The episode centers on a structural shift in technology risk management: liability for AI decisions is increasingly transferring downstream from technology vendors to MSPs and their clients. Insurers are moving to exclude generative AI from standard liability policies, while California regulators have mandated new automated decision-making rules with specific risk assessment and audit requirements for certain businesses operating above defined thresholds. Product licensing from major AI manufacturers such as OpenAI and Anthropic continues to disclaim liability, relying instead on “as is” terms that put post-deployment legal exposure on service providers and end users.
The most consequential development discussed is the combination of insurance market adaptation and new regulatory mandates. Insurers are segmenting their approach: some explicitly exclude AI coverage via policy riders, others remain silent (neither excluding nor affirming coverage), and a minority price for AI-related risks. According to Bernhard Kirchner, silent coverage offers limited protection and will not shield MSPs from liability unless operators can demonstrate robust risk assessment and control activities. Simultaneously, under California regulations effective January 1, MSPs supporting clients above $26.25 million in California sales or with over 100,000 California clients are obligated to generate and retain evidence-based AI risk assessments, updating these every three years or upon substantive change.
Several supporting developments reinforce this liability transfer and governance gap. ISO has released optional generative AI exclusions for general liability, and specific carriers, such as Berkley, have implemented absolute exclusions across multiple product lines. Kirchner notes that the lack of clarity in many insurance contracts creates further exposure, as legal precedents—including the Air Canada chatbot case—suggest that courts treat AI as an agent of the business deploying it, not a standalone legal entity. Evidence and documentation requirements, including technical evaluations and governance records, are beginning to emerge as practical minimums for qualifying for any future AI coverage.
The implications for MSPs and IT service providers are a marked increase in contractual, regulatory, and operational responsibility related to managing AI risk. MSPs working with affected clients must closely audit their customer footprint, update risk documentation, and explicitly clarify risk allocation in contracts and master service agreements. Lacking proactive compliance or documented controls, both MSPs and clients risk significant uninsured exposure, with limited recourse to recover from AI failures. Operational safeguards—such as periodic self-assessment, updated evidence retention, and clear assignment of liability—are emerging as necessary components for both competitive differentiation and risk management.