As AI Laws Proliferate, Liability and Coverage Questions Multiply

The only thing that may be keeping pace with the growing capabilities of artificial intelligence is the reaction to AI, which includes a proliferation of laws and regulations.

More than 1,500 AI-related bills have so far been introduced in 2026, and 280 of those were adopted, according to the National Conference of State Legislatures. More than 1,200 AI-related bills were introduced last year, with 227 enacted or adopted, NCSL data show.Proposals requiring disclosure when people interact with AI increased by nearly threefold this year, with deepfake legislation being the most common category of enacted AI laws this year, NCSL reports.

These AI-related bills and laws have been crafted in states across the U.S., creating a patchwork of proposed fixes — and a potential mess for the legal system and the insurance industry to deal with.This rapidly expanding patchwork of state laws and regulations is occurring not in the absence of action from the federal government, but despite it.

President Trump signed the executive order “Ensuring a National Policy Framework for Artificial Intelligence” in December 2025. The order seeks to accelerate AI innovation through a minimally burdensome national framework and calls for challenges to state AI laws that conflict with federal policy. The U.S. Department of Justice established an AI Litigation Task Force in January 2026 to challenge state AI laws that it considers inconsistent with that policy.

As states take it upon themselves to address the risks from AI, pressure is growing on regulators to act as well, adding to the compliance challenges for businesses adopting the technology and the insurers covering their risks.

“Basically, we’re seeing a sea change of what is happening with respect to AI,” said Jana Farmer, who leads Wilson Elser’s privacy, security and AI practice. “It’s a new technology. It’s the fastest adopted technology in history, and it has new capabilities not seen before, and it has some new threats that we’re not used to.”

Litigation is already playing out over AI’s harms, including lawsuits seeking hundreds of millions of dollars over allegations of children being endangered and people harming themselves after talking with AI chatbots.

Litigation against social media companies may offer a preview of how consumer protection laws could be used against AI developers and other businesses. One recent case, against Meta, came when a New Mexico court handed down a $25 billion civil penalty, finding it had violated the state’s consumer protection more than 43 million times. Meta has said it will appeal.

Farmer believes those lawsuits may be showing the way for regulators under pressure to take action to protect consumers and businesses from the ills brought by AI.

“We also see that regulators have various priorities, and protecting minors and vulnerable populations is important to them,” Farmer said. “And (people) kind of think that with social media, regulators maybe were not as fast to spot the dangers, and were regulating after the harm has occurred. So, with AI, many regulators are looking to see what they can do ahead of time with respect to protecting the vulnerable populations.”

More regulation is likely. A new poll from Quinnipiac University found 91% of those surveyed believe it’s very or somewhat important for the U.S. to establish guardrails for AI, and 81% believe that safety should come before the pursuit of innovation.

This is occurring in a soft cyber insurance market. Marsh reported that global cyber insurance rates declined 4% in the third quarter, the 13th consecutive quarterly decrease. U.S. rates were flat after an extended period of declines.

The potential risk from AI, even in a soft cyber insurance market with a push for ever-broader coverages, has prompted some insurers to focus on underwriting discipline. That concern has grown following recent incidents, including one in which rogue AI agents from OpenAI hijacked Hugging Face user accounts and probed the site itself for vulnerabilities.

“We know just from reading the news that AI has the potential to present significant exposure,” said Michelle Worrall, global director of insurance product for cyber managing general agent Resilience. “A lot of insurers post Hugging Face have really tapped their brakes and I do know that we are going to see, with respect to AI amendatories, they’re going to be very dynamic, they’re going to be changing all the time.”

Farmer also sees a parallel between AI regulation and the development of data breach and privacy laws, where businesses have had to navigate different requirements and potential legal exposures across states.

“This is the same thing that we have seen with data breach laws, because we have data breach laws in 50 states. The same thing that happened with state privacy laws, where there is no federal comprehensive privacy laws, so you end up with a patchwork,” Farmer said.

AI carries some of the same privacy and data-related risks, but the technology also introduces new exposures. Beyond misbehaving chatbots and agents that evade safeguards, AI can make cyberattacks and social engineering schemes easier to orchestrate.

“So, what you are seeing maybe is more claims, more varied (legal) theories, and theories stacked on top of each other in the alternative, but we also see developing laws, developing litigation theories, so this is a fast-moving field,” Farmer said. “It’s like drinking from the fire hose at the moment.”

One-in-five insurance industry respondents reported that a client experienced an AI-related loss or claim during the previous year, Gallagher’s 2026 AI Adoption and Risk Survey found. The survey showed cyber liability, product liability and employment practices liability were the lines most likely to be affected.

The state-by-state AI law patchwork is considerable, but Worrall pays closer attention to efforts ongoing globally to address AI concerns. That includes the EU AI Act, which imposes legal obligations on providers, importers, distributors and deployers of AI systems and general-purpose AI models (GPAI models), according to an explainer from Orrick, a global law firm that tracks AI developments.

The act imposes these obligations in phases, which are still being rolled out based on an organization’s role in the covered technology.

“When I draft (policy language), I tend to draft towards that which is the most rigorous, which of course is the EU AI Act,” she said.

Worrall also considers existing legal frameworks that could apply to AI-related claims, including Europe’s General Data Protection Regulation and state laws governing unfair or deceptive business practices, which can carry enhanced damages or penalties depending on the jurisdiction.

“It’s because the law doesn’t keep pace with the emerging technology, so you have to rely on those laws that are tried and true, that are already there, that are part of the governance framework,” Worrall said.

Worrall said that is one reason Resilience is emphasizing risk selection, starting with decisions about which AI developers, deployers and applications the company is willing to insure. She expects more carriers to take a similar approach.

“Every underwriter is looking at risk selection first with respect to AI right out-of-the-box,” she said. “Does the insurer want to cover foundational AI? What sort of deployers of AI do they want to cover? Do they want to cover AI that’s in business-to-consumer, which is certainly higher risk than business-to-business? What’s the AI doing? Is it companion AI?”

She added: “A lot of insurers would not want to insure companion AI models. That’s threshold question with respect to underwriters, before you even get to the wording.”

Was this article valuable?