A gene therapy priced at US$3.5 million, delivered once, is expected to replace decades of treatment. The clinical case is straightforward. The insurance case is not.
That tension runs through a new report from Zurich Insurance Group, Beyond 2030: The Future of Life Sciences, which draws on interviews with 34 industry experts and a survey of 62 specialists. The report suggests that scientific discovery is accelerating, but the systems required to prove, manufacture, finance and deliver that science are not keeping pace. The most consequential risks are emerging not in the laboratory, but afterwards.
For those placing life sciences risks, the report identifies a structural problem already arriving at renewal. Cover designed for physical products and recurring transactions may not respond as intended in a world of connected devices, AI-embedded clinical decisions and outcome-based contracts with obligations extending years beyond the initial sale.
The EU's revised Product Liability Directive, which came into force in December 2024 and takes effect from December 2026, is the clearest regulatory signal of how far this shift has travelled. For the first time under EU law, software and AI systems are classified as products, subject to strict liability rules. A diagnostic app, a clinical decision-support algorithm or an AI-enabled medical device sold into European markets carries product liability exposure under that framework. UK life sciences companies exporting to the EU fall within its scope regardless of where they are headquartered.
The Zurich report puts the scale in context. By the end of 2025, the US Food and Drug Administration's (FDA) public registry listed more than 1,450 AI-enabled medical devices, up from fewer than 1,000 little more than a year earlier. These are not outliers. They reflect the direction of travel across the sector.
The placement challenge is that AI systems in clinical settings operate across drug-app-device ecosystems. When something goes wrong, liability can sit with a device manufacturer, a software developer, a cloud provider and a clinical team simultaneously.
As the Zurich report notes, a missed diagnosis can begin with a miscalibrated algorithm, compound through a fragmented handoff between platforms and result in patient harm with no single responsible party. Standard life sciences product liability policies were not written with that architecture in mind, and most do not provide affirmative coverage for bodily injury arising from a technology product or service. Brokers working with UK life sciences clients have flagged this gap for some time. The regulatory environment has now made it considerably more urgent.
Outcome-based models are introducing a parallel problem. Healthcare is moving away from transaction-based arrangements, and the obligations those new models create do not expire cleanly.
NHS England's subscription arrangement for certain antibiotics, paying a fixed annual fee for access regardless of usage volume, is one live example. Outcome-based rebate agreements for gene therapies, where manufacturers repay a proportion of the fee if clinical performance targets are not met over time, are another. A manufacturer entering an outcome-based contract for a gene therapy is, in effect, underwriting a clinical promise over a decade or more. The financial, contractual and evidentiary obligations can persist long after the treatment has been administered.
"Innovation in life sciences is accelerating, but so are the risks and complexities surrounding it," said Penny Seach, chief underwriting officer international at Zurich Insurance Group. "The companies that succeed will be those that can identify critical dependencies, build resilience and navigate the regulatory, technological and operational challenges that stand between discovery and delivery."
The EU directive's expansion of liability to cover software updates and AI systems extends that obligation further. Accountability for a connected infusion pump failure, for instance, can span a device manufacturer, a software provider, a cloud platform and a clinical team, with none holding it unambiguously.
Single-source dependencies are a related exposure. Life sciences clients are relying on one cloud provider, one contract development and manufacturing organisation (CDMO) or one AI platform in ways their own risk frameworks would not accept for a physical raw material. The Zurich report flags this directly, noting that boards willing to accept sole-source reliance on critical digital infrastructure would not apply the same logic to a physical component.
Those dependencies carry cyber exposure that life sciences underwriters are still calibrating. The US healthcare sector recorded 460 ransomware attacks in 2025, according to the FBI, and a single clearinghouse breach in 2024 disrupted patient care at nearly three-quarters of American hospitals. In a sector where cloud infrastructure, AI platforms and clinical data pipelines are all critical to care delivery, losses from AI system failures can fall between cyber, professional liability and general liability policies without any of them responding fully.
The Zurich report frames insurability as a signal of operational readiness, rather than just a financial backstop. The placement conversation for life sciences clients increasingly starts with mapping where liability sits across connected products, long-tail outcome contracts and AI-embedded clinical decisions, before that architecture is inherited rather than designed.
