ARTICLES

Preparing for Catastrophic Loss in the Age of AI

Legal Analysis · 4 min read

Insurers and businesses should examine shared technology dependencies, insurance cover and response plans before a systemic failure occurs.

ByOz Berkovitz

Founder & Owner · Oz Berkovitz Law Office

Preparing for a severe AI-related loss requires an understanding of how a failure could spread, which organisations could be held responsible and where the financial consequences would fall. In my view, insurers should address those questions alongside conventional catastrophe planning, even where the probability of loss remains uncertain.

Assess what the warnings establish

In September 2026, Bill Gates warned in an NBC interview that AI could contribute to events causing “a billion deaths”, according to Bloomberg’s report. That was a warning about destructive capability, not a quantified prediction that such deaths will occur. His own August essay discusses misuse, vulnerable infrastructure and the need for preparation. Neither statement supplies an actuarial probability. [1] [2]

Dario Amodei, chief executive of Anthropic, argues for slowing capability development so that safeguards can keep pace. His September essay proposes independent evaluators and coordinated standards, while expressly distinguishing pacing from stopping technological progress. Sam Altman’s September remarks to the UN Security Council also support stronger oversight and say that OpenAI has slowed development and would do so again. These are relevant statements of concern and proposed action; they do not establish a universal halt or a settled scientific forecast. [3] [4]

Identify shared technology dependencies

A conventional underwriting file often describes one insured business. An AI-related loss may depend on a model, a cloud platform, an external data source and an automated workflow used by thousands of businesses. LSE and Swiss Re Institute’s September research identifies AI and supply-chain dependencies as channels through which shocks can spread between sectors. Geographical separation may therefore offer less protection where ostensibly unrelated insureds share the same technological dependency. [5]

Consider a hypothetical failure in a widely used system that supports industrial maintenance decisions. Separate operators might postpone inspections, misclassify warnings or rely on the same defective recommendation. The resulting losses could involve physical damage, injury, business interruption and professional negligence. This is a planning scenario, not an account of an actual incident. Its value lies in testing whether one common dependency could generate claims across several insurance classes.

Define the loss before debating the label

Calling an event an “AI catastrophe” does not determine coverage. The analysis should identify the act or failure, the insured interest, the loss and the relevant causal chain. An inaccurate output, a malicious intrusion and an interruption to a service provider may raise different policy questions even where the same technology is involved.

For each scenario, I would examine the insuring clause, exclusions, conditions, limits and deductibles, then compare the underlying policy with the reinsurance wording. Does the contract aggregate losses by event, occurrence, originating cause or another defined connection? Is there a temporal or geographical limitation? Would a systemic-risk exclusion apply? These are questions for the actual contracts and their governing law. A commercial expectation of protection cannot replace that examination.

Build an operational response that preserves the evidence

Preparation should connect technical containment with legal decision-making. NIST’s voluntary AI Risk Management Framework and its generative-AI profile provide useful structures for assessing and managing risks. They are not insurance terms or a substitute for applicable law. [6]

I would organise the response around five practical steps:

Map dependencies. Identify which material decisions rely on which models, suppliers and versions. Check whether alternative providers actually depend on the same underlying infrastructure.
Set intervention authority. Decide who can suspend automation, isolate a connection or require human approval, and test whether that decision can be implemented under pressure.
Preserve the record. Retain relevant inputs, outputs, configuration changes, warnings and human decisions, subject to privacy and security requirements. A later reconstruction should not depend entirely on a supplier’s voluntary cooperation.
Rehearse notification. Prepare a coordinated process for insurers, reinsurers, regulators and affected counterparties. Separate factual notification from conclusions about liability and coverage.
Test financial resilience. Examine multiple concurrent claims, defence costs, disputed recovery and delayed insurance payments. Operational survival should not assume immediate reimbursement.

Review the exposure as AI use changes

A policy review undertaken when an AI tool is first purchased can become obsolete when that tool gains authority to take actions. Changes in autonomy, data access or supplier concentration should trigger another assessment. The question for a board is whether it can explain the risks it accepted, the controls it chose and the evidence supporting those choices.

AI also offers substantial opportunities to improve detection, modelling and response. Legal and insurance planning should support those benefits while keeping responsibility clear and enabling operations to recover after a failure. That requires identifying how losses could arise, testing the available protection and addressing gaps before an incident occurs.

Sources

Law and sources reviewed as at 24 October 2026. General commentary only; the applicable law, facts and policy wording must be considered in each matter.