Real Safety AI Foundation / Research

Policy, Enforcement, and Implementation

Selling Control Without a Backstop: AI Governance Frameworks, the Uninsurability of Artificial Intelligence, and the Vendor in the Civil Liability Chain

Publisher: Real Safety AI Foundation

Working draft. Not peer reviewed.

Written
June 2026
Version
v2
Pages
13
Download PDFPlain language slides (PDF)Export BibTeXExport RIS

Abstract

A market has formed around the sale of artificial intelligence governance. Vendors offer frameworks, audits, maturity models, and certifications that promise an enterprise it can deploy AI responsibly and demonstrate that it did. This article argues that the governance market is selling a form of control over a risk that the insurance market has just declared it will not underwrite, and that the gap between those two facts has a legal shape. As of late 2025 and into 2026, major carriers filed to exclude artificial intelligence liabilities from standard corporate policies, and the standard form publisher for United States commercial general liability released endorsements that carve generative AI out of the baseline coverage that most businesses carry. Regulatory enforcement, where it reaches at all, terminates at the deployer. The result is a civil loss-allocation vacuum: when a deployed system causes a third party harm, the loss lands on the deployer’s balance sheet with no insurer behind it and no statute reallocating it. Into that vacuum the governance vendor has inserted itself, not by accident but through its own marketing, holding out its framework as the thing that makes deployment safe and defensible. This article develops three claims. First, control over a contemporary AI system cannot honestly be sold, because the system is stochastic in output, open in action space, and indifferent as to substrate, so no framework can promise the determinacy the sale implies. Second, when a framework is marketed as the assurance on which a deployer reasonably relied, the vendor has volunteered for a place in the civil liability chain that regulation does not give it and that an indemnity clause cannot fully cure. Third, the governance genre asks four familiar questions and never asks the fifth, which is whether the buyer and the people the buyer’s system will affect have been told, in plain terms, that the risk is uninsured. The article closes on that fifth question.

Keywords

  • artificial intelligence governance
  • insurability
  • civil liability
  • loss allocation
  • vendor liability
  • negligent misrepresentation
  • EU AI Act
  • ISO CG 40 47

Plain language slides

First slide of the plain language summary of Selling Control Without a Backstop: AI Governance Frameworks, the Uninsurability of Artificial Intelligence, and the Vendor in the Civil Liability ChainOpen the 14-slide summary (PDF)

Suggested citation

Gilly, Travis. "Selling Control Without a Backstop: AI Governance Frameworks, the Uninsurability of Artificial Intelligence, and the Vendor in the Civil Liability Chain." Real Safety AI Foundation Working Draft, June 2026. https://realsafetyai.org/research/d8mpxh/

Other versions

This paper is also posted on SSRN.

SSRN version

References (21)

This paper cites its sources in footnotes. Each authority is listed once, where it is first cited, with its footnote number.

  1. Footnote 1.Lee Harris & Cristina Criddle, Insurers Retreat from AI Cover as Risk of Multibillion-Dollar Claims Mounts, Fin. Times (Nov. 23, 2025), https://www.ft.com/content/abfe9741-f438-4ed6-a673-075ec177dc62.
  2. Footnote 2.Major Insurers Move to Avoid Liability for AI Lawsuits, Tom’s Hardware (Nov. 25, 2025) (quoting the “any actual or alleged use” language and describing the systemic, correlated, aggregated risk that drove it).
  3. Footnote 4.Exclusion — Generative Artificial Intelligence (Coverage B Only), Form CG 40 48 01 26 (eff. Jan. 1, 2026).
  4. Footnote 5.Cyber Re/insurance Market Hits New High as AI Risks Reshape Coverage, Reinsurance Bus. (May 4, 2026).
  5. Footnote 7.Geneva Ass’n, Gen AI Risks for Businesses: Exploring the Role for Insurance 1–3 (Oct. 2025).
  6. Footnote 9.Moffatt v. Air Canada, 2024 BCCRT 149 (Can. B.C. Civ. Resol. Trib.).
  7. Footnote 11.Insurance Carriers Quietly Back Away from Covering AI Outputs, CIO (Apr. 2026).
  8. Footnote 12.ISO CG 40 47 AI Exclusion Forces a GL Rate Adequacy Rethink, actuary.info (May 22, 2026).
  9. Footnote 13.ISO Just Made AI Exclusions Standard, Insurance Intel (May 18, 2026).
  10. Footnote 14.Munich Re, Insuring Generative AI: Risks and Mitigation Strategies (white paper).
  11. Footnote 15.The Insurance Industry Just Became AI’s Most Powerful Regulator, Modulos (Mar. 24, 2026).
  12. Footnote 17.Proposal for a Regulation Amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as Regards the Simplification of the Implementation of Harmonised Rules on Artificial Intelligence (Digital Omnibus on AI), COM (2025) 836 final (Nov. 19, 2025).
  13. Footnote 18.Arthur Charpentier, Insurers and AI, a Systemic Risk, Freakonometrics (Nov. 25, 2025).
  14. Footnote 19.Inst. of Int’l & Eur. Affairs, The Transition to a New Digital Policy Agenda (Dec. 15, 2025).
  15. Footnote 20.Major Insurers Are Pulling Back from AI Liability, Metropolitan Risk Advisory (Nov. 24, 2025).
  16. Footnote 26.Restatement (Second) of Torts §552 (Am. L. Inst. 1977) (information negligently supplied for the guidance of others).
  17. Footnote 26.Nycal Corp. v. KPMG Peat Marwick LLP, 688 N.E.2d 1368 (Mass. 1998).
  18. Footnote 27.Restatement (Second) of Torts §324A (Am. L. Inst. 1977) (liability to third persons for negligent performance of an undertaking).
  19. Footnote 27.Indian Towing Co. v. United States, 350 U.S. 61 (1955) (Coast Guard that undertook to operate a lighthouse and let the light fail, inducing reliance, could be held to the good-Samaritan duty to use due care in the undertaking).
  20. Footnote 28.Restatement (Second) of Contracts §195 (Am. L. Inst. 1981) (a term exempting a party from liability for harm caused intentionally or recklessly is unenforceable on grounds of public policy, and a term exempting a party from liability for negligence is unenforceable in defined circumstances, including where the party charged is a professional whose service is of importance to the public).
  21. Footnote 28.Tunkl v. Regents of University of California, 383 P.2d 441 (Cal. 1963)

All research