Key Takeaways
- Two new ISO endorsements, CG 40 47 and CG 40 48, took effect in January 2026 and let carriers exclude generative AI claims from standard commercial general liability policies.
- 74% of small businesses now use AI tools in some capacity, but most owners are unaware that their renewal policies may exclude AI-related claims.
- Four categories of claims are at risk: bodily injury, property damage, personal and advertising injury, and products and completed operations.
- The pattern matches the cyber liability story of the late 2010s, when silent coverage gave way to broad exclusions, often only discovered after a claim.
- Affirmative AI coverage is now available through write-back endorsements and standalone policies. Ask your broker the right questions before binding any 2026 renewal.
Article Reviewed by a licensed insurance professional: Sam Meenasian (CA dept of insurance license #0F75955).
Most small business owners never read their commercial general liability policy. They sign the renewal, file it away, and trust that if something happens, they are covered. That has always been a bit of a gamble. In 2026, the gamble is getting riskier in a very specific way.
Two new endorsements from the Insurance Services Office (ISO), the organization that drafts the standard policy forms most carriers use, took effect in January 2026. They are called CG 40 47 and CG 40 48, and they do something that has not happened to the general liability form in a long time. They let carriers remove coverage for an entire category of claims, AI-related ones, from policies that small businesses have relied on for decades.
The exclusions are arriving quietly. Most renewal packets we have seen in the first half of 2026 contain at least one of these endorsements or a carrier-drafted equivalent. Most business owners signing those packets have no idea the exclusion is in there. That is the gap we are going to walk through.
Figure 1: How the January 2026 ISO endorsements changed what standard small business general liability policies cover. Source: USA Business Insurance Services, Inc. — AI Coverage Gap Report 2026.
What the ISO Endorsements Actually Do
ISO is not a carrier. It is a standards organization that drafts the policy forms most US property and casualty carriers use as their starting point. When ISO issues a new endorsement, it does not automatically appear on every policy in the country, but the major carriers tend to adopt it within a year or two of release. CG 40 47 and CG 40 48 are following that pattern fast.
CG 40 47 is the broader of the two. It excludes losses arising from generative AI under both Coverage A (bodily injury and property damage) and Coverage B (personal and advertising injury). In plain English, if a claim has any meaningful connection to a generative AI tool, the carrier can deny it.
CG 40 48 is narrower. It removes only Coverage B, which is the personal and advertising injury section of the policy. This section covers claims for defamation, copyright infringement, and invasion of privacy. CG 40 48 leaves Coverage A intact, so bodily injury and property damage claims may still respond. That sounds better, but Coverage B is where most AI content claims actually live. Think AI-generated blog posts, AI-written ads, and AI-produced social media. So the narrower exclusion still hits hard for any business using AI in marketing.
There is also a third ISO endorsement addressing products and completed operations, which excludes AI-related harms that show up after a product or service has left the business’s hands.
An important detail: these endorsements are optional. ISO drafted them, but each carrier decides whether to attach them at renewal. Some carriers have gone further and drafted their own absolute AI exclusions, which apply to any AI-related claim under any coverage part of any policy they write. What shows up on your renewal depends entirely on which carrier you are with and how aggressively they are responding to AI risk.
How AI Adoption Got Ahead of the Coverage
HSB, part of Munich Re Group, surveyed 1,000 small and mid-sized businesses earlier this year and found that 74% are already using AI tools, with 91% planning to adopt them in the near future. The use cases are everywhere: chatbots on websites, AI-written social media posts, AI tools that help draft client emails, AI that schedules appointments or routes service calls, AI features embedded in software the business uses, and AI features inside products the business sells.
For most of the last few years, none of this was on the radar of standard insurance policy forms. AI claims, when they arose, fell into existing coverage categories by default. Insurance lawyers call this silent coverage. It is not coverage your policy intentionally provides, but coverage that exists because the policy did not affirmatively exclude it.
Figure 2: The widening gap between small business AI adoption and AI coverage in standard liability policies. Sources: HSB / Munich Re adoption data, ISO endorsement filings, USA Business Insurance Services book of business.
What ISO did with CG 40 47 and CG 40 48 is move AI from silent to explicit. The carriers using these endorsements are no longer leaving the question to chance. They are saying, clearly and in writing, that AI-related claims are not covered.
The Four Categories Now in the Crosshairs
There are four practical ways an AI claim can show up against a small business. The new ISO endorsements (and the carrier-specific absolute exclusions) address all four.
Figure 3: The four categories of AI-related claims now being formally excluded from standard CGL policies, with example scenarios. Source: USA Business Insurance Services, Inc. — AI Coverage Gap Report 2026.
The first is bodily injury. An AI-controlled system causes a physical injury. The HSB example everyone is using is an AI-managed HVAC system that creates condensation on the floor, leading to a slip-and-fall. There are plenty of others. An AI-enabled security camera that fails to alert someone to a hazard. An AI-driven access control system that locks a person in a room. Anywhere AI sits between a decision and a physical outcome, there is potential for a bodily injury claim.
The second is property damage. The cleanest example is a technician asking an AI chatbot for installation instructions and getting bad guidance that causes damage. Plumbers and electricians using AI tools to look up code requirements are exposed here. So, is anyone using AI to assist with technical service work where the AI’s output influences how the job is done?
The third is personal and advertising injury, and this is where the volume of claims is most likely to land. Personal and advertising injury covers libel, slander, defamation, copyright infringement, invasion of privacy, and similar harms. AI tools that generate text, images, video, or audio are the obvious source of risk. A marketing agency that uses AI to write a blog post and includes copyrighted content it scraped without permission has just triggered a personal and advertising injury claim. A consultant who lets an AI summarize a competitor’s product, and the summary turns out to be defamatory, has just generated one too.
The fourth is products and completed operations. This category covers businesses that sell products with built-in AI features. A manufacturer that ships equipment with an AI-driven sensor that misreads conditions after delivery. A software vendor whose AI feature gives bad advice that causes harm downstream. These claims usually surface months or years after the sale, which makes them especially hard to budget for.
Why This Is the Cyber Liability Story All Over Again
If you have been in business for more than a decade, you have seen this movie before. The pattern is almost identical to what happened with cyber risk in the 2010s.
Cyber claims used to fall into general liability and property policies by default. There were no explicit exclusions. When a data breach happened, lawyers fought over whether the loss qualified as property damage, business interruption, or personal injury, and sometimes carriers paid. Then, around 2014, ISO and the major carriers started adding explicit cyber exclusions to general liability policies. Within a few years, the silent coverage was gone, and a separate cyber insurance market emerged to fill the gap.
That market is now a multi-billion-dollar-a-year line of business. Almost every small business with meaningful digital exposure now carries some form of cyber liability, because the alternative is uncovered.
AI is following the same arc. The “before” looked like silent coverage under standard policies. The “after” will look like a separate AI liability market, with its own pricing, underwriting, and forms. HSB launched the first major standalone AI liability product for small and mid-sized businesses in March 2026, and others are expected to follow.
The difference, and this is the part that should get attention, is that AI is moving faster. Cyber took about a decade to transition from silent to explicit. AI is making the same move in 18 to 24 months. Owners who did not buy cyber early found themselves uncovered after a breach. Owners who do not address AI in 2026 face the same risk on a much shorter timeline.
The Industries Most Exposed Right Now
Across our book of business, a handful of industries are showing up with the highest AI exposure heading into 2026 renewals.
Marketing and creative agencies are at the top of the list. These businesses rely heavily on AI for content generation, ad copy, image creation, and social media. Almost every claim category we discussed above is in play. The personal and advertising injury exposure alone is significant, given how much output these agencies produce and how often it goes live without comprehensive human review.
Professional services firms are next. Consultants, financial planners, and marketing strategists use AI to draft client deliverables, summarize research, and generate reports. When the AI gets something wrong, the resulting harm often shows up as a professional liability claim, but content errors can also trigger personal and advertising injury exposure.
Online retailers and e-commerce operations rely on AI for product descriptions, customer service chatbots, and personalized recommendations. AI-driven content that infringes on copyright or makes false claims can land back on the retailer. AI chatbots that promise things the business cannot deliver can create issues with implied contracts.
Healthcare-adjacent businesses, including medical billing companies, telehealth platforms, and wellness apps, are using AI for triage, intake, and administrative work. The bodily injury exposure here is real, particularly if AI-driven decisions affect care.
Field service trades are not immune. Handymen, hood cleaners, pressure washers, and similar trades are increasingly using AI tools for estimating, scheduling, customer-service chatbots, and on-site technical lookups. The exposure per claim is lower than that of a marketing agency, but it exists. We have already seen carriers ask field service applicants about their use of AI tools at renewal.
How State Regulators Are Adding Pressure
The insurance side of this is happening in parallel with a major regulatory shift. According to the National Conference of State Legislatures, all 50 states have introduced bills addressing AI regulation, data oversight, or algorithmic accountability.
California is the most visible. Assembly Bill 316, effective January 1, 2026, explicitly bars businesses from claiming “the AI acted autonomously” as a defense in civil actions. In plain language, if your AI does something that harms a third party, you cannot point at the AI and walk away. The business is liable.
That single piece of legislation changes the calculus for every California small business using AI. It removes one of the most common defense strategies. Combined with the new ISO exclusions, a California business facing an AI claim now has both reduced insurance coverage and a harder defense in court.
Other states are following. New York, Texas, and Illinois all have bills in active consideration. Some focus on disclosure requirements (telling consumers when they are interacting with AI), some on data sourcing transparency, and some on algorithmic bias.
The combined effect is that AI is becoming a distinct category in underwriting and legal. Insurance carriers are pricing it separately. Regulators are treating it separately. Businesses that get caught in the middle, without explicit coverage and strong governance, will have the hardest time at both renewal and trial.
What to Ask at Your 2026 Renewal
Figure 4: The four questions every small business owner should answer before binding a 2026 renewal. Source: USA Business Insurance Services, Inc. — AI Coverage Gap Report 2026.
If you take only one thing away from this article, let it be this: do not bind your 2026 renewal without getting clear answers to four specific questions.
First, does your renewal policy include ISO endorsements CG 40 47 and CG 40 48, or a carrier-drafted absolute AI exclusion? Ask for the form numbers. A good broker should be able to tell you in 30 seconds.
Second, does your business actually use AI in ways that could generate a claim? This is broader than most owners assume. Customer-facing chatbots, AI-written marketing copy, AI-assisted scheduling, AI-driven decision tools, and AI features in products you sell all count. Your staff may be using AI tools you are unaware of. We have started asking small-business clients for an honest inventory of every AI-related tool used across the business at renewal.
Third, is affirmative AI coverage available to fill the gap? Affirmative coverage means the policy explicitly states in writing that AI-related claims are covered. There are two main paths. A write-back endorsement adds coverage back to your existing CGL policy. A standalone AI liability policy provides dedicated coverage outside the CGL framework. Both have very different pricing and limit structures.
Fourth, how is generative AI defined in the endorsement language? This sounds technical, but it determines the entire scope of what is excluded. Some carriers define generative AI narrowly, meaning only AI systems that your business built or trained. Others define it broadly enough to capture any third-party AI tool your staff touches in the course of work. The definition can be the difference between a covered claim and a denied one.
How to Actually Close the Gap
There is no single fix for the AI coverage gap. There are several practical steps that, taken together, get most small businesses to a reasonable position.
The first is documentation. Keep a running list of every AI tool your business uses. Note who uses it, what it is used for, and whether outputs are reviewed by a human before going to customers. This list does two things. It helps your broker present an accurate picture at renewal, which improves pricing. And it provides the documentation you need to defend a claim if one ever arises.
The second is human review. Carriers offering affirmative AI coverage are explicitly asking whether AI outputs are reviewed by a human before going public. Marketing copy, customer-facing messages, technical advice given to clients, and product features should all have at least some human oversight. The more documented the review process, the better the underwriting outcome.
The third is the coverage decision itself. For most small businesses we work with, the right answer is a write-back endorsement on the existing general liability policy, paired with affirmative AI language elsewhere in the program (cyber, professional liability) where relevant. For larger or more AI-dependent businesses, a standalone AI liability policy may make sense. We have started reviewing AI exposure as a standard part of every commercial renewal in 2026.
The fourth is staying current. AI regulation, AI insurance products, and AI claim trends are all moving fast. What is a reasonable position in mid-2026 may not be in mid-2027. Our blog is where we publish updates on this and other coverage topics as they evolve.
About Our Work
At USA Business Insurance Services, Inc., we work with small businesses in all 50 states, from marketing agencies and online retailers to manufacturers, restaurants, and high-hazard contractors. We are reviewing AI exposure as a standard part of every commercial renewal in 2026, and we place affirmative AI coverage for clients who need it. We also place general liability, workers’ compensation, commercial auto, and professional liability coverage for plumbers, electricians, welders, roofing contractors, and hood cleaning companies, along with hundreds of other trades and retail operations. If you are unsure whether your renewal policy includes one of the new AI exclusions, send us your renewal documents, and we will tell you in writing. There is no pressure to switch brokers. We just think every small business owner should know what their policy actually covers.
