In the middle of the nineteenth century, America had a technology problem that will sound familiar: a general-purpose machine spreading through every industry faster than anyone could make rules for it, with a habit of occasionally destroying the building it was in.

Steam boilers exploded. Not metaphorically. And the institution that eventually made them stop was not a legislature, because the legislatures of the era were decades away from writing meaningful boiler codes. It was an insurance company. Hartford Steam Boiler wrote the engineering standards and sent its own inspectors into factories, for the least idealistic reason available: it was the party that paid when the machines blew up. Underwriters Laboratories, the UL stamped on the bottom of every appliance you own, exists for the same reason. Fire insurers needed electrical products tested before any government cared.

Notice the order of events, because this post's entire forecast is that the order repeats. The insurer built the measurement apparatus first. Then it priced compliance into premiums. Then, decades later, public regulation arrived and mostly codified what the insurers had already written.

The figure peering at the boiler in that drawing is not from the government. They are from the carrier, and the factory owner waiting behind them understands the real rule of the era: the machine runs when the inspector says it runs.

So here is the claim, stated so it can lose. Between now and 2030, in every domain where an AI failure can produce a large legible loss, finance, medicine, autonomous operations, cyber-adjacent anything, the binding limit on deployment will be set by underwriters and reinsurers rather than by legislation. The corpus puts a number on the visible half: roughly 70% that by 2030, AI-specific liability coverage exists as a distinct line of business with published rates. The rate table, when it exists, will tell you more about real-world AI risk than any benchmark ever has.

Why the underwriter moves first, every time#

The mechanism has no politics in it, which is exactly why it is fast.

A firm that wants to deploy an autonomous system needs coverage, because boards do not approve uninsured tail risk. The insurer must quote. To quote, it must form a view on failure rates, severity, and correlation. The view becomes a price, the price becomes a condition, and the condition binds continuously, repriced at every renewal, while legislation binds discretely, after hearings, with a lag measured in years.

And insurers write conditions, not just prices. Underwriters demanding logging, human checkpoints, and vendor indemnities as terms of coverage are already writing the de facto AI deployment code, clause by clause, the way Hartford's inspectors wrote the boiler code. Where AI is uninsurable, it does not get deployed by any organization with a board, regardless of capability. That constraint is harder than regulation, arrives earlier, and is set by people with their own money at stake rather than people with positions to defend.

The refusals matter more than the acceptances. What gets covered, per the corpus: errors in bounded, auditable, human-checkpointed workflows, and professional liability where a licensed human signs. What gets excluded or capped: fully autonomous action in high-severity domains, anything the model provider will not indemnify, and, above all, correlated failure. Call that table the Exclusion Map, because it is the real chart of where autonomy can operate, and it will be redrawn at every renewal for the rest of the decade.

The correlation problem, which is the whole problem#

Insurance works when losses are independent. One house fire does not cause another. AI risk is correlated by construction, in three stacked ways: a small number of foundation models sit underneath an enormous number of insureds, a single failure mode manifests everywhere the model runs at once, and update cycles are synchronized, so everyone inherits the new behavior on the same day.

That is the drawing an actuary sees when they look at the AI economy: every building wired to the same cloud, and the lightning, when it comes, arriving at all of them in the same instant. You cannot pool risks that all fire together. Pooling them is just holding them.

The industry has seen this shape before, in cyber, and handled it badly: NotPetya, MOVEit, and CrowdStrike were each a single failure billed across thousands of policies at once. AI concentration is worse on every axis, fewer effective providers, deeper integration, faster propagation. Which is why the open uncertainty in the corpus is not whether an AI liability product exists by 2030. It is whether the high-severity tail is insurable at any price the real economy will pay. If it is not, the deployment frontier stops being a capability question entirely and becomes a reinsurance and sovereign-backstop question.

The market will run the cyber script, compressed#

Insurance capacity does not reprice smoothly after a surprise. It withdraws. After Hurricane Andrew bankrupted a dozen Florida insurers in 1992, private coverage did not get more expensive, it got unavailable, and the state's residual market became the insurer of last resort for decades. Cyber ran a compressed version after the 2019 to 2021 ransomware years: premiums roughly doubled, sublimits and coinsurance appeared, and war exclusions were rewritten in the middle of the market.

So here is the pathway, in order, each step observable before the next.

Now through the first event: the soft market. Cheap AI riders written into cyber and professional policies, on no loss history, priced by competition for premium. The corpus is blunt that this phase is evidence of nothing. Do not score insurability on 2026 brochure rates.

The event. The first failure that hits many insureds through one model at once. The likeliest venue is wherever propagation is fastest and the losses most legible, which points at finance and cyber rather than medicine, where the loop still has humans in it.

The following two renewal cycles: the hard market. This is where the forecast gets specific about what to watch. The response will not primarily be higher prices. It will be wording: aggregate limits, event exclusions, redefinitions of what counts as human in the loop. The Exclusion Map gets redrawn mid-market, the way cyber's war exclusions were. Prices are how insurers say yes carefully. Exclusions are how they say no, and no is what binds.

The layer above: the ceiling. Primary insurers only write what reinsurers will backstop, so aggregate AI capacity for the whole economy converges to what a handful of reinsurance treaties will bear. Call it the Insurance Ceiling: the point where deployment stops tracking capability and starts tracking treaty renewals. A very small number of people in Munich, Zurich, London, and Bermuda end up setting the world's effective autonomy budget, and January treaty renewals become de facto AI policy dates that no newspaper covers as such.

Within 18 months of the event: the backstop fight. The corpus's model of AI politics is that coordination is event-driven, with a roughly 18-month window after a salient incident in which the regime gets set. Expect the standing proposal to be the terrorism-reinsurance template, the state as reinsurer of last resort for correlated AI loss, legislated after the first event, not before. Whether that unlocks deployment or loads it with political conditions is the live branch, and it is the second scorecard row this post opens.

"Courts and Congress set liability, not insurers"#

Eventually, yes. But look at where the law will actually come from in the meantime, because it is not the courtroom you are picturing.

Adjudicating an AI claim requires a proximate cause, and an agentic failure chain smears causation across a user's instruction, a deployer's configuration, a model's behavior, a tool's output, and possibly another firm's agent replying. The doctrinal fights of the late 2020s will accordingly be contract-wording fights: where the vendor's indemnity ends and the deployer's errors-and-omissions begins, whether an agent's action was an occurrence under language drafted for human employees. And the venue will be subrogation, one insurer suing another to allocate a loss they have already paid. That is the same unglamorous path products-liability doctrine took a century ago. AI causation law gets made by carriers arguing with carriers, and the statutes arrive later to codify the settlements.

Meanwhile the single most informative public document in AI is one almost nobody reads as such: the indemnification clause in a frontier lab's enterprise contract. Game 1 calls indemnification breadth the revealed map of how much labs believe their own reliability claims. Narrow indemnities under broad marketing is the equilibrium a race predicts. Watch for the first lab to break from it, because that is either confidence or a bid to keep the insurance channel from becoming the bottleneck, and both are news.

What this does to every other forecast#

One consequence reaches beyond insurance, and the corpus states it in a form worth quoting whole: if AI liability is expensive to insure, the scarce complement in most professional domains is not expertise, it is the balance sheet capable of absorbing residual risk.

Reread the professions with that substitution. The radiologist's moat is not diagnostic skill, which the models are eating, it is that a malpractice policy exists covering a human radiologist and none yet covers an autonomous system. The auditor's moat is the same. So is the lawyer's, which is what the apprenticeship post meant by accountability being the half of seniority that AI cannot mint. The human moat, examined closely, is mostly a financial artifact. And financial artifacts change by underwriting decision, on renewal timelines, which is the most plausible mechanism by which every timeline in the corpus turns out too slow. One carrier deciding to cover an autonomous system, with reinsurance behind it, moves a deployment frontier that a decade of capability gains could not.

What would prove this post wrong#

• Broad provider indemnification at scale. If frontier labs absorb customer liability across their enterprise books, the risk gets carried inside the labs and the insurance market never becomes the binding layer. The Exclusion Map still exists, but it is written in Redmond and San Francisco rather than in treaty language.
• Correlation proving overstated. If real deployments turn out diverse enough, different models, scaffolds, and failure modes, then losses stay poolable, capacity arrives early, and the Insurance Ceiling never binds. Score this on post-event exclusion language and reinsurance terms, not on the soft market's prices.
• Captives routing around the market. Large deployers can self-insure through captives and never buy the coverage. The pricing still happens, but privately, and this post's public signposts, the rate tables and exclusion pages, stay thin while the mechanism works invisibly. Half right, unscoreable, which counts as wrong for a forecast blog.
• A statute arriving first. If a major jurisdiction enacts binding AI liability rules before the first correlated event forces the issue, the legislature will have beaten the underwriters to the pen, and the ordering claim at the top of this post fails on its own terms.

Somewhere in the next few years there is a meeting in which a company with a working autonomous system, benchmarks passed, demo flawless, regulators satisfied, does not deploy it, because the renewal quote came back with a new exclusion on page forty.

No hearing will be held about that decision, and no one will vote on it. The boiler code came second. The inspector always comes first.