Does insurance cover a payment your AI agent approved by mistake?

Probably not — and the reason has nothing to do with how good your fraud detection is. It's a clause. Standard cyber and tech E&O policies are built to trigger on a breach: an external attacker, unauthorized access, a system doing something nobody with the right credentials meant it to do. An AI agent that uses your own legitimate login to approve a payment to a fraudulent account doesn't clearly fit either category — the access was authorized, the agent was supposed to be there, it just made the wrong call. That gap is not hypothetical anymore. It's the reason insurers spent the first half of 2026 rewriting policy language, and the reason your next renewal conversation should include a direct question you may not have asked yet.

Why does the coverage gap exist?

Traditional cyber coverage was written around a specific story: someone gets in who shouldn't be there. An AI agent breaks that story without breaking any rule the policy anticipated. It has the credentials. It has the access. It does exactly what it was deployed to do — verify a vendor, match an amount, release a payment — and gets one input wrong, at machine speed, with no human in the sequence to catch it.

Insurers noticed the gap before most policyholders did. A survey cited in industry coverage this year found that 42% of companies now carry AI-specific exclusions in their cyber policies, and carriers have started offering AI security riders that require proof of controls — documented risk assessments, evidence that autonomous actions are reviewable — before they extend cover at all. The practical result: two companies running nearly identical AI-driven AP automation can have very different insurance outcomes, and the difference is usually a paragraph neither CFO has read since the last renewal.

Who's actually liable when the agent gets it wrong?

This is where 2026 changed the default answer. For a while, the assumption in a lot of finance departments was that if the AI vendor's system made the mistake, the vendor was on the hook. Under a California law that took effect January 1, 2026, that assumption stopped holding for organizations doing business there: a company can't use "the AI decided autonomously" as a defense. If you deployed the agent, the outcome is yours, whether or not a specific human approved that specific action. Legal analysis through the rest of the year describes courts elsewhere drawing the same line — toward the company that put the agent to work, not the lab that trained it.

None of this is settled case law across every jurisdiction, and this isn't legal advice — it's a reason to ask your counsel and your broker the question now rather than after an incident. But the direction is consistent enough to plan around: the deploying company carries the exposure by default, and the contract with your AI vendor is unlikely to move that by itself.

The control that actually changes the calculus

Every version of this question — insurer, court, or your own board — comes back to the same test: was there a point where a person could reasonably have caught this before it became irreversible? That's the difference between an agent that recommends and an agent that executes.

It's also, not coincidentally, how we build invoice fraud detection. Every invoice gets matched against its order and delivery note automatically — 10,000+ documents, 100% coverage, no sampling. But the system doesn't release a payment on its own. It flags the mismatch, the new supplier, the changed bank detail, and a person decides. That single design choice — flag, don't execute — is also the strongest answer available today to "were reasonable controls in place," because it puts a human exactly where the insurers and the courts are looking for one.

The six leaks that survive normal AP controls already show why bank-detail changes deserve that checkpoint more than anything else in the process — this is the same design principle, looked at from the liability side instead of the fraud side.

What to ask before you give an agent payment authority

• Does the system execute or flag? If it can release a payment without a person confirming it, ask what happens on the day it's wrong — not what happens on the 999 days it's right.
• Is there an audit trail for every autonomous action? Insurers reviewing a claim, and courts reviewing a dispute, both want to see what the agent saw and why it acted.
• Are new suppliers and bank-detail changes forced to a human review, without exception? This is the single highest-value checkpoint and the cheapest to build in from day one.
• What does your AI vendor's contract actually say about liability? Most say less than founders assume. Read the clause before an incident, not after.
• Have you asked your broker the direct question? Not "are we covered for cyberattacks" — "is a payment our own agent authorized, using our own credentials, covered or excluded?"

Where does this leave you?

If your AP automation — ours or anyone else's — can release a payment without a person in the loop, you're carrying an exposure that may not be insured and, increasingly, may not be anyone else's liability but yours. The fix isn't slower automation; it's automation that flags instead of executes on the decisions that matter. The free AI Audit is where we'd start: five minutes to see where your document flows already have that checkpoint and where they don't, before it's a question for your broker instead of us. Prefer to talk it through? Book a call. The mechanics of the reconciliation layer behind this are in how three-way matching works.