Making AI agents insurable

Insurers won't underwrite what they can't audit. Cyber and E&O carriers today are quietly excluding "autonomous agent operation." HATI restores insurability — for the buyer of policies, and for the underwriter writing them.

Why insurance got harder

The cyber-insurance market hardened twice in the last decade — once after ransomware industrialized, again after AI agents started taking actions with financial consequence. The problem from the carrier's seat: claims involving "the agent did it" have no defensible audit. Forensic investigators cannot determine which human authorized the action, what scope was granted, or whether controls were exercised. Underwriters cannot price what they cannot reconstruct.

Several major US and European cyber carriers have responded with new exclusion language. Coverage for "losses arising from autonomous AI agent operation outside documented human supervision" is now common in renewals.

What insurers want to see

The exclusions are not absolute — they are conditional on the buyer's controls. Carriers are receptive when shown:

• Verified human identity for every agent-authorizing principal (HATI Layer 1).
• Per-agent delegation tokens with documented scope, magnitude, and TTL (Layer 2).
• Tested kill switch with documented revocation latency.
• Tamper-evident audit log with the four anchors (identity, authority, action, audit).
• Annual tabletop exercises documenting the controls in action.

Insurers offering meaningfully better terms are conditioning them on these specifics. The premium difference is material — typically 15–30% for buyers who can demonstrate the controls.

The carrier opportunity

For carriers themselves, HATI primitives enable new product lines: agent-fleet liability coverage, AI E&O endorsements, parametric coverage triggered by audit-log events. The data needed to price these products is exactly the data HATI produces.

What the buyer should do

• Treat HATI as an insurance project, not just a compliance project.
• Engage your broker on the new exclusion language; understand which losses your existing policy now excludes.
• Demonstrate controls before renewal, not at the claim.
• Document the kill-switch test in writing the carrier will accept.

The math, briefly

For a $5M cyber policy with renewal, premium difference between "no documented HATI" and "full HATI controls" is typically $40–80K. The HATI deployment cost for a mid-sized enterprise is in the same range. The insurance saving alone often funds the project.

Common objections

The two pushbacks we hear from this vertical: integration risk — addressed by phased rollout starting with the audit trail (lowest risk, highest evidence-to-effort ratio), and internal politics — addressed by anchoring the project to a regulator deadline or a security-questionnaire deal-blocker, where the political question answers itself.

Frequently asked questions

What is the first integration to ship? The signed audit trail. It costs least, satisfies the most regulators, and produces the evidence everything else builds on. Every vertical we have integrated started here.

How does this affect end-customer experience? Invisibly, by design. The customer sees the same UI; the difference is in the audit log behind it. The latency added is single-digit milliseconds. The trust gain is structural.

What's the buying motion — security, compliance, or the line? Compliance writes the check; security signs off; the line of business sets the timeline. The strongest deals start with a regulator deadline; the next-strongest start with a deal-blocking security questionnaire.

Where to start

The first integration we recommend in this vertical: kill switch design, then audit trail design. Both are deployable inside a quarter; both produce regulator-grade evidence; both unblock procurement conversations the rest of the stack depends on.

Adjacent reading

For the regulatory ground truth in this vertical, see the Article 14 playbook. For the integration shape, see audit-trail design. For the buying motion, see the CISO compliance stack. Most successful pilots in this vertical follow that order: regulation first, integration second, procurement third.

The underwriter's actual question

Cyber and E&O underwriters are not asking "do you have AI agents." They are asking three increasingly specific questions on the questionnaire. Does every agent action carry a delegation traceable to a named human? Is the audit trail tamper-evident and exportable to the carrier on demand? Can the policyholder revoke an agent in under 200 ms with documented evidence of revocation? The vendors that answer yes to all three get quoted; the rest get declined for the agent-action rider.

The premium math follows. Underwriters in private conversations report 8–14% premium reductions when the audit trail is signed end-to-end, larger reductions on the agent-specific rider when multi-signature is enforced for critical-system actions. The economics of the controls regime is converging on "cheaper to install than to pay the loaded premium."

What underwriters reward in the policy form

Underwriters drafting policy forms for agent-driven business operations are converging on a small number of warranties the policyholder must make to qualify for preferred rates. The warranties name signed delegation chains, magnitude caps, audit-log retention, and human-upstream identification. Policyholders who can warrant all four receive double-digit premium discounts; policyholders who cannot warrant any of them face elevated rates or coverage exclusions. The warranties are not yet uniform across carriers but the convergence is visible in renewal cycles. Insurance brokers who follow the cycle are quietly steering risk-managed clients toward carriers with substrate-aligned warranties because the rate differential makes the broker case write itself. The substrate is therefore not just a compliance artifact; it is an insurance-eligibility artifact. The dual framing matters for the procurement case because risk and finance team leaders read insurance economics fluently in a way they sometimes do not read regulatory artifacts. The case lands either way; the insurance frame lands faster.

Underwriters can only price what they can audit. HATI is the audit they will accept.