Settle Liability and Insurance Before High-Risk Deployment
If this AI causes real harm, who bears the cost — and are we covered?
Enhanced: 22 controls
Who it applies to
Enter for every AI system whose letter is E or A (this area has no Baseline controls). Go as deep as your system letter, and implement in your mode.
Why it exists
Decide who bears the cost of AI-caused harm, and confirm your insurance actually covers it, before you deploy anything high-risk. Organisations discover the gap after the harm: that their existing insurance excludes or does not contemplate AI-driven decisions, and that the contract left liability unallocated. Close both before launch, because the moment of harm is the worst possible moment to learn who pays.
What to actually do
Establish who is liable for AI-caused harm, in the contract and in law. Before a high-risk system launches, know how liability is allocated between you, your provider, and any other party, and where the law places it irrespective of contract.
Confirm your insurance covers AI-driven decisions — do not assume it does. Check explicitly whether your cover contemplates harm arising from automated and AI-assisted decisions; many policies predate the exposure and exclude it by silence. Close the gap before the deployment, not after the claim.
Controls
Enhanced2 controls
Control 188
Establish liability allocation before deploying high-risk AI.
EnhancedPreventiveall rolesper system
What it is
Contractual and legal, documented and accepted.
How to implement it · Steps
List the harms the system could cause: to people, to clients, financial and reputational
Map who bears each harm under the contracts: the organisation, the provider, integrators, clients
Identify, with legal advice, where the law places liability regardless of contract
Record the residual liability the organisation keeps and how it is limited or covered
Have management formally accept the allocation before go-live
How to start
Make the liability analysis a launch condition for this system: it does not go live until the analysis is signed.
Evidence
The liability analysis for the deployment and management's acceptance, dated before launch.
Mode: light / standard / full
light
A one-page analysis prepared with an external lawyer and signed by the owner-manager.
standard
Prepared by legal and accepted by the system's business owner and the risk owner.
full
A mandatory step of deployment approval run by legal and risk, escalated to the board for the highest-risk systems.
Control 189
Confirm insurance cover for AI-driven harm, and close any gap.
EnhancedPreventiveall rolesper system
What it is
Verified explicitly before launch, not assumed.
How to implement it · Steps
Describe the system and the harm it could cause, in writing, to the broker or insurer
Ask explicitly whether current policies (liability, professional, cyber) cover harm from automated or AI-assisted decisions
Obtain the answer in writing, noting exclusions and limits
Close any gap: endorsement, new cover, contract change, or a recorded decision to accept the risk
Recheck at renewal and whenever the system's use changes
How to start
Send the broker a written description of this system and ask whether the current policies cover harm arising from its decisions.
Evidence
The insurer's or broker's written confirmation and the record of how any gap was closed.
Mode: light / standard / full
light
The owner-manager asks the broker by email and files the reply with the system's records.
standard
Finance or risk handles the enquiry and checks cover at each renewal.
full
The insurance function reviews AI exposure across all systems and negotiates specific cover.
Evidence
The liability analysis per high-risk deployment; the insurance-cover confirmation and any remediation of gaps.