For most of insurance history, the answer to "who pays when an employee gets it wrong?" has been fairly settled. A professional liability, cyber or tech E&O policy picks up the tab, and the claims team argues about the details later.
AI agents are scrambling that arrangement. Software that approves loans, prices policies, moves money and answers customers doesn't make one mistake and stop. It can repeat the same error hundreds or thousands of times before anyone notices, and many carriers have decided they would rather not find out what that costs.
Read next: Apple launches hub as Anthropic issues connected home AI risk warning
Into that gap steps Harbor, a San Francisco startup that seemed to come out of nowhere on Oct. 13 with $10 million in seed funding. Base10 Partners, Abstract and 8VC led the round, with Restive, NFX, Innovation Endeavors, Kibo Ventures, Masia and MVP Ventures also taking part, according to the company.
Co founded by Daniel Elechiguerra Batlle and Jesús Santos Aranda, Harbor’s promotional materials lean heavily into the start-up’s Stanford roots, Its pitch lands at a moment when the standard market is drawing harder lines. Since January, carriers have been able to bolt three ISO generative AI endorsements onto commercial general liability policies: CG 40 47, the broad version; CG 40 48, which is limited to personal and advertising injury; and CG 35 08, aimed at products and completed operations. A review of state filings found that the generative AI exclusion already sits on thousands of CGL policies, with 2,369 exclusion records in force across 49 states by mid-2026. Berkley has gone further, applying an absolute AI exclusion across its D&O, E&O and fiduciary products.
Not everyone thinks blanket exclusions are the right answer. On Marsh McLennan's earnings call on Oct. 15, chief executive John Doyle warned that a broad AI exclusion could cause "real confusion and uncertainty," and argued for a more nuanced look at how the exposures aggregate.
Keith Savino, US chief executive of cyber insurer Emergence, offered a blunter explanation for why the exclusions are arriving. "I think there are carriers coming out with exclusions because their existing forms probably provide coverage they never intended to provide," he told Insurance Business earlier this month.
Read next: Amwins outlines impact of AI on 2026 market conditions
It’s not just a concern that affects clients – carriers are also at risk. Research co-authored by insurers, brokers and AI labs this summer warned that carriers may already be carrying hidden AI liability they never priced, concentrated in cyber, D&O, CGL and tech E&O. Exclusions shrink that exposure for insurers, but they push it straight back onto the insured.
Harbor's answer is to bundle risk management and risk transfer into one product. It says that its software first hunts down every AI agent a client is running and builds an inventory. It then scores each one for operational, security and regulatory risk, using a framework the company says it mapped to the NIST AI Risk Management Framework, the EU AI Act and the federal banking agencies' new model risk guidance, SR 26-2.
The platform then claims to check each agent decision against the client's own rules and blocks the ones that break them before they execute. When an agent's underlying model, tools or data change, Harbor re-scores it. The risk left over after those controls is what Harbor insures, and the company says it is backing that cover with its own money.
The logic will be familiar to anyone who has watched cyber underwriting mature: no claims history means no pricing, so the measurement has to come first. Harbor also argues that carrying the loss gives it a reason to keep the controls honest.
"Companies need to understand the risk of their agents, and at the current pace of adoption and development, assessing the risk at a specific point in time seems useless," co-founder and chief executive Jesús Santos told reporters. Santos started the company with Daniel Elechiguerra, Cristian Bartolomé and Luis Botín after the four met at Stanford. Harbor says its first customers are banks and insurers in the US, Europe and Latin America.
Read next: AI governance isn't keeping pace with AI adoption, AXA XL warns
Regulators are watching, but haven't settled it
For US banks, the regulatory picture is still incomplete. When the Fed, OCC and FDIC issued SR 26-2 in April to replace the 2011-era SR 11-7, they explicitly left generative and agentic AI outside its scope, and signaled that a separate request for information on AI would follow, according to a Baker Tilly summary of the guidance. That leaves banks deploying agents today with no dedicated supervisory playbook, which is exactly the space Harbor is selling into.
Europe is moving faster on a related front. The European Central Bank has told the roughly 110 banks it directly supervises to file action plans against AI-enabled cyberattacks by Oct. 31. That letter targets AI as an attack tool rather than banks' own agents, but it adds to the pressure on boards to show they have AI risk under control. Euro-area subsidiaries of US banking groups are in scope.
Harbor isn’t unique in targeting AI agents. Lloyd's coverholder Armilla AI raised its standalone AI liability limit to $25 million per organization in January. Mosaic Insurance and Munich Re's aiSure unit offer up to $15 million for AI vendors whose models miss defined performance thresholds. San Francisco's Artificial Intelligence Underwriting Company (AIUC) goes highest, with up to $50 million in cover, according to a RAND report that found that there may be a lot of opportunity in this sector - most carriers are still silent on AI.
Those are meaningful numbers for a new class of risk, but small next to the losses a misfiring agent could rack up across thousands of transactions at a large bank. Harbor has not said how much capacity it will offer per client, or which licensed carrier, if any, will issue its policies. Those are the first questions brokers will need answered.
Read next: CFC extends affirmative AI cover to media policy, completing wider portfolio rollout
What brokers should do now
For brokers, the practical takeaway is less about Harbor and more about the gap it is chasing. Take a hypothetical: a company's accounts-payable agent pays the same vendor invoice 2,000 times over a weekend. There was no breach, no human fraudster and no bodily injury. Does tech E&O respond? Cyber? Crime? Or does an AI exclusion close every door? That uncertainty is what Harbor and its rivals are selling into.
Plenty of people in the market expect it to become a business line of its own. In a recent Insurance Business LinkedIn poll, half of respondents said AI-specific insurance would eventually become a major commercial line, while 14% expected AI risk to stay mostly within existing lines.
Until that settles, clients running agents should be asked before renewal which of their CGL, E&O, cyber and D&O forms now carry AI exclusions, and which policy would have paid for an agent error a year ago. Brokers shouldn't expect those answers to stay put. "This is not a done deal yet," Savino said of carrier positions. "Come back in three months and see if that answer has changed."
