AI Exposes Gaps in E&O Coverage

The Breakdown of Legacy Tech E&O

The P&C industry has long relied on tech E&O for risk mitigation when it comes to digital services. But these legacy policy forms were largely built for a software era where human error was the main culprit. There was a relatively clear trail of accountability, and a failure typically meant a system crash or a coding bug.

Today, we see autonomous agents making decisions that result in financial loss. Dynamic, self-learning algorithms are making questions of liability much more complex. New rules are being written seemingly in real time.

Take the Air Canada example – perhaps one of the highest-profile instances of AI E&O. Back in 2024, the airline’s chatbot hallucinated a policy offering retroactive bereavement refunds. When the passenger tried to claim the refund, Air Canada refused, arguing that the chatbot was a separate legal entity, responsible for its own actions.

A Canadian tribunal rejected this defense, saying that a company is responsible for all information on its website – whether it is delivered by a web page, or an automated agent. “The AI said it” was not a legal defense.

There has been a distinct rise in grey-zone liabilities like this – risks that don’t fit neatly into the buckets of a standard data breach or a traditional professional error. Consider issues such as algorithmic bias, data poisoning, and technology-driven discrimination. These risks often fall in the cracks between cyber exclusions and professional liability triggers.

For brokers and insured businesses, this gap creates dangerous exposure to a new class of litigation where policy language simply hasn’t kept pace with technology.

Same Regulations, New Litigation

The idea of “cyber risk” itself is evolving thanks to the impact of AI. Where it was largely about data privacy in the past, businesses today also need to think about algorithmic accountability.

One of the most striking examples is how the Americans with Disabilities Act (ADA) is being used as a tool for technology litigation. For example, if an AI-driven hiring tool or a financial services algorithm inadvertently discriminates against a protected group, the resulting legal challenge can be seen as a violation of professional standards and statutory law.

Workday came up against this in 2025, facing a massive class-action lawsuit (Mobley v. Workday) that alleged its AI-based screening tools discriminated against applicants based on race, age, and disability.

This case showed that blaming a technical glitch isn’t legally defensible. When technology begins to make decisions that affect human rights and equity, an error is ultimately a failure of governance – it’s people that are ultimately liable.

Traditional E&O policies often focus on language such as “failure of technology to perform.” This wording doesn’t handle socially-driven technical failures.

From Risk Transfer to Integrated Resilience