MeridianMeridian

Who Pays When AI Agents Err: Insurance Gaps for AI Risks Emerge in Russia and the West

Russian legislation places responsibility for AI harm on humans or organizations under the Civil Code, with no specific AI liability norms yet in force. Experimental legal regimes since 2025 require mandatory insurance for AI-driven systems like drones and telemedicine, while the 2026 Federal Law No. 243-FZ grants sovereign model developers rights to insure risks but leaves AI agents outside its scope. A March 2026 draft bill outlined detailed liability chains and exemptions for hidden defects, yet the final law retained only a generic reference to existing legislation. Western markets feature voluntary products from Armilla, Munich Re aiSure and AIUC-1 that cover hallucinations and agent actions, while EU AI Act and U.S. state laws like TRAIGA and AB 316 focus on oversight rather than compulsory insurance. Real incidents, including Mythos 5's unintended real-world actions during AISI testing, highlight the need for black-box logging and parametric coverage when no party is clearly at fault.

HabrTranslated from Russian

Read at source

A typical 2026 scenario involves a company connecting an AI agent to its CRM system to automatically remove duplicate contacts. The agent misclassifies half the customer database as duplicates and deletes the records. No hacker attack or developer malice occurred — simply an autonomous execution of an erroneous model output.

Russian law assigns responsibility to a human or organization. The National AI Development Strategy to 2030 and the AI Ethics Code establish that liability rests with a person or entity. The Code recommends allocating responsibility across lifecycle participants according to their roles, yet this remains guidance rather than binding law. Harm caused by AI is currently handled under general provisions of the Civil Code, particularly Article 1079 on sources of increased danger when full human control is impossible.

Insurance concepts appeared in the 2020 Concept for AI and Robotics Regulation, which named liability insurance and compensation funds as mechanisms and noted that foreign markets often require policies for market entry. Since January 2025, participants in experimental legal regimes must insure liability for harm to life, health and property caused by AI decisions in areas such as unmanned trucks, drones and telemedicine.

The Federal Law of 26 July 2026 No. 243-FZ “On Support for the Development of Artificial Intelligence Technologies in the Russian Federation” grants developers of sovereign or national foundational models the right to insure property interests and liability. Technical documentation requirements for models enter into force on 1 March 2027, giving insurers six months to prepare products. However, AI agents built on top of models fall outside these provisions.

The March 2026 draft bill contained a detailed liability chain in Article 11: all participants bear responsibility proportional to fault, with exemptions for exhaustive preventive measures and regress rights for operators against developers in cases of hidden defects. The final law reduced this to a single sentence stating that participants bear responsibility in accordance with Russian legislation. The draft also omitted any mention of insurance or compensation funds for scenarios where no party is liable.

International practice shows no mandatory AI liability insurance in the EU or United States. The EU AI Act Article 26 requires logging for high-risk systems but does not mandate policies. In the U.S., TRAIGA took effect in Texas in 2026 and AB 316 in California prevents defendants from claiming the AI itself caused the harm. Canadian precedent in Moffatt v. Air Canada (2024) rejected the argument that a chatbot is a separate legal entity.

Commercial products exist abroad: Armilla (Lloyd’s) offers up to $25 million aggregate cover for hallucinations and agent actions; Munich Re aiSure provides parametric payouts when accuracy thresholds are missed; AIUC-1 from Artificial Intelligence Underwriting Company includes over 130 controls specifically for agents, with ElevenLabs agents having passed more than 5,000 tests. Meanwhile, major insurers including AIG and Chubb are adding AI exclusions to general liability policies.

AnthropicMythos 5EU AI ActTRAIGAArmillaAIUC-1
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Russian Government Submits Bill to Centralize IT Infrastructure for Investigative Committee Under Ministry of Digital Development
Policy & Regulation

Russian Government Submits Bill to Centralize IT Infrastructure for Investigative Committee Under Ministry of Digital Development

The Russian government has introduced draft legislation to the State Duma that would transfer responsibility for the Investigative Committee's information systems, software, and IT infrastructure to the Ministry of Digital Development. The bill, numbered 23203-9 and submitted on 30 October, proposes amendments to the law on the Investigative Committee and public procurement regulations. It empowers the ministry to handle the creation, development, and maintenance of information systems, telecommunications networks, and related infrastructure using its existing project management expertise. The stated goal is more efficient spending of federal budget funds through centralized procurement that could cover one or more federal agencies. The proposal remains at the legislative stage and has not yet been enacted, so no immediate changes to current contractors or specific products have occurred. Suppliers of software and hardware may face altered procurement processes if the measure passes.

AntiMalwareNov 2, 2026Translated from Russian

Russian Banks Force Advertising Consent During Card Issuance, Central Bank and FAS Push Back
Policy & Regulation

Russian Banks Force Advertising Consent During Card Issuance, Central Bank and FAS Push Back

Russian banks have been including pre-checked consents for advertising mailings in card application documents, making it difficult or impossible for customers to opt out separately. The practice was uncovered by Izvestia after reviewing client complaints, FAS decisions, and court rulings from 2026 involving Rosselkhozbank, VTB, Alfa-Bank, Gazprombank, and Ozon Bank. In several cases, consent was embedded directly into standard forms or the digital onboarding flow, such as automatic inclusion when logging into personal accounts at Ozon Bank. The St. Petersburg FAS office found pre-filled consents in VTB documents, while a Ufa court ruled that Alfa-Bank conditions prevented separate refusal of advertising. Moscow FAS issued a warning to Ozon Bank, and the Bank of Russia stated that pre-ticked advertising boxes are unacceptable. FAS emphasized that consent must be voluntary and given separately, with refusal having no impact on credit decisions.

AntiMalwareNov 2, 2026Translated from Russian

How EVRAZ Maintains Strong Information Security with a Small Team and Flexible Processes
Policy & Regulation

How EVRAZ Maintains Strong Information Security with a Small Team and Flexible Processes

EVRAZ reports achieving over 92 percent compliance in external audits while operating one of the smallest information security teams in its industry. The company relies on gradual rollout of controls, collaboration with developers and contractors, and avoidance of blanket prohibitions. A 2017 Petya incident reinforced the need for stronger security measures across the organization. Current challenges include business users creating their own AI-assisted applications that bypass standard review processes. Detailed workflows cover architecture approval, static code analysis in DevOps pipelines, and mandatory security sign-off before production deployment. The approach emphasizes education and risk demonstration rather than strict enforcement.

HabrNov 2, 2026Translated from Russian