Artificial intelligence has moved quickly from pilot project to everyday tool across almost every industry, including downstream energy. Fuel retailers use AI to adjust street pricing, distributors use it to optimize routing and inventory, and back-office teams increasingly rely on AI “agents” that can log into systems, send messages, and complete tasks with little human involvement. These tools deliver real efficiency, but they raise a question many companies have not considered: If an AI tool causes a loss, will your insurance cover it?
Many people assume the answer turns on their cyber security policy. Increasingly, though, the bigger gaps are showing up elsewhere—in general liability, management liability, and professional liability coverage. Renewal season is a good time to find out what your policies say.
AI Exclusions Are Spreading Across Policy Lines
Somewhat surprisingly, cyber insurers have largely maintained coverage for AI-related losses, and some have even added endorsements confirming coverage for incidents such as deepfake fraud. Other lines are moving in the opposite direction. In January 2026, Verisk’s ISO division made new generative AI exclusions available for commercial general liability (CGL) policies. Form CG 40 47 removes coverage for bodily injury, property damage, and personal and advertising injury arising out of generative AI. Directors and officers (D&O), errors and omissions (E&O), employment practices, and fiduciary policies are also starting to include AI exclusions, and some are broad enough to reach almost any claim with an AI connection.
Even without an AI exclusion, older policy wording can cause trouble. Many policies assume a human wrongdoer, such as a hacker, a thief, or a careless employee. An AI agent acting on its own does not fit neatly into those categories.
Here are a few ways things could go wrong with AI, and the policies that might be in play.
- Runaway automation. An AI agent with access to your pricing or point-of-sale systems misreads an instruction and pushes incorrect prices to dozens of sites, or deletes critical records while “cleaning up” a database. Depending on the facts, that could implicate cyber or E&O coverage.
- Customer-facing mistakes. An AI chatbot or marketing tool makes a false statement to customers or uses someone else’s image or content in an ad. These kinds of claims have been traditionally handled by CGL advertising injury coverage, and they are exactly what the new ISO exclusions target.
- Physical harm. An AI-assisted maintenance, safety, or dispatch tool gives a bad recommendation that contributes to a spill, fire, or injury at a site. A CGL policy with a generative AI exclusion may not respond if the insurer argues the loss “arises out of” the AI output.
In each case, an insurer could point to an AI exclusion, argue that no person committed a covered act, or say the agent’s access was technically “authorized.” The phrase “arising out of” is usually read broadly, so an exclusion could reach a claim even where AI played only a small part. Coverage will turn on the exact wording and how a court in your state reads it, and courts have not yet addressed most of these questions.
Why This Matters for Downstream Energy Companies
Fuel retailers, distributors, and terminal operators carry a mix of risks, creating a coverage gap that warrants a closer look.
- Payment card data at scale. Convenience stores and fuel retailers process enormous volumes of card transactions. An AI-related incident that exposes payment data can trigger forensic costs and notification obligations.
- Operational technology. Terminals, tank monitoring, dispensers, and fleet systems are increasingly connected to business networks. An AI tool with broad access could disrupt operations, not just data.
- Vendor dependence. Many companies use AI through third-party platforms, such as pricing software, loyalty programs, or back-office providers. A loss caused by a vendor’s AI may raise additional questions about contract indemnities and contingent business interruption coverage.
- Deal exposure. For companies buying or selling sites or businesses, cyber coverage and AI use are becoming standard diligence topics, and gaps can affect representations, indemnities, and representation and warranty insurance.
What to Ask Your Broker
Start with a broker conversation that covers your whole program, not just cyber security. These questions are a good place to begin.
- Which of our policies have AI exclusions? Ask the broker to check your CGL, umbrella, D&O, E&O, employment practices, and cyber policies for any exclusion or endorsement that mentions artificial intelligence, generative AI, automated systems, or machine learning.
- How broad is the wording? Find out whether an exclusion is limited to generative AI or applies to any AI use, and whether it reaches claims where AI played only a minor role.
- Does “authorized” access defeat coverage? If your own AI agent causes harm using credentials you gave it, will the insurer treat the loss as an uncovered internal error?
- What about system failure and business interruption? Confirm whether non-malicious system failures are covered, and whether coverage extends to outages caused by a vendor’s systems.
- Are there disclosure obligations? Many applications now ask about AI use. Inaccurate or incomplete answers could create problems when a claim is made, so make sure your application reflects how your company actually uses AI.
- Can the gap be closed? Ask whether affirmative AI coverage, revised definitions, or an endorsement is available, and at what cost. The market is evolving, and options may differ significantly among carriers.
Practical Steps Beyond the Policy
Insurance is only part of the picture. Several internal steps can put your company in a better position.
- Inventory your AI tools. Identify which AI tools and agents are in use, including those embedded in vendor software, and what systems and data each can access.
- Limit access. Apply the “least privilege” principle so that AI agents can reach only what they need, and require human approval for high-impact actions such as price changes, payments, or data deletion.
- Review vendor contracts. Check whether AI vendors carry their own insurance, provide indemnities for AI-caused losses, and must notify you promptly of incidents.
- Adopt an AI use policy. Set clear rules for employees on approved tools and the handling of customer, payment, and employee data.
- Update your incident response plan. Make sure your plan addresses AI-related events, including how to quickly shut down or isolate an agent that is behaving unexpectedly, and when to notify your insurer.
Where to Go from Here
AI is changing how downstream energy companies do business, and insurers in several lines are responding by narrowing coverage. A program built before AI entered the workplace may leave you uncovered when a loss traces back to a chatbot, an algorithm, or a well-meaning bot that went off the rails. Before your next renewal, and ideally before rolling out any AI tool with broad system access, walk through every policy with your broker to find where AI exclusions appear and what it would take to close any gaps. Legal counsel can also help you read the policy language, align coverage with your vendor contracts, and get ahead of questions that tend to come up in a deal or a claim.
By Beth Harper
