language itself. A law firm review published on JD Supra states plainly that these exclusions can reach AI-generated content “regardless of whether the AI tool is developed in-house or obtained from a third-party.”

Desmond’s agency did not write the chatbot’s underlying model. It configured and deployed a vendor’s generative-AI product for its client. Nothing in the exclusion’s wording carves that distinction back out.

Whether other business insurance fills the gap

A business that loses CGL coverage for an AI-connected claim often assumes a cyber policy or a technology errors and omissions (tech E&O) policy already covers the difference. Neither reliably does.

MoneyGeek’s analysis is direct about the mismatch: cyber insurance “often responds to security or privacy breaches,” but claims over “AI hallucinations, defamation or intellectual property infringement from AI-generated content fall outside most cyber policies.” Technology errors and omissions coverage “is more likely to respond to AI-related mistakes,” but even that line of coverage was not built as a one-to-one replacement.

This is not the first time a small business has discovered its cyber policy carries narrower trigger language than the name suggests. A card-data assessment gap on the same cyber policies works the same way: breach-response coverage pays, but a related cost sitting just outside the named trigger does not.

Desmond’s own discrimination-style claim is a useful test case. It is not a data breach, so cyber coverage’s core trigger does not fit cleanly. It is not obviously a professional service failure either, which is tech E&O’s usual territory.

The claim sits in a gap between products that were each designed around a different kind of loss.

There is a second, quieter problem underneath the exclusion that most coverage reviews skip. Personal and advertising injury coverage, the part of a CGL policy a discrimination-style claim would normally reach for, only responds to a closed list of named offenses, things like defamation, wrongful eviction, or copyright infringement in an advertisement.

A customer who feels singled out by a chatbot’s bad advice is not obviously describing one of those named offenses at all. The claim may have never fit cleanly inside Coverage B in the first place, independent of whether the new AI exclusion applies to it.

That makes the exclusion’s practical bite narrower in some cases than its headline suggests, and wider in others. A claim that squarely matches an enumerated offense, like defamatory content an AI tool generated and published, is exactly what CG 40 47 or CG 40 48 was built to remove, while a claim that never matched the enumerated list to begin with was arguably uncovered before January 1, 2026 ever arrived.

What to check on your own renewal

The fix starts with the endorsement schedule, the list of forms attached to a policy, which most business owners never read past the first page. Ask a broker directly whether CG 40 47, CG 40 48, or CG 35 08 is attached, by number, rather than asking a general question about “AI coverage.” The same discipline already pays off on other CGL carve-outs, like the host liquor liability exclusion that quietly narrows coverage for businesses that only occasionally serve alcohol.

This is landing during a general-liability market that is still rising for small businesses, even as the increases shrink. General liability renewal rates rose 4.12% in the third quarter of 2026, down from 5.44% in the second quarter, according to the Ivans Index. A softening market makes this an easier year to negotiate the exclusion off a renewal, or price a standalone policy to cover what it removed, than a hardening one would.

The timing matters because the exclusion is still new. By mid-2026, a nationwide review of state filings counted 2,369 generative-AI exclusion records already in force across 49 states, a number that reflects how many policies already carry one of the three forms rather than how many states have formally approved the filings. Those two counts are not the same thing, and a business should not assume the absence of a state approval announcement means its own renewal is untouched.

Desmond’s broker eventually found CG 40 47 listed on page four of the endorsement schedule, a page he had never opened before the claim arrived. The agency’s next renewal added a standalone technology errors and omissions policy specifically to cover AI-connected claims the CGL policy no longer would, a fix that cost real premium but closed the gap the exclusion had opened.

Frequently asked questions

Does the AI exclusion apply if my business didn’t build the AI tool itself? Likely yes. The exclusion language groups the insured’s own AI use together with a vendor’s AI product under the same causal-connection trigger, and no source reviewed for this article describes a clean carve-out for a purchased or licensed AI tool versus an in-house one.

What is the real difference between CG 40 47 and CG 40 48? CG 40 47 is the broad version, removing bodily injury, property damage, and personal and advertising injury tied to generative AI. CG 40 48 is narrower, removing only personal and advertising injury, so bodily injury and property damage claims stay covered under that version.

Will a cyber insurance policy cover a generative AI liability claim instead? Not reliably. Cyber policies are built around security and privacy breaches, and claims over AI-generated defamation, hallucinated advice, or intellectual property infringement typically fall outside that trigger. A technology errors and omissions policy is a closer fit for an AI-related mistake, but neither is a direct substitute for the CGL coverage the exclusion removes.

How do I find out if my CGL policy already carries this exclusion? Ask your broker for the policy’s endorsement schedule and look for CG 40 47, CG 40 48, or CG 35 08 by form number. None of the three forms attach automatically, so adoption varies by carrier, state, and renewal date.

Is my business required to accept this exclusion at renewal? No. Adoption is the carrier’s choice, not a regulatory mandate, and it is negotiable. A business that uses AI tools in a customer-facing way has grounds to ask a broker whether the exclusion can be removed, or whether a standalone technology errors and omissions or AI-specific endorsement can replace what it takes away.