AI Insurance Readiness: The Six Controls Carriers Now Require

For three years your insurance covered AI losses by silence, not by grant. That era ended on January 1, 2026 — the day the Insurance Services Office (ISO) released three generative-AI exclusion endorsements (CG 40 47 broad, CG 40 48 limited, CG 35 08 products/completed-operations) attachable at every Commercial General Liability renewal. In parallel, cyber carriers including Beazley and QBE began introducing AI sublimits around 10% of policy limits, while a new affirmative AI-coverage market — Munich Re/Mosaic, Armilla at Lloyd's, Counterpart, Testudo — emerged that underwrites only on documented governance evidence. This evidence pack is the source-verified breakdown of what changed, what it costs, and what the six insurance carriers we met with said they now require before they will quote or renew AI-touching coverage. Every claim traces to a verified source ledger: ISO form numbers, FT reporting on Beazley/QBE, Munich Re/Mosaic capacity, AIUC-1 standard alignment, NAIC Model Bulletin adoption count, EU AI Act Article 9, plus the four costed receipts (Bartz v. Anthropic ~$1.5B, Moffatt v. Air Canada, Mobley v. Workday, Hasbro Q1 2026 ~$20M). EPC Group is not an insurance company, broker, or producer and does not sell, place, or provide insurance. This pack documents the governance evidence enterprises and their brokers present to underwriters — assembled to recognized standards (NIST AI RMF, ISO/IEC 42001, AIUC-1) and mapped, for multinational exposure, to EU AI Act Article 9.