CNBC Asked About AI Risk. Here Is the Gaping Hole.

On October 28, 2026, CNBC published a story on Anthropic's IPO filing under the headline "Anthropic IPO filing warns some risks may be uninsurable. AI coverage will be issue for every company." Reporter Kevin Williams asked me where the coverage actually stands for a business using AI today. This post is the long version of what I told him, with the parts an article does not have room for.

The short version is in the article. Cyber is doing most of the work. It covers one kind of AI loss. The loss nobody is covering is a person getting hurt.

What Anthropic told the SEC

The filing is a Form S-1, and the language is plainer than most people expect from a securities lawyer. In the risk factors, Anthropic writes that "the insurance market for AI-specific risks is nascent and evolving, and we may be unable to obtain coverage for certain AI-related liabilities on commercially reasonable terms, or at all, leaving us exposed to potentially significant uninsured losses."

Read that again with your own business in mind. A company that builds the models cannot buy full coverage for what the models might do. If the people with the biggest budgets and the best brokers cannot place it, the medical practice using an AI scribe and the dental office using an AI scheduler are not going to find it on a quote form either. That is the point of the CNBC piece, and it is correct.

Where cyber covers AI today

Here is what I told CNBC, word for word: "Right now, cyber is the policy doing the most to cover AI, but it only covers one kind of AI loss. Cyber responds when AI is involved in a data breach, a privacy violation, a system outage, or a deepfake wire fraud."

Those four triggers are real and they are already paying claims. An employee pastes client records into a public AI tool and they leak: breach. An AI system profiles customers in a way a privacy law prohibits: privacy violation. An AI vendor's outage takes your operation down: system interruption. A cloned voice of the owner tells the bookkeeper to wire money: funds transfer fraud. Some cyber carriers have widened their wording in the last year to say plainly that AI-driven security events count. That is useful, and if your cyber policy renews this year, ask for that wording.

Every one of those losses has the same shape. Data was exposed or money moved. Cyber was built for exactly that.

The gaping hole

This is the part I called a gaping hole, and I stand by the phrase: "Nearly every cyber policy excludes bodily injury. Cyber was built for data and dollars, not for people getting hurt."

Picture a medical practice using an AI scribe. The scribe listens to the visit and writes the note. It drops a medication from the list, or records the wrong dose, and the physician signs the note without catching it. The patient is harmed. That is a bodily injury claim. The cyber policy will not pay it, because cyber was written for data and dollars. The practice's malpractice carrier is going to ask who was actually making the decision, the physician or the software. And there is no AI policy on the shelf to fill the gap. Not for Anthropic, and not for the practice down the street. The same shape shows up anywhere AI sits between a business and a person: a chatbot answering a customer's medical question, an AI tool reviewing a structural drawing, a screening tool deciding who gets the safety-sensitive job.

So the question moves to the general liability policy, and here is where it gets uncomfortable. General liability does cover bodily injury. Whether it responds to an injury that traces back to an AI decision depends on how the AI was used and on the exclusions sitting on that specific form, and carriers are adding AI exclusions to forms right now. The professional liability policy has the same problem in reverse: it was written for advice a human gave. No two policies answer this the same way, which is why I will not give a blanket answer on it. I read the form.

The article has experts on both sides of whether AI coverage becomes its own product or gets folded into cyber. My view, which CNBC printed, is that the financial-loss side becomes routine and gets priced like cyber. Bodily injury is the hard line. Expect tight underwriting, low sub-limits, and a requirement that a human reviews what the AI does before it reaches a patient or a job site.

We have seen this movie

I also said this to CNBC, and it is the part that matters most if you run a business: "We've seen this before with cyber insurance. First insurers stopped covering it, then they created separate policies for it, and their checklists ended up setting the rules companies followed. I expect the same with AI: for many businesses, insurers will set the standards before the government does."

That is not a prediction. It is how the cyber market went from 2015 to 2022. The carrier's application became the security standard. No multi-factor authentication, no policy. No offline backups, no policy. AI will go the same way. The underwriter's checklist will tell you whether a human has to approve the AI's output, how you log it, and what you may not let it touch, long before a statute does.

And the uncomfortable part, which CNBC also printed: "Insurance companies come out with a new product, then the claims come in, and they won't renew the policy." When that happens, the carrier walks away and the independent agent is the one on the phone with the business owner who thought he was covered. I have had that call. I am expecting a lot more of them.

What a Florida business should do this month

None of this requires buying a new policy today. It requires knowing what you have.

1. Write down every place AI touches a customer, a patient, a job site or a hiring decision. Not the tools in the marketing deck. The ones your staff actually use, including the free ones. 2. Pull the cyber policy and read the definition of a security event. If it does not mention AI-driven events, ask the carrier for the broadened wording at renewal. 3. Find the bodily injury exclusion in the cyber policy. It is there. Then find any AI exclusion on the general liability and professional liability forms. If any of the AI uses in step one could hurt a person, that is the gap, and it needs a conversation before the claim, not after. 4. Check your contracts. If a client contract makes you responsible for AI-assisted work product, the contract has just defined your exposure, whatever the policy says. 5. Put a human in front of the AI where a person can be hurt. That is what the underwriters will require anyway, and it is the one control that actually lowers the odds of the claim.

The point

Anthropic told the SEC it may not be able to insure what its models do. Your business is downstream of those models. The data and dollar losses have a policy. The injured person does not, yet. Find out which side of that line your AI use sits on before a carrier finds out for you.

Sources

• Kevin Williams, "Anthropic IPO filing warns some risks may be uninsurable. AI coverage will be issue for every company," CNBC, October 28, 2026. cnbc.com. All quotations attributed to Dennis Hendrickson above appear in this article.
• Anthropic, PBC, Form S-1 registration statement, filed with the U.S. Securities and Exchange Commission, 2026, risk factors. sec.gov.

Coverage descriptions are general. Actual coverage is governed by the terms, conditions, and exclusions of the issued policy. Availability varies by carrier and by state.