The evidence that turns an unmeasured exposure into a risk a market can price.
Across commercial lines, AI risk that used to sit quietly inside general liability, cyber, directors and officers, and errors and omissions policies is being pulled out into the open. Standard policy forms now carry optional AI exclusions. Some carriers have added broad, near-absolute AI language. Others are narrowing definitions, adding sublimits, or simply asking harder questions at renewal. The market is drawing the lesson it took from silent cyber: when an exposure cannot be measured, it tends to be excluded first and priced later.
For an underwriter, the driver underneath all of this is plain. You cannot price what you cannot see. When an applicant runs an autonomous system that acts thousands of times, “we take AI governance seriously” is not something anyone can put a number against. Faced with an unmeasured exposure, the safe move is to exclude it, sublimit it, or load the premium. The applicant who can show what their system did, on what basis, and under whose authority gives the underwriter something to work with. The one who can only describe their governance does not.
The question has shifted from “do you use AI” to “show me what it did”
Underwriting questions about AI have moved on. It used to be enough to ask whether an applicant used AI and roughly how. Now the questions are specific: which models, how the decision to deploy them was made, what oversight sits around them, and what evidence exists that the system behaves as described. Those are evidence questions, not posture questions. A submission that answers them with a policy statement gives an underwriter nothing to price against. A submission that answers them with a record, showing what the system did and how each fact is known, gives an underwriter something real to underwrite.
What a record lets a submission carry
Decision provenance is a record of what an autonomous system did, on what basis, under whose authority, and how each item was captured, kept so it can be reconstructed later. On the inbound side of an insurance transaction, that record is what lets a submission carry evidence instead of adjectives.
An honest record does not present every fact as equally solid. Some items come from the infrastructure that ran the decision, some are captured close to the event, some are reconstructed, and some are stated by a person. The record shows which is which. For an underwriter that distinction is the whole point, because it is the difference between a claim about controls and evidence of them.
Custara prepares, structures and preserves that record so it arrives in a form a reviewer can read. It does not price the risk, place or advise on cover, or reach an underwriting conclusion. What the record means for terms is the underwriter’s call. Custara’s job is to make the evidence legible, not to grade it.
Like working papers, so one record serves every party
An insurance placement passes through parties who do not fully trust each other: the insured, the broker, the carrier, sometimes a reinsurer. Each needs to work from the same underlying facts, and each has reason to doubt a version prepared by someone with an interest in the outcome. Financial audit solved this problem a long time ago with working papers: the underlying evidence, organised so anyone downstream can follow how a conclusion was reached, prepared in a consistent structure rather than to taste.
Decision provenance is the working papers for an autonomous system, and it travels the same way. One record can support the insured’s submission, the broker’s placement and the carrier’s underwriting file, because it was prepared in a consistent structure rather than assembled to persuade. A standard can define what the record should contain and how evidence quality is described, which is the work of the Decision Standards Institute, and an independent assessor can review the record separately, which is the role of Attestra. Custara prepares the record. It does not assess it, and it does not price or place the risk that sits on top of it.
Why this matters before renewal
The exclusions and sublimits are being written now, at renewal, into forms that used to respond silently. The applicant who arrives with a record has something an underwriter can price and something a broker can carry into the market. The applicant who arrives with a policy binder and a promise is the one most exposed to a broad exclusion, because there is nothing for the underwriter to hold on to.
None of this is a promise that a submission will be accepted or priced a particular way. That is the underwriter’s decision, on the underwriter’s terms. It is the difference between asking a market to take an unmeasured exposure on trust and giving it something it can actually underwrite.
See how one record structures an insurer’s inbound AI review in the worked examples, or read how Custara works with insurers.
The framework behind this approach, and the book that sets it out, are forthcoming. This article is general information, not legal or insurance advice.