The AI Insurance Coverage Gap Coming to Canada

Spencer Brawner - The AI Security Guy · 24 Jan 2026 · 7 min read

Your AI exposures are being quietly excluded from liability policies on the other side of the border—and Canadian insurers are taking notes.

If you've been following the real estate commission wars, you know how this story goes: The United States has a massive market disruption (the NAR settlement), industry groups fight it, and then the same changes inevitably arrive in Canada—just more gradually, and with more complexity because we navigate provincial regulations instead of a single national framework.

We're watching that exact pattern unfold right now with AI insurance coverage. And if you're waiting for the "Big Bang" moment to react, you're already too late.

The US Canary in the Coal Mine

Starting in January 2026, the Insurance Services Office (ISO)—the US insurance industry's standard-setting body—rolled out absolute AI exclusions for commercial general liability coverage. Multiple US states have already approved these forms. Major carriers like AIG, Berkley, and Great American are implementing them now.

These exclusions cover bodily injury, property damage, and personal or advertising injury arising from "generative artificial intelligence"—defined broadly as any machine-based learning system that can create content including text, images, audio, video, or code.

Sound familiar? It should. We've seen this movie before with "silent cyber" in the 2010s. When traditional insurance products start excluding emerging risks, those exposures migrate to cyber policies through ambiguous language that wasn't written for these scenarios.

Now we're watching the sequel: "silent AI."

Why Canadian Organizations Should Care Right Now

Unlike the real estate commission fight—where RE/MAX Canada settled in October 2025 for $7.8 million while CREA continues fighting—there's no class-action lawsuit forcing Canadian insurers to show their hand. They're making these decisions quietly, policy by policy, renewal by renewal.

But the trend is unmistakable:

Coalition, a major cyber insurance provider, launched AI/deepfake coverage in Canada in December 2025—alongside the US, UK, and Australian markets. They wouldn't be building specialized AI coverage products unless they saw standard policies failing to address the exposure.

Air Canada learned this the hard way when a tribunal forced them to honour a refund policy their chatbot invented. The airline actually argued the chatbot was a separate legal entity responsible for its own actions. The tribunal disagreed. That's operational AI liability landing exactly where general liability policies are now excluding it.

The Privacy Commissioner of Canada is actively investigating deepfake creation on platforms like X, expanding inquiries into whether companies obtained valid consent for using personal information in AI systems. That's regulatory risk creating exposure before the insurance industry has figured out how to price it.

And critically: AIDA (the Artificial Intelligence and Data Act) remains stalled, creating regulatory uncertainty that insurers hate. When underwriters can't predict the regulatory environment, they respond by excluding coverage or pricing for worst-case scenarios.

The Coverage Migration Pattern

Here's what makes this particularly problematic for Canadian CISOs and risk managers: cyber insurance policies haven't caught up to exclude AI risks yet. Some carriers are actually adding AI endorsements to clarify they still cover losses initiated by AI threat actors.

This creates bizarre asymmetry:

Your cyber policy will cover you when AI-powered deepfakes trick your CFO into wiring $3 million to fraudsters (the Arup Engineering incident that cost $25 million).

But what about when your AI chatbot gives harmful medical advice? When your hiring algorithm systematically discriminates? When your content generator violates copyright? When your AI system makes a safety-critical error that causes physical harm?

Those aren't cyber events. They're operational AI failures—exactly what general liability policies are starting to exclude.

Alexandra Bretschneider, VP and cyber practice leader at Johnson Kendall Johnson, describes it perfectly: "AI creates a murkiness of new exposures that, really, to me, are not a far cry from some of the silent cyber risks we were experiencing to begin with."

The Sublimit Trap (And Why It Matters for Your Budget)

The likely outcome—based on how insurers handled similar coverage migrations—is small sublimits for AI-specific risks buried in cyber and Tech E&O policies.

Let's be concrete about what this means for Canadian CISOs:

Scenario: Your AI customer service system gives incorrect medical advice to a vulnerable user who suffers harm.

Potential legal costs: $500K - $2M (defence, settlement, regulatory investigations)
Blast radius: Every interaction that system has handled becomes discoverable evidence
Regulatory exposure: Privacy Commissioner investigation, potential PIPEDA violations, provincial health authority involvement
Remediation costs: Third-party audit, system replacement, notification requirements
Reputational damage: Quantify lost revenue, customer churn, impact on valuation for Series A-C companies

Your cyber policy sublimit for AI exposures? Probably $500K.

Now multiply that scenario across every AI system in your organization. Your developers are using code generation tools. Marketing is using content generators. HR is screening resumes with AI. Customer service is deploying chatbots. Each one creates uncovered exposure.

You're going to have to decide which of your AI systems you can afford to self-insure.

The Provincial Complexity Layer

Unlike the US—where ISO forms create relatively standardized policy language—Canadian insurers navigate provincial regulation. That means AI exclusions may appear:

In different forms across provinces
Carrier by carrier rather than industry-wide
With varying definitions of what constitutes "AI"
At different times depending on provincial approval processes

Ontario companies operating under TRESA-style transparency requirements might face different exposures than BC or Alberta companies. Quebec's unique civil code creates its own liability framework. And federally regulated entities face OSFI oversight that adds another layer.

This fragmentation means you can't wait for a single "industry announcement" to know you're affected. You need to audit your specific policies, understand your specific provincial context, and map your specific AI exposures.

What CISOs and Risk Managers Must Do Now

1. Conduct an AI Incident Cost Analysis

For every AI system you're operating, answer these questions:

What's the worst-case failure mode?
What would defence costs be? (Legal, technical expert witnesses, forensic investigation)
What's the blast radius? (How many people/transactions affected, scope of harm)
What are regulatory costs? (Privacy Commissioner investigation, provincial regulators, potential fines under PIPEDA or future AIDA requirements)
What are remediation costs? (System replacement, third-party audits, notification, credit monitoring)
What's the reputational impact in dollars? (Lost revenue, customer acquisition cost for replacements, impact on valuation)

If the total exceeds your cyber policy sublimits by 5-10x, you have a coverage gap that needs addressing.

2. Audit Current Coverage Before Renewal

Pull your GL, D&O, E&O, and cyber policies. Map where AI-related losses would theoretically be covered. Look for:

Any mention of "artificial intelligence" or "machine learning" in exclusions
Sublimits on cyber policies that mention AI
Provincial endorsements that might differ from base policy
Differences between your various provincial operations

If you're renewing in Q2-Q4 2026, expect AI exclusions to start appearing. Negotiate them now while you still have leverage.

3. Build the AI Governance Framework That Insurers Care About

Canadian insurers are asking increasingly detailed questions during underwriting:

Do you have model validation processes with documented human oversight?
What's your incident response plan specifically for AI failures?
How do you ensure PIPEDA compliance in AI training data?
What's your process for bias testing and fairness validation?
How do you handle AI system changes and updates?

Organizations that can demonstrate robust frameworks get better terms. Those without may not get coverage at all—or pay 2-3x more for sublimited protection.

4. Create Cross-Functional AI Risk Teams

This can't be just the CISO's problem. AI liability spans:

CISO: Technical controls, model security, incident response
Legal: Regulatory compliance (PIPEDA, future AIDA, provincial consumer protection laws)
Risk Management: Insurance strategy, quantifying exposures
Privacy Officer: Data governance, consent management, Privacy Commissioner liaison
Lines of Business: Operational context, understanding where AI is actually deployed

They need to meet regularly and speak the same language about AI risk—because when an incident happens, all of these functions will be involved simultaneously.

5. Build Your AI System Inventory

Shadow AI is proliferating across Canadian organizations:

Developers using GitHub Copilot, Claude Code, or other coding assistants
Marketing using ChatGPT, Claude, or specialized content generators
HR using resume screening or interview analysis tools
Sales using AI meeting summarizers or lead scoring
Customer service deploying chatbots on websites or phone systems

Build a comprehensive inventory: every AI system in use, who owns it, what decisions it makes, what data it processes, and what could go wrong. You can't insure—or self-insure—risks you don't know exist.

The Competitive Advantage Hiding in Plain Sight

Here's what most Canadian organizations are missing: This coverage chaos creates competitive advantage for whoever solves it first.

Just like the real estate commission changes—where forward-thinking brokerages adapted their models early and captured market share while others were paralyzed—AI insurance uncertainty creates opportunity.

Organizations building strong AI governance frameworks now aren't just protecting against liability. They're creating operational resilience that enables faster, safer AI adoption. When your competitors are paralyzed by uncovered exposures, you'll be moving confidently because you understand your risk profile.

Insurers price for uncertainty. Organizations that can articulate their AI attack surface, demonstrate effective controls, and show clear accountability structures will separate themselves from the pack—especially important for Series A-C companies where insurance costs directly impact runway and valuation.

The companies getting this right are treating AI risk management like they treated cybersecurity maturity five years ago: as a strategic capability, not a compliance checkbox.

The Timeline: Sooner Than You Think

Don't expect a "Big Bang" moment where Canadian insurers announce industry-wide AI exclusions on a specific date. That's not how our market works.

Instead, expect the RE/MAX pattern:

Q1-Q2 2026: More carriers quietly add AI exclusions to renewals
Q3-Q4 2026: Exclusions become standard for most commercial policies
2027: Specialized AI insurance products mature (higher premiums, stricter governance requirements)
2027-2028: First major Canadian AI liability lawsuits create case law that shapes coverage interpretation

The organizations that thrive through this transition will be the ones that stop treating AI risk as an IT problem or a legal problem and start treating it as an enterprise risk management problem.

They'll build the frameworks, document the governance, create accountability structures, and approach insurance renewals with eyes wide open.

Everyone else will find out about their coverage gaps the hard way—right after an incident they thought they were covered for.

How is your organization preparing for the AI coverage gap? Have you quantified the potential costs and blast radius of your AI systems? What governance frameworks are you building that insurers will actually care about?

Spencer Brawner, CISSP, CISM, CIPP/C, is the founder of Classified Intelligence, an AI governance and cybersecurity consultancy specializing in ISO 42001, EU AI Act compliance, and enterprise risk management for AI systems.