Read the indemnity clause in your AI vendor’s contract again. Then ask the vendor for the certificate of insurance sitting behind it. Most governance teams do the first and skip the second, and this month’s reporting on AI insurance explains why that second step is the one worth adding before your next renewal cycle.
The number behind the promise
The Wall Street Journal reported on 17 October that frontier AI developers are carrying potential legal liabilities running into the tens, and in some disclosed scenarios hundreds, of billions of dollars from safety incidents and wrongful-use claims. Specialist cover for those same companies tops out far lower. AIUC’s dedicated AI liability cover caps around $50 million per insured, Munich Re’s own aiSure product caps at roughly $15 million per claim, and limits from carriers such as Armilla and Testudo sit in a similar range. Insurers including AIG, W.R. Berkley, Great American, Chubb and Travelers have sought regulatory approval to strip AI-related claims out of standard liability policies altogether, and state regulators have approved the large majority of those requests. Some in the industry are now floating a federal liability backstop modelled on the Price-Anderson Act that underwrites nuclear power, though that is currently an industry request rather than a confirmed government commitment.
Separately, biotech entrepreneur Giorgos Tsetis argued in Fortune the same week that no individual carries personal accountability when an AI system causes harm. Companies absorb fines as a line item. The people who decided to ship the system, underfund the safety review, or ignore an internal warning carry none of that risk personally. Put his point next to the Journal’s numbers and the shape of the problem gets clearer: the financial backing behind an AI harm claim is thinner than advertised, and the personal accountability for causing that harm barely exists at all.
What an indemnity clause actually guarantees
An indemnity clause is a contractual promise to cover your losses if the vendor’s product causes harm. It is not evidence that the vendor can pay. A vendor can offer broad indemnity language and still carry a policy that caps at $50 million, a subsidiary structure that keeps liability away from the parent company, or no AI-specific cover at all because the general liability policy now excludes it by endorsement. None of that shows up in the clause. It shows up in the certificate of insurance, the policy schedule, and the corporate entity that actually signed the contract.
What this changes for PMO and governance review
For anyone standing up governance around healthcare transformation or health information exchange work, this is not an abstract insurance story, it is a contract due-diligence gap sitting inside your next vendor renewal. A contract touching patient data, clinical decision support, or an HIE integration carries exposure that runs into real money if the model gets something wrong: a misrouted referral, a hallucinated clinical summary, a leaked record set. The indemnity clause was written to make a risk committee comfortable signing off. Whether it can absorb a serious incident is a separate question, and until this month nobody had sized how wide that gap actually runs.
What to actually do about it
Three things change in how a PMO should run vendor due diligence from here.
Ask for the certificate of insurance and the stated policy limit before any AI-related contract reaches sign-off, not just the indemnity clause itself. If the vendor cannot produce one, treat the clause as marketing language until they can.
Check whether the policy names AI or algorithmic harm specifically, or is silent on it. A general liability policy written before the vendor’s AI product existed may not cover the product you are actually buying.
Size the gap against your own exposure. A $50 million cap set against a breach touching hundreds of thousands of patient records leaves the bulk of that exposure sitting with your organisation rather than the vendor’s.
This takes one new question added to the vendor risk template, asked at first sign-off and again at every renewal: show me the policy behind the promise, every time, before the signature goes on the page.