IDC Reports 88% of AI Agent Projects Never Reach Production

First Movers

The insurance industry has never seen a risk class quite like an autonomous AI agent. It writes code, negotiates discounts, accesses production databases, and issues unauthorized refunds at scale, as early deployers have found. Traditional errors-and-omissions policies were built for human judgment errors, not for software that acts on its own initiative. That gap is where a new market is forming.

Three players have moved first. Klaimee, a San Francisco startup founded in March 2026, entered Y Combinator's Spring 2026 batch with a thesis: scaling autonomous agents requires a liability framework that does not yet exist. Vouch, the technology-powered broker specializing in growing tech companies, and Coalition, the cyber insurer blending coverage with active security services, have each signaled active product development for the same customer base. The race is not just to write policies — it is to define what "AI agent liability" means before the courts do.

Klaimee's origin story traces to its founder's prior frontier. Ines Boutemadja spent five years as General Manager of Nomad Insurance at SafetyWing, a Y Combinator Winter 2018 graduate, building insurance infrastructure for remote workers across borders. She co-founded Klaimee with her husband, Julien Catonnet, and became the first Algerian woman accepted into Y Combinator, the third Algerian-heritage founder overall, following Yassir (Winter 2020) and Elevate. The company's platform audits an agent's architecture, memory design, and failure modes, then issues AI-specific liability coverage through a self-service flow aimed at startups selling agents to enterprise buyers. The initial focus is voice agents.

What distinguishes this moment from prior specialty-line launches is the feedback loop. Klaimee's underwriting requires an architectural audit, effectively a technical due diligence that doubles as a risk-control standard. Vouch and Coalition, by virtue of their existing portfolios, see claims data from the first wave of agent deployments. Each claim sharpens the next policy's exclusions and pricing.

The market is still too young for loss runs. Gartner projects more than 40 percent of AI agent projects will be canceled by end of 2027; IDC puts the share that never reach production at 88 percent, TeqTalk found. One analysis of 2,000 projects found an 80 percent failure rate, roughly double normal IT projects. Insurers are pricing uncertainty, not experience. But the first policies are binding, and the terms they set will shape how startups build, how investors underwrite, and how regulators respond.

Market Size: Formation, Not Scaling

No analyst firm has published a credible total addressable market figure for AI agent liability insurance. The handful of carriers writing these policies have not disclosed premium volume. That absence of hard numbers is itself the most reliable signal: the market is in the formation stage, not the scaling stage.

Klaimee's Y Combinator-backed launch marks one of the few concrete data points. The company's model, auditing an agent's architecture and failure modes, then issuing such coverage through a self-service platform, targets startups deploying voice agents to enterprise clients. That narrow initial focus suggests the addressable premium pool today is measured in low millions of dollars annually, not billions. For comparison, the broader cyber insurance market reached roughly $14 billion in global direct written premiums in 2023, according to Munich Re estimates. AI agent E&O sits as a microscopic slice of that, carved out only as autonomous systems move from pilot to production.

Growth drivers are qualitative but specific. The core thesis driving the market: scaling autonomous AI agent deployment requires a new framework for risk, liability and trust that does not currently exist. That gap (no existing framework) creates the insurance opportunity. As frameworks like LangChain and LlamaIndex push agents into production workloads (pharma, finance, customer support), each enterprise deployment becomes a potential policyholder.

Reinsurance capacity is the leading indicator to watch. Bermuda's specialist reinsurers have historically entered emerging cyber lines early — first data breach, then ransomware, now AI model failure. When capital allocators start dedicating sidecars or quota shares to AI agent E&O, that signals the market has reached critical mass. No such commitments have been publicly announced as of mid-2026.

Forecasts through 2030 remain speculative. The only defensible projection is directional: the market grows from near-zero to a measurable sub-segment of cyber E&O as three conditions converge — regulatory clarity on AI liability, standardized agent audit frameworks, and a critical mass of enterprise deployments with board-level risk awareness. Until carriers file rate pages with state insurance departments or reinsurers disclose AI-specific treaty limits, any dollar figure attached to 2030 is invention, not analysis.

Why Demand Is Rising

Enterprise adoption of autonomous AI agents has accelerated past the point where existing liability frameworks hold. Deloitte's 2026 State of AI in the Enterprise survey, conducted across 3,235 leaders in 24 countries between August and September 2025, found that worker access to sanctioned AI tools jumped 50 percent in a single year, from under 40 percent to roughly 60 percent of the workforce. The same research shows 85 percent of companies now expect to customize agents for their specific business needs, and close to three-quarters plan to deploy agentic AI within two years. A spring 2025 MIT Sloan Management Review and Boston Consulting Group survey put current adoption at 35 percent, with another 44 percent planning near-term deployment.

The governance gap is widening faster than the adoption curve. Only 21 percent of companies planning agent deployments report a mature governance model for autonomous systems. MIT Sloan professor Sinan Aral said the collective understanding of societal implications is "nascent, if not nonexistent," and said even cutting-edge deployers don't fully grasp how to maximize productivity or assess risk. Kate Kellogg, also at MIT Sloan, found in a 2025 study that 80 percent of the work deploying an adverse-event detection agent in oncology consumed data engineering, stakeholder alignment, governance, and workflow integration, not model tuning. Kellogg said monitoring must become a permanent operational expense, not a one-time project cost.

Agent capabilities themselves create novel exposure. Unlike generative AI that produces content, agents "perceive, reason, and act in digital environments to achieve goals on behalf of human principals, with capabilities for tool use, economic transactions, and strategic interaction," Horton and Shahidi said. They can employ APIs to communicate with other agents, send and receive money, access the internet, and execute multi-step plans across external tools. Aral said agents "can actually take actions that change things happening in the physical world," citing a warehouse agent programmed to stop a conveyor belt when vision systems detect anomalies. In financial services, JPMorgan Chase is exploring agents for fraud detection, customized advice, and automated loan approvals. Walmart is building LLM-powered agents for personal shopping and merchandise planning. A major airline uses agents to rebook flights and reroute bags autonomously.

Physical AI compounds the liability surface. Deloitte reports 58 percent of companies already use physical AI, including collaborative robots on assembly lines, inspection drones with automated response, robotic picking arms, and autonomous forklifts, with adoption projected to hit 80 percent within two years, led by manufacturing, logistics, and defense. These systems operate in environments where errors cause bodily injury, property damage, and supply-chain disruption.

Three risk categories drive insurance demand most directly. First, irregular reliability and unethical behavior: Aral said "a rogue AI agent deciding to reject a mortgage loan or college admissions decision based on faulty information can do just as much damage, or more, than simple hallucinations." Second, cybersecurity: as agents gain permissions to access datasets and enterprise systems, Kellogg said "don't underestimate the importance of building robust permission-based systems." Third, accountability: Kellogg said organizations must "clearly delineate who bears responsibility when agentic AI makes an error or causes harm," especially when workflows run with minimal human supervision. Kellogg said demonstrating success remains "one of the biggest challenges and risks to agentic AI success" because without shared metrics, "it's difficult to prove value, or even to know whether these systems are truly accomplishing desired outcomes rather than inadvertently introducing new risks."

Regulatory pressure sharpens the need. Deloitte said leading organizations "proactively monitor evolving legal requirements and build systems that can demonstrate safety, fairness, and compliance." The report said effective governance now "integrates with existing risk and oversight structures, not parallel 'shadow' functions." Companies factoring country of origin into vendor selection reached 77 percent, and nearly three in five build AI stacks primarily with local vendors, a sovereign AI dynamic that fragments liability across jurisdictions.

The economic imperative is unambiguous. Nvidia CEO Jensen Huang said enterprise AI agents are a "multi-trillion-dollar opportunity" at CES 2025. Horton and Shahidi said the fundamental promise is "dramatically reduce transaction costs — the time and effort involved in searching, communicating, and contracting." Agents don't tire, work 24 hours a day, and in high-stakes markets like real estate or B2B procurement can analyze vast documentation at near-zero marginal cost. But as Aral said: "It's absolutely an imperative that every organization have a strategy to deploy and utilize agents. But that sort of agentic AI strategy requires an understanding and systematic assessment of risks as well as business benefits." That assessment, and the financial backstop for when it proves insufficient, is what the emerging insurance market now sells.

Two Regulatory Architectures

The regulatory architecture around AI agent liability insurance is being built in real time, and the two largest jurisdictions are taking distinctly different approaches. In the European Union, the framework is comprehensive and prescriptive. In the United States, it is fragmented and sectoral. Both create compliance obligations that insurers and the startups buying their policies must navigate.

The EU's Tiered Stack

The EU AI Act, which entered force in August 2024 and phases in through 2026, is the centerpiece. It establishes a tiered system: unacceptable-risk AI is banned; high-risk AI, including AI used in medical devices, vehicles, hiring, credit scoring, and critical infrastructure, must meet requirements for data quality, accuracy, robustness, non-discrimination, technical documentation, record-keeping, risk management, and human oversight. Providers of high-risk systems face fines up to 6 percent of annual global turnover for non-compliance. For an insurer underwriting an AI agent that automates loan underwriting or screens job candidates, the policy itself becomes part of the provider's compliance evidence: proof that risk transfer exists, that residual exposure is quantified, and that a solvent counterparty stands behind the agent's errors.

The General Product Safety Regulation (GPSR), applicable from December 13, 2024, extends the safety net to consumer-facing AI agents and connected devices. It requires a "responsible person" established in the EU, a legal entity with access to technical documentation and authority to coordinate recalls. For a U.S.-based MGA writing AI agent E&O policies on a freedom-of-services basis, the GPSR means the policyholder (or the insurer's EU branch) must designate that responsible person and maintain traceability records sufficient for market surveillance authorities to pull a non-compliant product offline. The regulation explicitly covers e-commerce platforms, so an AI agent sold via a marketplace triggers the same obligations as one sold direct.

Layered on top are the Digital Services Act (DSA) and Digital Markets Act (DMA). The DSA mandates transparency for recommender systems and requires very large online platforms to submit to independent audits, audits that increasingly will examine whether AI agents deployed on those platforms carry adequate liability coverage. The DMA bars gatekeepers from self-preferencing their own AI services; an insurer that also operates a platform distributing AI agents could face scrutiny if its insurance arm favors affiliated agents.

The EU's approach to medical devices, the New Approach Directive model delegating technical detail to harmonized standards, is the template the AI Act follows. Standards bodies (CEN/CENELEC) are now producing the technical specifications that will define "state of the art" for AI risk management. Until those standards are published, insurers and regulators are operating in a guidance vacuum, referencing ISO/IEC 42001 (AI management systems) and the NIST AI Risk Management Framework as interim benchmarks.

The U.S. Patchwork

The United States has no horizontal AI law. The White House Blueprint for an AI Bill of Rights (2022) endorses a sectorally specific approach: health, labor, education, financial services, each regulator adapts existing authority. The result is a mosaic. The FDA has issued guidance on AI/ML-enabled medical devices, including predetermined change control protocols that anticipate model updates, a direct analog to the "continuous underwriting" problem in AI agent insurance. The SEC has proposed rules on predictive data analytics in broker-dealer and investment adviser contexts, which could capture AI agents that execute trades or allocate portfolios. The CFPB has signaled that algorithmic underwriting falls under the Equal Credit Opportunity Act. The FTC has used Section 5 authority against deceptive AI claims and unfair data practices.

State law adds another dimension. Colorado's SB 21-169 (2021) prohibits insurers from using external consumer data and algorithms that unfairly discriminate, a statute that could be read to require bias testing of AI agents used in insurance pricing or claims. California's SB 253 and SB 261 (2023) mandate climate risk disclosure for large companies; the CSRD and CSDDD in the EU impose parallel obligations on U.S. multinationals. Nearly 900 non-EU companies, including U.S. insurers and reinsurers with EU operations, will need to comply with the CSDDD's human rights and environmental due diligence requirements by July 2028.

Insurance regulation remains state-based. The National Association of Insurance Commissioners (NAIC) is developing guiding principles to update risk-based capital formulas for alternative asset risk, relevant because AI agent E&O policies may be placed in captives or sidecars backed by private credit. The Bermuda Monetary Authority issued a supervision paper on private equity-backed insurers in December 2023; the IMF followed with a white paper on PE in life insurance. Both signal that capital structures supporting novel lines, AI liability included, will face heightened scrutiny.

Sandboxes and Guidance

Concrete guidance on AI agent liability insurance specifically is thin. The EU AI Act's Article 9 (risk management system) and Article 10 (data governance) are the closest statutory hooks; the Commission has not yet issued detailed implementing acts for insurance products. In the U.S., the Treasury Department's Federal Insurance Office (FIO) has not published AI-specific guidance. State insurance departments are moving individually.

Singapore and Hong Kong offer a contrast. The Monetary Authority of Singapore (MAS) has funded AI adoption grants. Hong Kong's Insurance Authority launched a sandbox for AI pilots. Both jurisdictions treat insurance as a testbed for AI governance, not just a risk to be regulated. Bermuda, as a reinsurance hub, is watching both: its Monetary Authority has signaled openness to innovative risk transfer structures provided capital adequacy and governance standards are met.

The transatlantic divergence is real. The EU AI Act calls for a wide variety of standards on a compressed timeline; U.S. federal agencies have largely not developed the required AI regulatory plans. The EU-U.S. Trade and Technology Council has produced a joint roadmap on evaluation metrics for trustworthy AI and a pilot on privacy-enhancing technologies, but alignment on liability insurance — whether an AI agent E&O policy issued in Delaware satisfies a German deployer's GDPR Article 28 processor obligations — remains unresolved.

For now, the practical path is dual compliance: write policies that satisfy the EU's high-risk AI documentation and human oversight requirements, and structure capital to meet NAIC risk-based capital charges and Bermuda's PE insurer supervision expectations. The first court decisions on AI agent liability — whether a hallucinated contract clause binds the principal, whether an autonomous trading agent's error is a "professional service" exclusion — will shape the next generation of guidance more than any regulator's circular.

Fundraising Lever

The clearest signal that AI agent liability coverage has become a fundraising lever comes from the insurers themselves. Corgi, the San Francisco startup founded in 2024 by Emily Yuan and Nico Laqua to underwrite "newer categories" of risk including AI-related liability for startups, raised three rounds in eight weeks, as detailed in the table below.

Kindred Ventures' Kanyi Maqubela said the valuation leaps were rationalized by revenue trajectory — Corgi is on track for a $450 million run rate by year end, but the speed also reflects investor conviction that demand for AI-native risk products is structural, not speculative. Laqua said the capital will "expand into new insurance categories, scale the AI underwriting platform, grow embedded distribution partnerships, and continue growing our team."

That demand side is visible in how early-stage AI companies are positioning coverage. The company cited 0.1 percent churn, 2,400 customers, and 93 percent gross margins, metrics that venture partners now treat as table stakes, but founders and VCs alike describe liability coverage as a due-diligence checkbox that removes a category of "unknown unknown" from the data room. When an AI agent can autonomously execute contracts, move funds, or modify production code, the absence of a tailored errors-and-omissions policy becomes a diligence red flag. Investors have started asking for proof of coverage in term-sheet negotiations, particularly for Series A and B rounds where the product has moved from pilot to customer-facing deployment.

Limited partners are watching the markup dynamics closely. A limited partner who backs multiple venture funds said there is "growing distrust of internal markups" when a portfolio company re-prices upward without a liquidity event. The same source said "If a company is just getting re-priced upward with no real liquidity event, LPs notice." Maqubela said "LPs really like exits above all. They discount the value of markups since those aren't always reflective of reality." In this environment, a startup that can demonstrate it has transferred tail risk — hallucinated contract clauses, regulatory fines from autonomous decisions, data-leak liability from agent memory — to a rated carrier or a capitalized RRG gains a tangible differentiator. The coverage itself becomes a mark of operational maturity, similar to SOC 2 compliance five years ago.

Corgi's product architecture reflects the fundraising signal. The company uses Risk Retention Groups for some lines, structures that pool member premiums and pay claims from the pool, while placing other policies on state-regulated carrier paper. RRGs avoid certain state regulations but lack guaranty-fund backing; a severe claim can drain the pool and even bankrupt the RRG. For founders, the choice of structure matters in board conversations: a policy on admitted carrier paper carries more weight with institutional investors than an RRG certificate, even if the coverage language is identical. Corgi's spokesperson said the company deploys both structures depending on the risk class.

The feedback loop is tightening. Insurers need rapid premium growth to justify their own markups (Corgi's $2.6 billion valuation implies roughly 5.8x forward run-rate revenue) so they underwrite aggressively to win logos. Startups buy the policies to smooth fundraising. VCs accept the policies as risk mitigation, then mark up the startup. LPs scrutinize the markup. The cycle only holds if claims stay low. The first material AI agent liability loss will test whether the coverage language, the carrier capital, and the reinsurance treaties behind them actually perform. Until then, the policy is a fundraising asset. Afterward, it becomes a balance-sheet liability.

Incumbents and Bermuda Capital

Traditional carriers are moving from observation to underwriting. Lloyd's of London has signaled interest in autonomous-agent risk as a distinct class rather than a cyber endorsement. Hamilton Insurance Group, the Bermuda-based carrier founded by AIG veteran Brian Duperreault, has highlighted growing premium writings in technology errors-and-omissions lines tied to AI deployments. The company's earnings calls have noted that reinsurance treaties renewed at higher attachment points, reflecting both capacity appetite and the need for larger limits as enterprise customers demand nine-figure coverage towers.

Embroker, a digital brokerage that raised $100 million in 2024 to become a full-stack carrier, has added AI agent liability to its product roadmap alongside a strategic partnership with Everspan to expand admitted paper capacity. The move mirrors a broader pattern: incumbents with balance-sheet strength are using managing general agent (MGA) structures to test wording and pricing before committing full capacity. Willis Towers Watson's acquisition of Newfront would give WTW a technology-enabled retail arm already distributing cyber and professional liability policies to AI-native startups. Whether the deal closes or not, the bid itself underscores how legacy brokers view AI risk distribution as a growth vector.

Bermuda's role is structural. The island's reinsurance market added capacity for AI risk across the 2023-2024 renewal seasons, driven by catastrophe-model vendors extending their frameworks to cover model drift, hallucination cascades, and autonomous decision chains. Several Class 4 reinsurers have created dedicated "emerging technology" sidecars, segregated accounts that absorb AI E&O layers above primary insurers' retention. These vehicles allow primary carriers to write larger limits without breaching regulatory capital ratios, while Bermuda's tax-neutral regime and established ILS infrastructure attract pension and sovereign wealth capital seeking uncorrelated yield. The capacity increase is qualitative as well as quantitative: underwriters now require evidence of agent observability, rollback capability, and human-in-the-loop governance before attaching, standards that did not exist in 2022 treaty wordings.

The incumbent response is not uniform. U.S. admitted carriers remain cautious, filing rate and form changes state by state, while surplus-lines markets and London syndicates move faster. But the convergence — Lloyd's syndicates, Bermuda sidecars, MGA-backed primary products — creates a layered capital stack that did not exist for AI agents eighteen months ago. Startups buying coverage today are effectively stress-testing that stack; each claim will refine the wordings that eventually become the industry standard.

Where Frameworks Meet Coverage

The wordings taking shape in London and Bermuda are being written against the two frameworks that dominate agent development — LangChain and LlamaIndex — which have become the de facto operating systems for autonomous software. LangChain's 2026 State of Agent Engineering survey, drawn from 1,300-plus practitioners in June 2026, found 57.3 percent of respondents already running agents in production, up from 51 percent a year earlier, with another 30.4 percent actively building toward deployment. Customer service leads at 26.5 percent of use cases, followed by research and data analysis at 24.4 percent. GitHub stars tell the same story: LangChain passed 130,000 stars in early 2025; LlamaIndex sits near 48,000. Both frameworks connect large language models to private data, support agentic workflows where models plan actions and use tools, and share the same vector databases, embedding providers, and LLM APIs. Production teams frequently run both simultaneously, LangChain for task orchestration, LlamaIndex for specialized retrieval.

Insurtechs are moving toward these frameworks because that is where the risk originates. Klaimee's model, auditing an agent's architecture, processes, and failure modes, then backing it with such a platform aimed at startups deploying agents to enterprise clients, is framework-agnostic today, yet the technical hooks for deeper integration already sit inside the development stack.

LangSmith, LangChain's observability layer, provides built-in tracing and evaluation that monitors agent decisions and improves performance through feedback loops. LangGraph adds precise control over agent flows — conditional retrieval, memory persistence, external-service interactions, creating a deterministic layer between probabilistic model output and tool execution. That control layer is exactly where an embedded warranty could enforce boundaries: verify that a proposed action matches policy, check outcome against expected state, and trigger coverage logic when the agent steps outside verified parameters. LlamaIndex offers a parallel surface. Its query engines automatically apply reranking, filtering, and fusion techniques; its agent workflows, including document ingestion, parsing via LlamaParse, indexing, retrieval, and action, are used by KPMG, Salesforce's Agentforce team, and insurance carriers for claims triage, policy summarization, fraud-signal cross-checks, and regulatory-filing tracking. LlamaParse alone processes millions of pages with citation-level traceability and confidence scores on every extracted field.

The convergence is visible in early implementations. The Insurance Documents QA RAG Chatbot, a public reference architecture, combines LangChain and LlamaIndex with dynamic tool selection, multi-layer caching, cross-model compatibility across ChromaDB and OpenAI APIs, and memory-driven error recovery. It handles both document-based and general queries while maintaining performance at scale. That architecture — retrieval, reasoning, tool use, execution, is the same surface an embedded liability layer would need to instrument. LlamaIndex's own industry materials frame the pipeline explicitly: upload documents, parse and extract key information, agents take action (route, validate, log, notify), review or monitor via dashboards and APIs. Each step is a potential failure mode with a corresponding insurable event.

No public announcement yet confirms a native "insurance SDK" inside LangChain or LlamaIndex. But the technical prerequisites, including structured tracing, policy-enforceable control graphs, auditable retrieval with citations, and a production base signaled by 130,000-plus GitHub stars, are already in place. The next move will likely come from an insurtech that treats the framework's observability APIs as underwriting data feeds: real-time agent behavior streams that replace static questionnaires with continuous risk scoring. When that happens, the warranty becomes a feature of the build process, not a policy purchased after deployment.

Working in frontier tech? Zero G Talent tracks the openings: see every open ASML role, browse frontier tech jobs, openings at Stripe, and the people building the field.