US securities filing data, broker observations and available exclusion-form wording show why boards should match AI oversight statements to examinable controls—without mistaking evidence for insurance coverage.
Executive takeaways
- Substantiate the statement, not the governance label. A committee charter establishes a governance structure, not whether an incident reached it or a control operated on a specific system, release and reporting period.
- Read your own directors’ and officers’ (D&O) policy wording at renewal. A broker reports that AI exclusions are uncommon in the US public-company policies it arranges, yet an exclusion form bearing Berkley’s name, reaching AI oversight and disclosure allegations, is publicly available.
- Preserve the boundaries of the evidence. Record which systems, versions and periods were examined, the failures and exceptions found, and what could not be established.
The board decision is what the organisation can substantiate
The stakes are visible in US securities litigation: AI-related filings represented 13% of core filings (those excluding merger-and-acquisition class actions) in the first half of 2026 but 73% of two market-capitalisation loss indices—not damages or insured losses. These figures describe concentration, not control failure. [1]
When a company tells shareholders or an insurer that it oversees artificial intelligence, it makes an assertion that may later be tested against its records. A policy, a committee and a dashboard are not equivalent evidence. Each says something different about whether management actually monitored a particular deployment, received an escalation or exercised an approval right.
The board-level decision is to require an evidence basis for material external AI oversight statements before they are issued or renewed. That basis should identify the covered systems, their relevant versions, the reporting period, responsible owners, supporting records and unresolved exceptions. An independent examination can assess a defined assertion against those records. It cannot determine whether directors breached their duties or whether an insurance policy will respond.
This article concerns underwriting risks arising from organisations’ use of AI, not an insurer’s use of AI to automate underwriting.
US litigation evidence indicates concentration, not proven governance failure
Cornerstone Research and the Stanford Law School Securities Class Action Clearinghouse counted 15 AI-related US securities class-action filings in the first half of 2026, compared with 16 across 2025. AI-related filings represented 13% of core filings, but accounted for 73% of both the Disclosure Dollar Loss (DDL) and Maximum Dollar Loss (MDL) indices in that half-year. Two AI-related filings represented 66% of the overall MDL Index. These indices measure specified changes in defendant companies’ market capitalisation; they are not payments to investors, court-assessed damages, insurance claims or insurer losses. The concentration warns against interpreting the headline 73% as typical claim severity. [1]
The 15 filings also covered different and sometimes overlapping categories: AI development, AI infrastructure and hardware, data centres, and AI usage. Seven concerned AI development and five involved data centres. The report identifies three data-centre filings also classified as AI infrastructure or hardware; it does not identify overlap between the AI-development and data-centre groups. Treat these as report-specific categories rather than mutually exclusive sub-totals. This is not a dataset of confirmed failures in the governance of deployed AI agents. ODA3 Institute’s analysis: using the aggregate filing number to quantify operational AI oversight failures would conflate materially different alleged conduct. [1]
In commentary published on 5 October 2026, Aon describes US public-company directors’ and officers’ (D&O) litigation broadening beyond allegations of exaggerated AI capabilities (‘AI washing’). It identifies shareholder derivative claims (shareholders suing on behalf of a company) alleging failures to monitor AI-related risks and securities claims alleging inadequate disclosure of AI risks. Aon reports at least four pending derivative lawsuits alleging AI-related monitoring failures against technology companies. Aon also characterises US courts as paying particular attention to oversight of risks considered “mission critical”. The suits are allegations described by a broker, not court findings, and the “mission critical” point is Aon’s legal characterisation; neither the pleadings nor the court decisions were reviewed here. [2]
Exclusion wording and available D&O cover are not contradictory claims
Aon reports that conventional D&O coverage remains broadly available in its observed public-company placements (insurance policies it has helped arrange), and that it has not observed widespread adoption of AI-specific D&O exclusions. Aon also acknowledges reports that some insurers have filed AI-related exclusions. It also describes greater underwriting attention to AI governance, oversight and disclosure. This is a broker’s account of its experience, not a global market survey or a representation about a particular insurance programme. [2]
The publicly accessible form is direct evidence that exclusion wording has been drafted, regardless of how widely it is used. A copy of Berkley Insurance Company’s unpopulated Artificial Intelligence Exclusion (Absolute), form PC 51380 00 (06-24), hosted by Hunton Andrews Kurth, identifies amendments to forms coded DO, EPL and FLI. DO refers to directors’ and officers’ coverage and EPL to employment practices liability; the form does not expand FLI. Its wording addresses allegations of deficient AI policies and practices, AI-related disclosures and representations, and other categories of AI-linked conduct. Hunton Andrews Kurth discussed the exclusion on 28 May 2025; where its description of the affected lines differs from the form, this article relies on the form. [3][4]
The unpopulated endorsement form (a document that would amend an insurance policy if incorporated), which contains placeholders for the insured, policy number and effective date, establishes that this wording exists; it does not demonstrate attachment to an issued policy. Its current filing, issuance, adoption frequency and judicial interpretation were not established by this review. An exclusion is a provision intended to remove specified claims from policy protection, but whether it does so in a disputed case depends on the complete contract, applicable law and facts.
Both findings can therefore be true: Aon may observe few exclusions in its placements while broad exclusion wording bearing one insurer’s name is publicly available. The executive decision is neither to assume protection nor to assume withdrawal of cover. It is to examine the organisation’s own insuring agreements, definitions, exclusions, endorsements, limits and renewal changes with its broker and suitably qualified counsel.
Examinable evidence must follow the alleged failure mode
A credible chain links AI deployment → plausible failure mode → business consequence → relevant control → examinable evidence → bounded conclusion → remaining uncertainty.
For example, consider an agent authorised to change production infrastructure. A plausible failure mode is executing a consequential action after approval authority has changed, potentially causing an outage. An outage can require restoration work and generate costs, but whether it caused measurable financial loss requires separate records. Any claim that directors failed to oversee the relevant risks requires facts and applicable law; whether a D&O policy responds then requires the actual wording, allegations and circumstances. Controls might include permission revocation, execution-time approval and change management. Records might include the permission snapshot, approval decision, action trace, release identifier and exception log. An examination could establish whether a particular sampled action complied with a specified rule at a specified time—not that every action was safe, a loss occurred, management was legally liable or a D&O insurer must pay.
Those last four determinations remain distinct: technical failure, actual financial loss, legal liability and insurance coverage. None follows automatically from another.
The insurer–organisation evidence exchange works in both directions
Insurer → organisation. An underwriter can ask whether management is describing control design or observed effectiveness; which AI activities and alleged conduct fall within the proposal; whether a claim concerns disclosure or operational failure; and whether an independently examined record speaks to the deployed system and relevant time. These are proposed examination questions, not a universally required D&O checklist.
Organisation → insurer. Management can maintain a statement-to-evidence register with scope, version, time, owner, artefacts, exceptions, and approval or remediation outcomes. This makes statements testable and helps avoid presenting a limited test as organisation-wide proof. Insurers remain responsible for their underwriting decisions; management owns its controls and records; independent examiners assess only the specified subject matter.
| Executive or underwriting question | Evidence to examine | What it can show | What remains uncertain |
|---|---|---|---|
| Which consequential AI deployments require approval? | AI inventory, release-path rules, approval logs, deployed version identifiers | Whether identified deployments had approvals under specified rules | Shadow deployments and whether approval criteria were adequate |
| What material AI incidents reached management? | Incident classification, escalation thresholds, selected cases, committee papers | Whether recorded events triggered and reached the specified escalation path | Unrecorded events, completeness and sufficiency of response |
| Were autonomous agents constrained at execution? | Permissions, decision-time approvals, refusal tests, action traces | Whether limits operated for the actions and configurations examined | Other paths, changed context and adversarial conditions |
| Were significant changes re-examined? | Release history, change decisions, test-to-deployment links | Whether approval and tests correspond to the released version | Undetected changes and the quality of review |
| Were public oversight statements checked against the evidence? | Disclosure drafts, sign-offs and referenced technical records | Whether a particular statement was supported when issued | Whether later changes made the statement stale or incomplete |
| Did material exceptions reach the Board? | Failed tests, exception register, escalation decisions and Board papers | Which known exceptions reached directors and what response was recorded | Undetected exceptions and legal sufficiency of the response |
The relevance of each control depends on the alleged conduct. An intellectual-property monitoring allegation calls for evidence about rights, provenance and escalation; a financial-disclosure allegation about AI infrastructure spending calls for evidence about financial reporting and disclosure controls. Neither can be answered by a generic “AI governance” label.
The table is ODA3 Institute analysis, not a completed examination, insurer-approved standard, certification or assurance rating.
Illustrative scenario — synthetic, not based on an examined system
A company states that every high-impact action by its AI agents requires human approval. It tests one release path before the statement is issued. Three months later, a configuration change introduces another path that bypasses the approval service. The statement may have been supported when issued; the subsequent release changes the period and deployment for which evidence supports the word “every”.
Comparing the statement, approval record, deployed configuration and action traces might establish that the examined control did not cover the later path. If the path is demonstrably outside the promised approval condition, that is affirmative contradictory evidence for a carefully scoped finding. If records for the later path are simply unavailable, the examiner must instead state Unknown, not assert that approvals did not occur. Neither result alone determines misleading intent, loss, breach of directors’ duties or coverage.
Independent examination should preserve what the record cannot show
An independent examiner can assess whether specified controls existed, whether selected transactions followed them, and how those findings relate to a management assertion. Its report should disclose criteria, sampling, versions, dates, exclusions, access limitations, reliance on management-supplied data, conflicts, commissioning party, intended users and permitted reliance. Any implementation or advisory role that could affect independence should be disclosed and appropriately separated.
Preserve failed tests, unresolved exceptions and contrary system behaviour. Do not turn ‘no record supplied’ into ‘no activity occurred’. A formally adverse finding requires affirmative evidence of a contradiction or the absence of a required element; incomplete evidence alone supports a limitation or unknown conclusion.
What leadership should decide before the next disclosure or renewal
| Action | Accountable owner | Decision, evidence and condition for reconsideration |
|---|---|---|
| Reconcile material external AI oversight statements with actual evidence | General Counsel and Chief Risk Officer (CRO) | Narrow or qualify statements that lack period-, system- or version-specific support; reassess when disclosures or deployment scope change |
| Review the entire D&O programme for AI wording | Head of Risk Transfer with Chief Financial Officer (CFO), broker and coverage counsel | Identify any AI exclusions, endorsements and changes across layers; reconsider negotiation strategy if wording or limits change |
| Prioritise evidence continuity for high-consequence AI uses | Chief Information Security Officer (CISO) and AI engineering leader | Require release-linked approvals, action traces and exceptions where consequences justify the effort; adjust scope if autonomy or impact increases |
| Protect the integrity of exception reporting | CRO and Internal Audit | Retain failed tests, omitted-scope notes and remediation decisions; escalate when summaries conceal material adverse evidence |
| Decide where independent examination is warranted | Board Audit or Risk Committee | Approve scope, independence safeguards and intended reliance for material claims; revisit when the statement or evidence users change |
These recommendations support better decisions and more defensible disclosure processes. No evidence examined establishes that they reduce premiums, losses, litigation or liability.
Notably Absent
- No court ruling or original pleading, including any “mission critical” oversight decision, was examined to test the merits of the pending AI oversight cases described by Aon.
- No real insured’s D&O contract was examined, and no claims payment, denial or coverage outcome was established.
- No evidence in the sources checked establishes the frequency with which the Berkley form wording is attached to active policies or how a court would enforce it.
- No data was verified connecting independent AI control examination to D&O premium reductions, exclusions avoided, claim frequency or claim severity.
- The Cornerstone dataset does not establish the number of cases caused by failures of deployed AI governance, nor does its market-capitalisation-loss index measure actual paid losses.
- No jurisdiction-specific insurance practice or regulatory rule for India, the UK or the EU was verified for this analysis. The US litigation observations should not be generalised to them.
- No customer system, board record, insurer questionnaire or independent examination was performed by ODA3 Institute for this article.
Conclusion
A board can make a better disclosure and risk-transfer decision when each material AI oversight statement is connected to evidence for the system, version and period described. US litigation data and available exclusion wording justify scrutiny, but neither proves an insurance outcome. The unresolved empirical question is which operational records—release approvals, action traces or exception logs—underwriters actually rely on when setting D&O terms, and with what effect.
References
[1] Cornerstone Research and Stanford Law School Securities Class Action Clearinghouse. “Securities Class Action Filings: 2026 Midyear Assessment.” Cornerstone Research, July 2026. https://www.cornerstone.com/wp-content/uploads/2026/07/Securities-Class-Action-Filings-2026-Midyear-Assessment.pdf (accessed 16 October 2026).
[2] Adam Furmansky, Nick Reider and Laura Wanlass. “AI-Related D&O Claims and Emerging Litigation Risks.” Aon, 5 October 2026. https://www.aon.com/en/insights/articles/ai-related-do-claims-and-emerging-litigation-risks (accessed 16 October 2026).
[3] Berkley Insurance Company. “Artificial Intelligence Exclusion (Absolute).” Unpopulated endorsement form PC 51380 00 (06-24), form edition June 2024; copy hosted by Hunton Andrews Kurth; publisher, publication and policy attachment dates not established. https://www.hunton.com/assets/htmldocuments/noindex/PC-51380-00-06-24-Artificial-Intelligence-Exclusion-Absolute.pdf (accessed 16 October 2026).
[4] Geoffrey B. Fehling, Michael S. Levine and Alex D. Pappas. “The Continued Proliferation of AI Exclusions.” Hunton Andrews Kurth, 28 May 2025. https://www.hunton.com/hunton-insurance-recovery-blog/the-continued-proliferation-of-ai-exclusions (accessed 16 October 2026).
Methodology note
Source-bounded documentary synthesis distinguishing US securities filing indices, broker placement observations, unpopulated exclusion-form text and law-firm commentary; proposed statement-to-evidence matrix and synthetic scenario; separate determinations for technical failure, financial loss, legal liability and coverage.
Notably Absent
No original pleadings or court decisions examined; no issued insured D&O contract or claims decision examined; no verified adoption rate for Berkley wording; no evidence that independent AI examination improves premiums, exclusions, claim frequency or severity; no demonstrated operational AI-governance failure rate in Cornerstone indices; no verified jurisdiction-specific practice for India, UK or EU; no ODA3 client system examination.
