AI Insurance Will Ask for Evidence, Not Intent

In 2017, the NotPetya malware tore through Merck’s network and did roughly $1.4 billion in damage. Merck claimed under its all-risk property policy. The insurers refused, invoking the war exclusion: a state-backed attack is an act of war, and acts of war are not covered. Merck litigated for six years and won, but the market learned the cheaper lesson. Within a couple of years the Lloyd’s syndicates had rewritten their cyber war exclusions to draw that line in advance instead of arguing it in front of a judge.

That is the pattern worth studying, because AI is the next loss class to run through it. Insurers do not absorb a risk they cannot price. They bolted an “absolute pollution exclusion” onto general liability policies once asbestos and environmental claims outgrew their models. They killed “silent cyber” by forcing every policy to state explicitly whether a breach was covered. The mechanism is always the same: first the carve-out, then a buy-back priced on whatever the insured can prove about its controls.

So the question for AI is not whether the exclusion arrives. It is what the buy-back costs you, and that price tracks evidence, not your statement of responsible use. A claims adjuster, a regulator, and a plaintiff’s lawyer want the identical thing: the record of what you knew, what you tested, and what you changed. Intent does not appear in that record. Artifacts do.

The record has to survive a hostile reader

This is where “keep good records” stops being advice and starts being engineering, because the record has to convince someone who assumes you would alter it. A folder of PDFs does not. What underwriters and discovery are both moving toward is tamper-evidence, and it has three concrete parts:

• An append-only log where each entry carries the hash of the entry before it, so editing or deleting a past decision breaks the chain and the break is visible.
• The head of that chain anchored on a schedule to an external timestamp authority (RFC 3161) or a third-party witness, so “this existed by this date” is provable without your say-so.
• The store itself on WORM media under object-lock retention, where the storage layer, not a policy, refuses deletion until the retention clock runs out.

Get those right and backdating is not tempting because it is not concealable. Get them wrong and your timestamps are worth exactly your good word, which in a deposition is worth nothing.

The content is a byproduct, the integrity is the work

What flows into that log already exists if you run the program. Eval runs, change-control approvals, the incident reviews that forced architecture changes : you produce these whether or not you capture them. The discipline is writing each one at the moment of the decision into a store you cannot later rewrite. That is the practical reason governance has to be a residue of the work and not a quarterly performance. A residue is contemporaneous, and contemporaneous is the only property that makes a record hard to dismiss.

The failure mode is rarely malice. It is a model that causes a loss, an inquiry that opens, and a team that meant to stand up the logging last quarter. The most expensive sentence in any post-incident room is “we always meant to.” You cannot retrofit an eval history. You cannot anchor a timestamp to a date that has already passed. The artifact existed when the decision was made, or it did not, and the gap reads as negligence rather than innocence.

Treat the audit trail as load-bearing infrastructure now, while it costs only discipline. After the claim it costs twice: the premium you can no longer buy, and the maturity you cannot prove when the buy-back gets priced.