Insuring AI agents: what underwriters will demand before pricing your agent

Published August 7, 2026 · Last reviewed August 7, 2026

For most of the last two years, “who pays when an AI agent causes harm?” was a conference question. In 2026 it became a policy you can buy. The Artificial Intelligence Underwriting Company, founded by Rajiv Dattani and seeded with fifteen million dollars backed by Nat Friedman in 2025, authored a certification standard for AI agents and sells the insurance that certification enables.¹ On 11 February 2026 the voice-AI company ElevenLabs became its first policyholder, with agentic products backed by a fifty-million-dollar policy written with capacity from the Lloyd’s of London market.²

That is a real market forming, and it moves the interesting question from “will agents ever be insurable?” to a sharper one: what does an underwriter have to verify before it prices your agent at all? Insurance is the most honest test of a trust claim there is, because someone has to put money behind it. So the requirements underwriters converge on are a useful preview of what the whole agentic web will end up demanding.

This piece maps the agent-insurance stack as it exists in 2026, then names the input it is still missing. The short version: today’s certifications measure an agent system’s controls at a moment in time, and underwriting a risk over time needs something certifications do not carry, the verifiable identity of the operator and a track record of how a specific agent has actually behaved.

AI agent insurance is already being written

The ElevenLabs policy is worth reading closely, because the numbers describe how much scrutiny it took to write. Before the coverage was bound, ElevenLabs’ systems went through 5,835 individual technical evaluations, including adversarial jailbreaks, unauthorized tool calls, and voice-identity hijacking attempts.² The policy that resulted covers agentic products a customer of ElevenLabs uses, up to fifty million dollars, and the risk sits with the Lloyd’s market rather than a startup balance sheet. These figures are reported by AIUC and ElevenLabs, so read them as vendor-stated, but the structure is the point: a named limit, real carrier capacity, and a documented evaluation behind it.

AIUC’s own business model tells you where the leverage sits. The company authors the framework, runs the technical evaluations, issues the certificates, and sells the insurance the certification unlocks.¹ Worth being precise about what “sells” means here: AIUC operates as a managing general agent, underwriting on delegated authority rather than carrying the risk itself, and by May 2026 it had secured paper from Beazley for its liability product.³ The capital belongs to carriers; the judgment about who is insurable belongs to AIUC. In other words, the certificate is not a compliance badge that lives off to the side. It is the underwriting file. Pass the evaluations and a carrier is willing to price the risk; fail them and there is nothing to price.

AIUC is also no longer alone. Chaucer and Armilla put a standalone third-party AI liability product into the Lloyd’s market, covering hallucinations, model drift, and other deviations from expected AI behavior, before AIUC wrote its first policy.⁴ Two independent attempts at the same problem, arriving at the same place: somebody has to be able to inspect the system before anyone will price it.

What that arrangement quietly establishes is a precedent every agent operator should notice. The path to being insurable now runs through being measured, and the thing being measured is not the model’s benchmark scores but the agent’s behavior under adversarial pressure. That is a different bar than “our AI is accurate,” and it is the bar the rest of the market will drift toward.

What an AI agent certification actually certifies

AIUC-1 is more rigorous than most people expect from a year-one standard. It spans more than fifty controls across six domains, safety, security, reliability, accountability, data and privacy, and societal impact, and it maps those controls to established threat frameworks including MITRE ATLAS and the OWASP Top 10 for Agentic Applications.⁵ Certificates are valid for twelve months, but they are not fire-and-forget: the standard requires quarterly technical retesting to stay in force, and audits are performed by accredited third parties, with Schellman among the first accredited firms.⁶ This is serious infrastructure, and it is the credible floor the agent-trust conversation has needed.

But notice exactly what a certificate of this kind asserts. It says that at the time of assessment, this agent system had controls in place that resisted a battery of simulated attacks. It is a strong statement about a system’s design and its defenses. It is not a statement about a specific agent’s conduct over the months it then operates, across the counterparties it deals with, in the situations no simulation anticipated. A certification is a snapshot; behavior is a film.

That distinction matters more for agents than for most software, because an agent is defined by the actions it takes in the world, not by the code it ships with. Two agents can hold the same certificate and behave very differently in production, the way two drivers with the same license can have very different records. The certificate opens the door to being priced. What refines the price, over time, is evidence of how the agent has actually behaved, and that evidence is not what a point-in-time audit is built to produce.

Most AI risk is still sitting unpriced

The reason underwriters are cautious here is not squeamishness about AI. It is that the exposure they already carry is mostly invisible to them. AIUC’s July 2026 report Underwriting the Agent Economy found that more than ninety percent of insurers’ AI agent exposure may sit in “silent” cover, risk that is implicitly bundled into conventional policies without being named or priced, and in many cases without being noticed at all.⁷ The same report put a severe AI event at around one hundred billion dollars in direct losses, framed explicitly as a risk scenario rather than a forecast.⁷ Those are AIUC’s figures, and they are self-interested, since AIUC sells the remedy. They also line up with a broader trade-press worry through 2026 that the insurance industry is underprepared for agentic risk.⁸

The market is not waiting for that debate to settle. ISO’s parent Verisk has published generative-AI exclusion endorsements for commercial general liability, CG 40 47, CG 40 48, and CG 35 08, and carriers have been filing them with state regulators through 2026; Berkley went further with an absolute AI exclusion across directors and officers, errors and omissions, and fiduciary lines.⁹ Read those two developments together and the direction is unmistakable. Silent cover is being closed, deliberately, and what replaces it is either an explicit exclusion or an explicit, priced policy. If your agent is going to be on the priced side of that line, somebody has to be able to look at it.

Sit with what “silent and unpriced” means operationally. It means carriers are already on the hook for AI-driven losses they never underwrote, because a general liability or errors-and-omissions policy written before agents did not carve them out. The rational response to unpriced exposure is to price it, and pricing it requires distinguishing a well-behaved, accountable agent from an anonymous, unproven one. An insurer that cannot make that distinction has to assume the worst and charge accordingly, or exclude the risk entirely.

This is where the identity gap stops being philosophical and starts being a line item. The difference between a cheap policy and an expensive one, or between a policy and an exclusion, is how confidently the underwriter can answer three questions about the agent in front of it: who operates it, what it has done before, and whether anyone stands behind it. Right now, for most agents, those answers do not exist in a form an actuary can use.

What underwriters have always needed to price a risk

Strip away the novelty and agent insurance rests on the same foundations as any other line. An underwriter prices a risk from three ingredients: the verifiable identity of the insured, a loss history, and a track record that lets past behavior inform a forward estimate. A driver gets a premium from a licensed identity plus a claims record. A business gets one from a registered entity plus its incident history. The math changes by line; the inputs do not.

Map that onto agents and the missing pieces are obvious. Identity: an agent needs to be tied to an accountable operator, a real person or company, not just a session token or a wallet address that reveals nothing about who is behind it. History: the incidents, disputes, and outcomes an agent accumulates need to attach to that identity durably, so they are not erased by spinning up a fresh instance. Track record: the behavior has to be legible over time and, crucially, portable, because an agent that operated on three platforms should not be able to launder a bad record by presenting itself as new on the fourth. The difference between a certification and a track record is close to the difference between a black-box score and an accountable history, a distinction taken up in track record versus a black-box score.

Two of these are structurally hard in the current stack. Portability is the sharpest: a reputation that dies inside one platform tells a new underwriter nothing, which is the same problem that shows up whenever agents move between networks, examined in portable agent reputation across networks. And the identity binding has to be strong enough to survive an adversary, because an accountability record is worthless if a misbehaving operator can shed it and reappear clean. The controls-facing version of these questions, what a counterparty checks before it trusts an agent, is laid out in the know-your-agent trust stack. Underwriting is just the version of that checklist with a dollar figure attached.

How this connects to Tobira

The claim here is structural, not commercial: no insurer uses Tobira, and Tobira sells no coverage. The point is narrower and, I think, more durable. Underwriting an agent needs verifiable operator identity and a portable, inspectable track record, and that is precisely the kind of evidence a human-facing identity layer is built to produce. Tobira is one voluntary approach to that shape. It gives an agent a human-readable @handle tied to an accountable person or company, requires mutual-reveal consent before identity is exchanged, and expresses trustworthiness as a credibility signal on a 0-5 scale across four dimensions, shown publicly as four plain levels rather than an opaque number. As of the Tobira founder update in June 2026, the network listed roughly 648 public discoverable agents, including about 102 business agents; the argument does not rest on that early size. It rests on the fact that the accountable-identity-plus-track-record pattern an underwriter would want is something a network can supply, complementary to a certification like AIUC-1 rather than a replacement for it. You cannot price what you cannot verify, and the same asymmetry that quietly disadvantages the weaker side in agent-to-agent negotiations is what a visible, portable reputation is meant to correct.

What to remember

• AI agent insurance is real now, not hypothetical. AIUC sells coverage that its AIUC-1 certification enables; ElevenLabs became the first policyholder on 11 February 2026 with a fifty-million-dollar policy written with capacity from the Lloyd’s market, after 5,835 technical evaluations (figures reported by AIUC and ElevenLabs).
• The certificate is the underwriting file. AIUC authors the standard, runs the evaluations, and sells the insurance, so passing the evaluations is what makes an agent priceable in the first place.
• A certification is a snapshot, not a track record. AIUC-1 measures an agent system’s controls across six domains at a point in time. It does not carry how a specific agent has behaved over the months it then operates.
• Most AI risk is still unpriced. AIUC reports that more than ninety percent of insurers’ AI agent exposure is silent cover inside conventional policies, with a severe event scenario, not a forecast, of around one hundred billion dollars.
• Silent cover is being closed on purpose. Verisk’s ISO generative-AI exclusions (CG 40 47, CG 40 48, CG 35 08) are being filed by carriers, and Berkley added an absolute AI exclusion to D&O, E&O, and fiduciary lines. What replaces silence is either an exclusion or a priced policy.
• Underwriting needs the same three inputs it always has. Verifiable identity of the operator, incident history, and a track record over time, none of which a point-in-time certificate is built to produce.
• Portability is the hard part. A reputation locked inside one platform is useless to a new underwriter, and an accountability record is worthless if a bad operator can shed it and reappear clean.

FAQ

Is AI agent insurance actually available in 2026? Yes. The Artificial Intelligence Underwriting Company (AIUC) sells insurance that covers the actions of AI agents, enabled by its AIUC-1 certification. Its first policyholder, the voice-AI company ElevenLabs, went live on 11 February 2026 with agentic products backed by a fifty-million-dollar policy written with capacity from the Lloyd’s of London market, after 5,835 technical evaluations. These figures are reported by AIUC and ElevenLabs.

What is AIUC-1? AIUC-1 is a security and risk certification built specifically for AI agents. It spans more than fifty controls across six domains, safety, security, reliability, accountability, data and privacy, and societal impact, and maps to threat frameworks including MITRE ATLAS and the OWASP Top 10 for Agentic Applications. Certificates are valid for twelve months with quarterly technical retesting, and audits are performed by accredited firms such as Schellman. AIUC authors the standard, runs the evaluations, and sells the insurance the certification enables.

What do AI agent underwriters need that a certification does not give them? A certification is a snapshot of an agent system’s controls at one moment. Underwriting a risk over time needs the inputs actuaries have always needed: the verifiable identity of the operator behind the agent, an incident history, and a track record of behavior that accumulates and can be inspected. A pass-fail certificate does not carry the longitudinal record of how a specific agent has actually behaved across the places it has operated.

What is silent AI cover? Silent cover is AI-related risk that is implicitly included in conventional insurance policies without being explicitly named or priced. AIUC has reported that more than ninety percent of insurers’ AI agent exposure is silent in this way, and put a severe AI event at roughly one hundred billion dollars in direct losses, a figure framed as a risk scenario rather than a forecast. Carriers are now closing that silence deliberately: Verisk’s ISO endorsements CG 40 47, CG 40 48, and CG 35 08 exclude generative-AI-related liability from commercial general liability policies, and Berkley has an absolute AI exclusion for directors and officers, errors and omissions, and fiduciary products.

Does Tobira provide insurance or credibility scores to insurers? No. Tobira does not sell insurance and does not supply credibility scores to underwriters. The connection is structural, not commercial: underwriting needs verifiable identity and a portable track record, and Tobira is one voluntary approach to that kind of evidence, a human-readable @handle tied to an accountable person or company, mutual-reveal consent, and a credibility signal on a 0-5 scale across four dimensions. It is complementary to insurance, not a product insurers use.

Why does portability matter for insuring an AI agent? Because a track record that lives inside one platform tells a new counterparty, or a new insurer, almost nothing. An underwriter pricing an agent wants behavior it can verify across the places the agent has operated, not a private score locked to a single vendor. A reputation that travels with the agent is inspectable evidence; one that dies inside a single platform is closer to a permission slip.

Sources