By: Jennifer Gilligan. IntegraMSP President

As artificial intelligence becomes embedded in daily operations, questions about legal responsibility, insurance coverage, and corporate oversight are becoming more difficult to ignore.

Artificial intelligence is changing how businesses operate, but the legal and financial responsibilities associated with its use are proving more complicated than the technology's rapid adoption might suggest.

Companies are incorporating AI into customer service, financial analysis, employee management, contract reviews, and operational decision-making. Much of that adoption has focused on productivity and efficiency, with less attention given to how responsibility is allocated when automated systems produce inaccurate information, expose sensitive data or contribute to harmful decisions.

That imbalance is becoming more apparent as insurers, regulators and legal professionals examine the risks associated with AI deployment. While technology vendors develop and distribute the systems, the businesses implementing them may retain substantial responsibility for how they are used.

In a Nov. 2 interview published by Business of Tech, Bernhard Kirchner of SynData Labs discussed the growing exposure facing technology service providers and their customers. His central argument was that contractual protections for software developers, emerging insurance exclusions, and regulatory requirements are placing greater responsibility on the organizations operating AI systems.

Although the discussion focused on managed service providers, the implications extend to nearly any business integrating AI into its operations.

Insurance Coverage Is Becoming a Central Concern

One of the clearest indications of the changing risk environment is emerging from the insurance industry, and we're seeing this firsthand with our clients.

Insurance companies are increasingly demanding evidence of security testing, documented safeguards, and ongoing risk management. In the past, assurances that appropriate security measures were in place were often sufficient. Today, insurers are asking for supporting documentation, verification and, in some cases, formal audits.

This shift has significantly changed the relationship among businesses, their technology providers and insurance carriers. Simply implementing security controls is no longer sufficient. Organizations are increasingly expected to demonstrate that those controls are functioning as intended.

Artificial intelligence is now entering these conversations, introducing additional questions about data protection, automated decision-making, and operational accountability. Although the insurance industry's approach to AI-related risks is still evolving, the precedent established through cybersecurity is significant. Businesses are moving from an environment in which having protections in place was often enough to one in which they must be able to produce evidence of those protections. As AI becomes more deeply integrated into business operations, similar expectations for documentation and oversight are beginning to emerge.

In its 2026 analysis of AI-related risk, global insurance broker Aon identified significant uncertainty surrounding coverage for losses involving artificial intelligence. According to Aon, more than 90% of AI-related risks in its litigation-based analysis fall into the category of "silent AI," meaning the relevant insurance policies neither explicitly provide nor exclude coverage for AI-related exposures.

The distinction is important. An insurance policy that does not mention artificial intelligence cannot necessarily be interpreted as providing protection against every loss involving the technology. Businesses may carry cyber, professional liability, general liability, or employment practices insurance without knowing how those policies would respond to an incident involving AI-generated information or automated decisions. The insurance market is responding in different ways. Some carriers are introducing exclusions or restrictions, while others are offering affirmative coverage through endorsements or specialized policies.

Aon has also emphasized that the market is not uniformly withdrawing coverage. Rather, insurers are becoming more selective in how they evaluate AI-related exposure, with greater attention to the systems businesses use and the controls surrounding them.

The uncertainty bears a resemblance to the early development of cyber insurance, when traditional commercial policies were not designed to address emerging digital risks. As claims and legal disputes increased, insurers began clarifying coverage, introducing exclusions and developing specialized products. AI appears to be moving through a similar period of adjustment, although the eventual insurance market may develop differently.

Regulatory Attention Is Expanding Beyond Developers

Insurance is only one part of the emerging accountability question. Regulators are increasingly examining the responsibilities of businesses that deploy AI systems, particularly when those systems influence decisions affecting individuals.

The European Union's AI Act establishes obligations for both technology providers and organizations deploying certain categories of artificial intelligence. For designated high-risk systems, those responsibilities include human oversight, operational monitoring, recordkeeping, and other safeguards, subject to the law's applicable implementation dates. In the United States, the regulatory landscape remains more fragmented, with requirements developing through state legislation, industry-specific regulations and existing consumer protection and discrimination laws.

The insurance industry provides an example of how regulators are approaching corporate responsibility.

In December 2023, the National Association of Insurance Commissioners adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The guidance emphasizes that insurance companies remain responsible for complying with applicable laws when decisions are made or supported by AI, including systems supplied by third-party vendors.

By October 2026, 27 states, Washington, D.C., and Puerto Rico had adopted the model guidance, according to an October analysis of NAIC adoption records. Four additional states, including Texas, had established separate AI-related insurance guidance.

Although these requirements specifically address the insurance industry, they illustrate a broader development in regulatory oversight: Organizations using third-party AI systems may retain substantial responsibility for the decisions and outcomes those systems support. Although the bulletin addresses insurance companies specifically, it illustrates a broader regulatory principle: The use of a third-party AI system does not necessarily relieve an organization of its existing legal obligations.

The degree of responsibility depends on the industry, jurisdiction, contract terms, and circumstances of a particular incident. AI developers may also face liability for defective products, contractual violations, or other legal claims. Nevertheless, the increasing focus on deployment practices suggests that regulators are interested not only in how AI systems are developed, but also in how businesses incorporate them into operational decisions.

A Familiar Pattern in Technology Adoption

The intersection of AI, insurance, and regulatory accountability reflects a pattern businesses have encountered with earlier technologies. Cybersecurity provides perhaps the closest comparison.

As businesses became increasingly dependent on digital infrastructure, technology security gradually evolved from a predominantly technical concern into a broader matter of corporate governance. Data breaches, privacy legislation, insurance requirements, and contractual obligations eventually made cybersecurity oversight a responsibility extending well beyond IT departments.

Artificial intelligence presents a related challenge, but with a different operational dimension.

Traditional software generally follows defined instructions and workflows. Modern AI systems can generate content, interpret data, recommend actions, and operate with varying degrees of autonomy. Their behavior may be influenced by the information they receive, the permissions they are granted and the controls established by the organization using them. As AI becomes embedded in existing business applications, companies may find it increasingly difficult to distinguish between conventional software functionality and AI-supported decision-making.

This creates an additional management consideration. A business may understand which software products it purchases without having a complete picture of the AI capabilities operating within those products or the information those capabilities can access. The challenge becomes more significant when AI systems are connected to financial records, customer information, personnel data, or operational processes. The risks are not limited to whether a particular model produces an inaccurate response. They also involve how businesses validate the information, manage access, define decision-making authority, and respond when something goes wrong.

The Contractual Implications May Be Just as Significant

While regulatory requirements often receive the greatest attention, customer and vendor contracts may become an equally important source of AI-related accountability.

Businesses increasingly depend on interconnected service providers, software platforms, and external data systems. The addition of AI introduces new questions about how information is processed, whether automated systems are involved in delivering contracted services, and which party bears responsibility for errors or disclosures.

Software licensing agreements may limit a vendor's liability or disclaim certain warranties, although the enforceability and scope of those provisions depend on the applicable law and circumstances. At the same time, a business's obligations to its own customers may remain unchanged.

This creates the possibility of a mismatch between the protections a company receives from its technology suppliers and the responsibilities it has accepted under customer agreements. The issue is particularly relevant for businesses handling confidential information, providing professional services or operating in industries where errors can produce significant financial or legal consequences.

It also suggests that AI governance may increasingly become part of vendor due diligence, contract negotiations and customer risk assessments, much as cybersecurity requirements have become common in those processes.

For small and midsize businesses, these developments may be particularly consequential. Smaller organizations often lack dedicated legal, compliance, and technology risk management departments, yet they may be adopting the same AI capabilities used by substantially larger companies.

The Business Implications of AI Accountability

The emerging liability landscape does not necessarily indicate that AI adoption should slow. The technology continues to offer significant opportunities for operational improvement, particularly for businesses seeking to increase productivity without proportionately increasing staffing or overhead.

The more consequential issue may be whether corporate oversight is keeping pace with implementation.

As businesses move beyond using AI to generate content and begin allowing systems to influence or execute operational decisions, the distinction between assistance and authority becomes increasingly important. There is a meaningful difference between an employee using AI to prepare a draft for review and an automated system communicating directly with customers, making recommendations that influence financial decisions or taking actions within business applications.

Those differences affect the potential consequences of an error and the level of oversight that may be appropriate.

For business leaders, AI risk management is likely to become less about whether the organization has adopted artificial intelligence and more about understanding where it operates, which decisions it influences, and how responsibility is assigned. The insurance industry's response, evolving regulatory requirements, and growing attention to contractual liability suggest that the accountability surrounding AI is becoming more defined, even as the technology itself continues to develop. The central question is not whether AI vendors or their customers will bear all responsibility. Both may have obligations, and the allocation of liability will depend on the facts. Rather, it is whether businesses recognize that the decision to implement AI carries responsibilities that may extend beyond their agreements with technology providers. As artificial intelligence becomes a routine part of business infrastructure, its associated risks are also becoming part of ordinary corporate risk management.

The technology may be new, but the underlying question is familiar: When a business relies on a tool to perform its work, how much of the responsibility for the outcome remains with the business itself?

The answer will help shape how organizations purchase, govern, insure, and ultimately trust artificial intelligence.