Breaking news exclusive….updating
Reporting and opinion by Mathew Carr
The AI-obsessed financial press and analysts are banking that huge corporations will be massive users of artificial intelligence.
You just have to read WSJ, FT or Bloomberg to know that is baked into assumptions and overripe stock-market valuations.
The problem is, no one wants to be held to account for AI deployment.
Boards of directors? No, thanks, they say!
The excuses emanating from AI companies when rogue agents cover up their own bad behavior are “ludicrous”, said one member of multiple financial-services boards.
Regulators around the world have set down multiple standards designed to protect shareholders against those supplying goods and services to corporations and those are a high hurdle for board directors to meet, said the person. (see the chart, below.)
“You can’t blame the third party” AI company, the person said of directors who might be thinking they can dodge a bullet that way. I don’t understand how large corporations can be meeting these obligations, the person said
Gemini
Perhaps insurers will take on the legal risk faced by directors. Well, no, is mostly, and increasingly, the answer.
Traditional insurers are managing the risk of reckless AI deployment by introducing broad AI exclusions, creating massive coverage gaps for board members because carriers currently lack the historical data to quantify and price AI liability, according to a survey of insurers and research by CarrZee.
Currently, the market is undergoing a clear divergence, which cannot be simply summarized as “does not cover.”
1. Traditional Policies May “Silently” Provide Coverage
In the past, many D&O policies did not explicitly exclude AI risks. Legal and insurance industry analyses generally believe that if directors are accused of failing to fulfill oversight duties regarding AI deployment (such as inadequate governance leading to losses), this could be construed as a “wrongful act” in management decisions, and thus potentially covered by traditional D&O policies. Zurich Insurance’s analysis points out that investigations or claims arising from AI deployment may fall within the scope of “investigations” or “wrongful acts” in existing policy wordings.
2. New “Absolute Exclusions” Are Emerging
This is the source of the risk you’re concerned about. Some insurers have begun adding “absolute AI exclusions” to their D&O, E&O (professional liability), and fiduciary liability policies. For example, Berkley Insurance has introduced such clauses, explicitly excluding coverage for any claims involving AI use, deployment, or development. This means that if a director is accused of inadequate AI governance leading to shareholder losses, under such policies, they would indeed receive no coverage.
3. Key Trend: Coverage Increasingly Depends on “Governance”
The insurance industry is sending a clear signal: insurers are no longer simply asking “do you use AI,” but rather focusing on “how do you manage AI.” If a company can demonstrate robust AI governance (such as approval processes, human oversight, risk assessments), it may secure better terms and pricing. Conversely, if AI is deployed recklessly without documentation or oversight, not only may coverage be excluded, but it may also be deemed a breach of directors’ fiduciary duties.
Some insurers’ D&O policies do indeed exclude coverage for AI-related claims, but this is not yet universal. Whether coverage exists depends on the specific policy terms you purchased and the governance status at the time of the incident.
Here are some slightly disturbing examples of what specialists won’t even touch:
While baseline premiums have not spiked, underwriters are aggressively scrutinizing AI governance. Reckless deployment exposes directors to severe, potentially uninsured liabilities in several ways:
-
“AI Washing” Litigation: Shareholders are already filing derivative suits against boards for misrepresenting, inflating, or failing to deliver on stated AI capabilities, triggering stock drops and D&O claims.
-
Shadow AI Exposure: For every authorized AI tool a company purchases, employees typically use 1-2 unauthorized AI applications (like personal ChatGPT accounts for corporate work), creating unmonitored data and intellectual property liabilities that courts hold directors accountable for.
-
Uninsured Operational Failures: Because insurers are writing AI exclusions into standard policies, directors could face personal financial exposure if an AI system causes consumer harm, employment discrimination in HR platforms, or inaccurate financial reporting.
-
Expensive Affirmative Coverage: While standard D&O premiums are declining, the handful of specialized carriers that are actually willing to write bespoke, affirmative AI coverage are pricing it significantly higher than traditional policies.
……..
Across all major financial jurisdictions, regulators have intentionally shifted board accountability from passive policy approval to direct personal liability. Rushing the deployment of AI without rigorous controls exposes board members to significant personal legal, financial, and regulatory risk.
The mechanisms of personal exposure vary by country, but the trend toward board member accountability is global:
Jurisdictional Exposure Breakdown
┌─────────────────────────────────────────────────────────┐
│ GLOBAL REGULATORY SHIFT: INDIVIDUAL DIRECTORS │
└────────────────────────────┬────────────────────────────┘
│
┌──────────────────┬──────────────┴───────┬──────────────────┐
│ │ │ │
EUROPE UNITED UNITED AUSTRALIA
(DORA & AI) KINGDOM STATES (FAR)
│ │ │ │
Direct legal Personal regulatory Fiduciary litigation Personal fines &
penalties clawbacks & bans & regulatory suits rep. disqualification
1. European Union (DORA & EU AI Act)
-
Specific Directive: Article 50(5) of the Digital Operational Resilience Act (DORA) mandates that EU member state regulators can apply administrative penalties and enforcement measures directly against members of the management body.
-
The AI Risk: DORA legally classifies AI models as ICT assets. Simultaneously, the EU AI Act imposes strict governance rules on high-risk AI (such as credit scoring and fraud tools). Delegating AI management to IT teams or third-party vendors without board-level testing violates DORA, opening directors up to personal sanction.
2. United Kingdom (Senior Managers and Certification Regime – SM&CR)
-
Specific Directive: The UK’s SM&CR assigns mandatory “Statements of Responsibility” to senior managers and board members.
-
The AI Risk: Under PRA/FCA operational resilience rules, directors must demonstrate they took “reasonable steps” to prevent systemic operational failures. If a rushed AI system causes an outage, algorithmic bias, or market distortion, responsible board members face individual enforcement action, variable compensation clawbacks, or being banned from the UK financial sector.
3. United States (Caremark Duties & SEC Oversight)
-
Specific Directive: Delaware corporate law (Caremark doctrine) requires directors to maintain active oversight of critical operational risks, while the SEC aggressively targets misleading statements about technology readiness (“AI washing”).
-
The AI Risk: US boards do not have a single overarching regulatory standard like DORA, but face severe fiduciary class-action risk. If a board approves rapid AI adoption without establishing proper monitoring controls, shareholders can sue directors personally for a breach of the duty of oversight following an incident or drop in valuation.
4. Australia (Financial Accountability Regime – FAR & CPS 230)
-
Specific Directive: Managed jointly by APRA and ASIC, the FAR framework assigns individual accountability to executive directors and key officers.
-
The AI Risk: Paired with CPS 230, any board member who fails to exercise due diligence over a critical third-party AI vendor or unvetted AI algorithm can face direct regulatory investigation, disqualification from holding directorships, and loss of deferred remuneration.
Why “Rushing” AI Specifically Triggers Board Liability
-
Failure of Duty of Care: Pushing AI to market without model risk auditing, drift detection, or bias testing constitutes a demonstrable failure of oversight.
-
Third-Party Illusion: Regulators globally agree that outsourcing operational control does not outsource liability. Relying on external AI vendors (e.g., OpenAI, Anthropic) without mapping their supply chain vulnerabilities directly breaches third-party risk rules.
-
Mandatory Literacy: Under regulations like DORA, directors are now legally required to maintain their own technical literacy to understand the operational risks of technologies like AI. Claiming “I didn’t understand how the model worked” is no longer a viable defense.
Global Regulatory Shift: Board Director Exposure
[ GLOBAL REGULATORY SHIFT: INDIVIDUAL BOARD LIABILITY ]
"Outsourcing operations does NOT outsource liability"
│
┌───────────────────────┼───────────────────────┐
│ │ │
[ AUSTRALIA ] [ EUROPE ] [ UNITED KINGDOM ]
• APRA CPS 230 • EU DORA • SS1/21 Rules
• FAR Framework • EU AI Act • SM&CR Framework
│ │ │
▼ ▼ ▼
Liability: Liability: Liability:
• Personal fines • Direct admin • Bonus clawbacks
• Board disqual. penalties on board • Personal fines
• Remuneration • Sanctions for • Reg. bans from
clawbacks non-compliance financial sector
│ │ │
└───────────────────────┼───────────────────────┘
│
┌───────────────────────┴───────────────────────┐
│ │
[ UNITED STATES ] [ SINGAPORE ]
• Interagency Guidance • MAS BCM Guidance
• SEC & Delaware Caremark • Tech Risk Framework
│ │
▼ ▼
Liability: Liability:
• Fiduciary class-actions • Direct reg. reprimands
• SEC "AI washing" suits • Remuneration penalties
Key Rules & Director Exposure by Country
Australia
-
Regulations: APRA CPS 230 & Financial Accountability Regime (FAR)
-
Liability Mechanism: APRA/ASIC joint statutory enforcement
-
AI Risk: Directors face personal fines, disqualification from holding board positions, and clawbacks of variable pay for operational disruptions caused by unvetted AI.
Europe
-
Regulations: Digital Operational Resilience Act (DORA) & EU AI Act
-
Liability Mechanism: DORA Article 50(5) direct board sanctions
-
AI Risk: Direct administrative penalties levied against individual board members for failing to oversee ICT, third-party cloud vendors, and high-risk AI models.
United Kingdom
-
Regulations: PRA/FCA SS1/21 & Senior Managers & Certification Regime (SM&CR)
-
Liability Mechanism: Individual Statements of Responsibility
-
AI Risk: Personal regulatory fines, public reprimands, clawback of bonuses, and permanent bans from serving as a director in UK financial services.
United States
-
Regulations: Interagency Guidance, SEC Oversight & Delaware Caremark Doctrine
-
Liability Mechanism: Fiduciary breach litigation & SEC regulatory action
-
AI Risk: Director personal liability in shareholder class actions for breach of oversight duties, plus SEC penalties for misleading claims about AI readiness.
Singapore
-
Regulations: MAS Business Continuity & Technology Risk Management
-
Liability Mechanism: MAS Senior Responsible Persons Framework
-
AI Risk: Direct executive remuneration penalties, formal regulatory reprimands, and mandatory capital add-ons imposed on the institution.