Your customer just asked for AI liability coverage. Here's what to send.

It happened to one of our customers last Tuesday. They were three weeks into a six-figure enterprise deal. The technical due diligence was done. The security review had passed. The deal was in legal review. Then the procurement lead at the buyer sent a one-line email: "Before we sign, please send a certificate of insurance evidencing AI liability coverage for at least $5M per occurrence."

The CTO forwarded the email to us with three words: "What is this?"

This is happening more often. Enterprise procurement teams have started adding AI liability coverage to their vendor risk questionnaires, often without specifying what they actually want or how they expect it to be evidenced. The vendors getting these requests are not always sure how to respond. The wrong response loses the deal. The right one closes it.

This post is what to do when that email lands in your inbox.

What procurement actually means when they ask this

The request "evidence of AI liability coverage" can mean four different things, depending on who at the buyer wrote the question and how recently they updated their procurement template:

1. A certificate of insurance (COI) explicitly naming AI agent failures as a covered cause of loss. The buyer's risk team has done their homework, knows that silent AI in a generic Tech E&O policy is not a credible answer, and wants affirmative coverage language they can file.
2. A contractual indemnity from you to them, with a defined dollar cap, covering claims arising from your agent's actions. They want you on the hook directly, with your balance sheet behind the indemnity.
3. Both of the above. The contract requires you to maintain coverage at a stated limit AND to indemnify them on top of that. Common in regulated industries (finance, healthcare, insurance distribution).
4. They don't actually know what they want. Their procurement template now has a checkbox for "AI liability coverage" because someone in their risk function added one. They will accept a reasonable answer if you can give one.

You will not know which of the four applies until you ask. The first response is almost never "here is what you wanted." The first response is a clarifying email back to procurement.

The clarifying email to send first

Before you commit to sending anything, write back. A short, calm, professional email that asks three things:

Hi [name], happy to put together what you need. Three quick questions to make sure I send the right thing.

1. Do you need a certificate of insurance evidencing affirmative AI liability cover, contractual indemnity language in our MSA, or both?
2. What coverage limit are you looking for? Per occurrence and aggregate.
3. Is the trigger specifically autonomous AI actions taken on your behalf, or broader (any errors arising from the AI product)?

Once I know what you need, I'll get it to you in the next [X] business days.

This email does three things. It tells procurement you understand what they are asking. It surfaces the requirement specifically enough that you can actually meet it. And it buys you several business days to assemble whatever you do not yet have.

We have seen procurement teams who started by asking for a $5M COI revise the ask after this email to "indemnity language sufficient for our risk team is fine." Sometimes the ask was bigger than the buyer needed.

What to send if you already have AI agent coverage

If you carry an affirmative AI E&O policy from a specialist carrier, the response is straightforward.

A certificate of insurance issued by your broker showing the policy in force, the carrier name, the limits, and a description of the coverage that explicitly includes "errors or omissions arising from autonomous actions of artificial intelligence agents." That last clause is the part procurement will read.

A redacted policy form if they want to dig deeper. Most procurement teams will not. Your general counsel may want to redact the rate page before sharing.

A third-party risk assessment certificate. A document from a recognised AI risk assessor confirming that your agent has been independently evaluated against a structured framework. This is the part of the response that most differentiates a serious vendor from a tickbox vendor, and it is increasingly what sophisticated risk teams ask for as a follow-up to the COI.

If you do not have all three pieces, you do not have to invent them. But you should have the COI at minimum, and you should be able to articulate which carrier wrote your policy and on what trigger.

What to send if you do not yet have coverage

This is the situation most AI vendors in 2026 are in. There is no shame in it. Affirmative AI coverage from major carriers is not yet broadly available, and procurement teams who have done their homework already know this. What is defensible is the path you can show.

A credible response when you do not have a bound policy yet:

1. Acknowledge directly that the product category is new and that affirmative AI coverage from major carriers is not yet broadly available. The buyer's risk team probably already knows this. The teams who do not will respect the candour.
2. Show your risk posture independently. This is where a third-party AI risk certification matters. If your agent has been independently assessed and graded against a structured rubric, you can attach the resulting certificate as evidence that your operating perimeter has been examined and is auditable. This is materially more credible than a self-attested checklist.
3. Show your roadmap to bound coverage. Name your broker, name the carrier process you are in, name a target effective date. "We are mid-process with a specialist AI agent insurance MGA. Target bind date Q3 2026. We will send the COI when issued" is a real answer that closes deals.
4. Offer contractual indemnity in the interim, with caps tied to deal value or annual contract value rather than open-ended exposure. Be careful here. Indemnity language without an insurance policy behind it means your balance sheet absorbs the loss directly. Tie any indemnity you offer to limits you can actually backstop, and ideally to coverage you are bringing in.
5. Be specific about what your agent will not do. If your agent is read-only on the buyer's systems, will not send external communications without human review, and will not execute financial transactions, name those constraints explicitly. The buyer's risk team is trying to size the exposure. Narrow the surface for them.

Common gotchas in the contract language

Once you signal you have coverage or are getting it, the buyer's legal team will often send proposed indemnity and insurance clauses. Read them carefully before you sign. The most common traps:

Unlimited indemnification. Some standard enterprise MSA templates ask for uncapped indemnification on AI errors. This is not market. Cap your exposure to a multiple of annual contract value (commonly two to three times ACV) or a fixed dollar amount that matches your insurance limit.

Coverage limits that exceed what the market can supply. A buyer asking for $50M per-occurrence AI agent coverage in 2026 is asking for something almost no AI vendor can buy from a single carrier. Push back politely and offer what is genuinely achievable today.

Definition drift between "AI" and "AI agent." Some clauses define AI broadly enough to include any feature with a machine learning component. This is a problem if your product has fifty ML-driven features and only the agentic ones carry meaningful third-party risk. Negotiate the definition down to autonomous agents specifically.

Self-insurance carve-outs. Watch for language saying "the vendor may satisfy this requirement through self-insurance." That puts your balance sheet directly on the line for every claim. Insurance from a rated carrier is materially safer for both sides.

Per-claim vs aggregate confusion. A $5M aggregate limit means $5M for the entire policy period across all claims combined. A $5M per-occurrence limit means $5M for each separate claim. The buyer may not realise these differ. Make sure the contract says what you can actually deliver.

What to put in your sales playbook so this never blindsides you again

Vendors who get this question once will get it again. The fix is upstream. Put the answer in your data room and train your sales team on the three responses.

• A one-page risk posture summary explaining what your agent can and cannot do, what controls you operate under, what testing has been done, and what your current insurance status is. Refresh it quarterly.
• A pre-approved COI request template so when procurement asks, your broker can turn a certificate around in a day, not a week.
• Standard contract language for indemnity that you have already negotiated with your legal counsel, so the sales team can drop it into the redline without rewriting it deal by deal.

Then make sure the sales team knows: when this question comes in, do not ad-lib. Forward the email to risk or finance, and use the prepared response.

The market shift behind this

Why is this question landing now? Three reasons.

First, the Air Canada chatbot ruling in February 2024 established that companies are financially liable for the autonomous statements of their AI agents. Enterprise risk teams that had been treating AI as an internal IT concern have updated their vendor risk questionnaires to reflect the new legal reality.

Second, several major insurance carriers have begun adding AI exclusion endorsements to Tech E&O and Cyber policies at renewal in 2025 and 2026. Enterprise buyers reading their own renewal terms have realised they may not be covered for AI vendor incidents under existing policies, which has pushed them to require evidence at the vendor level.

Third, the run of well-publicised agent incidents over the last two years (chatbots binding $1 sales, AI coding agents deleting production databases, prompt-injected enterprise assistants exfiltrating data) has trained procurement teams to ask the same question they ask about cyber: is this vendor a transferred risk or one we absorb?

If you are an AI vendor in 2026, expect this question on every enterprise deal. The vendors who close those deals will be the ones who answer it well.

Bottom line

When a customer asks for AI liability coverage, three actions this week.

1. Write the clarifying email back to procurement. Get specific about what they need.
2. Audit your current insurance and your data room. Know what you can credibly send.
3. If you do not yet have affirmative AI coverage, start the process. An independent risk certification is a credible bridge while you bind.

If you want an independent assessment of how your AI agent would grade against a structured rubric, start here.