Episode Details

A startup whose AI vendor causes a customer harm outside the vendor’s contract and outside the startup’s own technology errors and omissions policy pays for that harm itself, out of its own cash, because the customer never had a contract with the vendor in the first place. Every dollar of that claim comes off the same balance sheet a venture investor is counting on to reach the next milestone.

Most founders read the indemnification paragraph in their AI vendor’s order form, see the word indemnify, and stop reading closely. The paragraph they stop at almost always covers exactly one thing: a third party’s claim that the model’s output infringes that third party’s patent, trademark, copyright, or trade secret. It says nothing about the claim that actually lands on a startup’s desk this year, the one where the model got a fact wrong, produced a discriminatory output, or gave a customer legal or medical guidance nobody asked it to give. Read the exclusion sitting in the startup’s own insurance binder and the picture gets worse, not better.

OpenAI’s commercial API terms cap indemnification at the customer’s own fees paid and cover only third party intellectual property claims, never a model’s factual error. Anthropic’s commercial terms are built the same way: a defense against a copyright claim tied to authorized use, conditioned on the customer having followed Anthropic’s own usage policy, and nothing broader. Both companies cap total exposure, intellectual property claims included in most deployments, at roughly twelve months of the fees the customer paid. A startup paying a vendor $100,000 a year has negotiated, whether anyone in the room said so out loud, a ceiling of about $100,000 against a claim that regulators or a class of harmed customers could push into the hundreds of millions.

The insurance side closed at almost the same moment. Insurance Services Office endorsement CG 40 47, filed for the January 2026 policy period, excludes bodily injury, property damage, and advertising injury arising from generative AI out of standard commercial general liability policies. Two companion forms, CG 40 48 and CG 35 08, narrow the same exclusion to advertising injury and to products and completed operations coverage. Because Insurance Services Office forms underpin roughly 82 percent of the property and casualty policies written in the United States, that filing did not stay a specialty problem. State regulators have approved more than 80 percent of the AI exclusion filings submitted to them, led by Florida, Connecticut, and Maryland, and Berkley went further still, writing an absolute AI exclusion into its own directors and officers, errors and omissions, and fiduciary liability forms.

A March 2026 report from Gallagher Re, Smart Systems, Blind Spots, gave the mechanism a name: hallucinated outputs, biased decision making, model drift, and contaminated training data fall outside cyber, technology errors and omissions, product liability, and general liability coverage at the same time, in the same claim. The report’s warning is not abstract. A fault inside one widely used foundation model can trigger correlated claims against every company built on top of it inside a single underwriting cycle, which is exactly the kind of concentrated exposure a carrier writes an exclusion to avoid.

None of this is new in kind, only in scale. In Moffatt v. Air Canada, the Civil Resolution Tribunal of British Columbia held the airline liable for negligent misrepresentation after its own website chatbot invented a bereavement fare policy that did not exist, awarding the passenger $812.02 in February 2024. Air Canada told the tribunal the chatbot was responsible for its own words. The tribunal did not accept that. A company answers for what its automated tool tells a customer, whether the company built that tool in its own shop or licensed it from a vendor three layers down the stack. Swap the in house chatbot for a licens