A typical 2026 scenario involves a company connecting an AI agent to its CRM system to automatically clean duplicate contacts. The agent errs in classification, treats half the customer database as duplicates, and deletes it. No hacker attack occurs and no malicious intent exists on the developer side — the harm stems purely from autonomous execution of an erroneous model output.
Who bears responsibility? The model developer, the integrator who assembled the agent, or the company that deployed it? More importantly, does any party hold an insurance policy that would cover the loss?
Russian Legal Framework
Russian legislation consistently assigns responsibility to a human or legal entity. The National Strategy for AI Development until 2030 and the AI Ethics Code establish that liability must rest with a person or organization. The Code recommends allocating responsibility across lifecycle participants according to their roles, yet this remains guidance rather than binding law.
No dedicated civil-law norm governs AI liability. Harm caused by AI is currently evaluated under general provisions of the Civil Code. Paragraph 18 of Supreme Court Plenum Resolution No. 1 defines a source of increased danger as any activity that creates elevated risk of harm due to the impossibility of full human control. Legal doctrine debates whether an AI agent qualifies; if it does, liability arises under Article 1079 regardless of fault.
Insurance concepts appeared as early as 2020. The Concept for Regulating AI and Robotics until 2024 explicitly listed insurance of liability and compensation funds as mechanisms for compensating AI-related harm. It also noted that foreign markets often require insurance policies as a condition for market entry and proposed a “red button” for system shutdown plus a “black box” for recording incident circumstances.
Mandatory insurance already exists inside experimental legal regimes. Since January 2025, participants in such regimes must insure liability for harm to life, health, and property, including harm caused by AI-driven decisions. This covers unmanned trucks, drones, delivery rovers, and telemedicine. Conditions are set by each regime’s program.
Federal Law No. 243-FZ of 26 July 2026 “On Support for the Development of Artificial Intelligence Technologies in the Russian Federation” grants developers of sovereign or national foundational models the right to insure property interests and liability arising from model use. The provisions defining sovereign and national models enter into force only on 1 March 2027. At the same time, Article 8 obliges developers to maintain technical documentation containing key parameters and model limitations — precisely the information insurers need for risk assessment.
Draft Law vs Final Text
The March 2026 draft “On the Fundamentals of State Regulation of AI Technologies” contained a detailed responsibility chain in Article 11. All participants would be liable proportionally to their degree of fault. Developers, operators, and service owners would be released if they took “exhaustive measures” to prevent unlawful outcomes. Users would remain liable only for intentional acts or violations of usage terms. Operators who compensated victims could seek recourse from developers for hidden model defects.
The draft also addressed situations where no one is at fault: if harm resulted from hidden system defects or unforeseeable third-party actions, both operator and user would be released. In such cases insurance and compensation funds would become essential, yet the draft omitted any mention of insurance mechanisms.
The final law reduced Article 11 to a single sentence stating that participants “bear responsibility in accordance with the legislation of the Russian Federation.”
International Experience and Market Products
Neither the United States nor the European Union imposes mandatory AI liability insurance. Article 26 of the EU AI Act requires users of high-risk systems to maintain oversight, monitoring, and logs for at least six months, but does not mandate insurance. The draft AI Liability Directive was withdrawn in summer 2025.
In the US, liability arises from common law, state statutes, and case law. Texas enacted TRAIGA on 1 January 2026, while Colorado replaced its stricter law with a softer version effective 2027. California’s AB 316 took effect the same day, preventing defendants from arguing that “the AI itself” caused the harm.
Specialized insurance products already exist. Armilla (Lloyd’s) offers up to $25 million aggregate coverage for hallucinations, model degradation, AI-agent actions, and regulatory fines. Munich Re aiSure provides parametric coverage up to €15 million triggered when predefined accuracy thresholds are breached. Testudo (Lloyd’s) covers generative-AI liability up to $9.25 million. HSB (Munich Re) embeds coverage for bodily injury, property damage, and privacy or copyright claims into SME policies.
The AIUC-1 standard from Artificial Intelligence Underwriting Company defines approximately 50 requirements and 130 controls specifically for AI agents. Certification includes third-party audits and extensive agent testing; agents from ElevenLabs have undergone more than 5,000 such tests.
Conversely, major carriers including AIG, W.R. Berkley, Great American, Chubb, Travelers, and Berkshire Hathaway have begun inserting AI exclusions into general liability policies. OpenAI reportedly secured only $300 million in coverage against potential claims reaching billions.
