The Economics of AI Liability
Because Big Tech shifts uninsurable AI risks onto enterprise buyers, the law must impose strict liability on the monopolies selling this digital asbestos.
By Victor Hale
Sparked by Launch HN: Risklytics (YC S26) – Insurance brokerage for frontier tech companies · discussion
Politicians and tech executives are currently busy debating science-fiction scenarios about artificial general intelligence going rogue and seizing the nuclear codes. Ignore this alarmism. We always imagine the movie-plot threat: a Skynet-style cyber apocalypse. The reality is that the actual check on the generative AI boom is the ruthless, boring mathematics of insurance actuaries. Actuaries serve as the ultimate rational actors in our market, entirely immune to venture capital marketing hype or a CEO's belief that an algorithm is conscious. They care exclusively about statistical probability and quantifiable risk. And in January, the Insurance Services Office (ISO) published clauses that explicitly void commercial insurance coverage for AI-generated losses. The actuaries looked at the underlying technology, ran the numbers, and realized that enterprise AI is currently uninsurable.
When an organization integrates a large language model into its customer service pipeline, its HR department, or its internal codebases, it inherits an attack surface that defies standard cybersecurity risk modeling. Take prompt injection. If a malicious actor can slip a hidden string of text into a prompt that tricks the system into executing unauthorized commands, the defense has already lost. The attacker extracts proprietary data or manipulates outputs, and the system complies because it cannot distinguish between legitimate inputs and hostile directives. Add in systemic hallucinations where the system confidently lies, automated intellectual property infringement on a massive scale, and continuous data leakage, and you have a liability nightmare. We are seeing desperate attempts from the market to quantify this chaos, such as the emergence of Risklytics and the accompanying Hacker News discussion where the developer community is finally admitting what they have been handed. Whether a company is worried about regulatory fines for discriminatory lending algorithms, class-action lawsuits for copyright violations, massive data breaches from manipulated prompts, or basic operational failures when a chatbot invents non-existent refund policies and promises them to customers, the underlying mathematical risk profile of these systems cannot be reliably calculated. Unquantifiable.
Economically, enterprise AI is the twenty-first century equivalent of asbestos. During the middle of the twentieth century, asbestos was aggressively marketed as a miracle material. It was cheap, highly effective as an insulator, exceptionally fire-retardant, and seemingly magical in its diverse industrial applications. Consequently, it was rapidly embedded into the literal infrastructure of countless buildings, schools, naval ships, and consumer products. The manufacturers who refined and sold asbestos pushed it into the market long after they suspected its catastrophic health impacts. The short-term profits were simply too massive to ignore. That delay in accountability ultimately triggered the longest-running mass tort in U.S. history, costing hundreds of billions of dollars and destroying millions of lives.
Big Tech is running the exact same playbook today. Generative AI is being hyped as an economic miracle and shoved blindly into the digital infrastructure of every Fortune 500 company, healthcare provider, and government agency. It is being baked into word processors, search engines, and operating systems. Just like the asbestos manufacturers, the AI model creators know perfectly well that the long-tail liability of their product is inherently toxic. They know the models are insecure by design. And just like the asbestos industry, they have engineered a legal and economic system to ensure they do not have to pay for the fallout.
Enterprise software failures appear to be technical problems requiring engineering solutions, yet they ultimately break down because of warped market dynamics. The fundamental rule of behavioral economics in cybersecurity is that a system will remain insecure as long as the people capable of fixing the flaw bear absolutely no financial consequence when it fails. Tech monopolies privatize the massive profits of this miracle technology while socializing all of the long-term risks. They deploy dense, boilerplate End User License Agreements to legally shift 100 percent of the burden for data leaks, hallucinations, and copyright violations onto the naive enterprise buyers who integrate the models. They are selling the rope, but refusing to hold any liability when it snaps.
The corporate buyers in this equation are trapped by their own incentives. Executives desperately want the magical AI productivity upgrade they read about in airline magazines. No one wants to be the CEO left behind by the competition, so they buy the hype. Economically, the vendors are incentivized to ship highly capable, fundamentally insecure garbage as fast as possible to capture market share. The AI creator sells the asbestos, the enterprise customer installs it in their servers, and the enterprise customer absorbs all the legal risk when the toxic dust settles.
This dynamic explains precisely why the commercial insurance industry is quietly walking away. The January ISO exclusions act as a blaring financial fire alarm. For decades, the cyber insurance market has functioned by pooling risk for known threats like ransomware and business email compromise. Insurers are perfectly willing to underwrite predictable, measurable risks, making them fiercely unwilling to hold the bag for Big Tech's reckless deployment of a highly flawed asset. By refusing to cover AI-generated losses, the insurance industry is exposing the hollow core of the AI boom. If the insurers will not cover the damage, and the AI creators have successfully disclaimed all responsibility via contract, the entire systemic cost collapses directly onto the enterprise customers and, inevitably, the public at large.
Technical guardrails and market self-correction are insufficient for solving what is fundamentally an economic market failure. We must stop treating algorithmic vulnerabilities as unsolvable mysteries and start treating them as defective products. When a manufacturer produces a dangerous product and refuses to bear the cost of its defects, the law must force them to do so. The only way to force companies to provide safe AI is through federal regulation imposing absolute strict liability on the model creators. Either the tech monopolies hold the liability for the systems they build, or no one does.