The Exclusion That Cleared Devices Do Not Prevent

In 2025, the Insurance Services Office introduced optional generative AI exclusions for 2026 commercial general liability policies, excluding coverage for bodily injury, property damage, or personal and advertising injury arising out of generative artificial intelligence. The definition is deliberately broad, covering nearly any machine system that produces text, images, audio, video, or code. The FDA database now lists 1,451 AI-enabled medical devices, and 31.5% of US hospitals reported using generative AI in 2024. The clearance memo sits in the hospital's regulatory file. The insurance exclusion sits in the same drawer, three pages later, and those two documents do not reconcile.

I spend enough time with hospital procurement teams to know the shape of this problem. An imaging triage system receives FDA 510(k) clearance. The vendor offers indemnification for third-party IP claims, but the contract caps total vendor liability at twelve months of fees. The enterprise customer is expected to absorb downstream liability, and most AI vendor agreements cap total liability, including indemnification, at 12 months of fees. The hospital's own general liability carrier now has the option to exclude AI-related injury from coverage. FDA authorization does not establish clinical benefit, does not decide civil liability, and is not a malpractice safe harbour. The clinical director who signs the purchase order owns the space between those three facts.

What the exclusion covers, and what remains exposed

The ISO generative AI exclusion definition encompasses nearly any machine-based system capable of producing text, images, audio, video, or code. Read that against the device categories FDA has cleared. Reviewing 1,016 FDA authorizations issued through 20 December 2024, researchers found 621 devices, or 84.4%, use medical images as their core data input, and 107 devices, or 14.5%, use physiological signals such as ECG or EEG traces. Most of those are predictive models, not generative. But although generative AI often dominates media headlines, researchers are testing generative applications such as models that generate synthetic chest X-ray and skin-lesion images, or ones that integrate multimodal data, such as imaging and clinical text, to improve diagnostic speed. The exclusion language does not draw that line.

A radiology AI that flags a suspected pulmonary embolism and auto-generates a text alert to the on-call radiologist is producing text. A pathology slide scanner with an AI module that highlights regions of interest and writes a structured report summary is producing both images and text. Whether the ISO exclusion would apply in a claim alleging missed diagnosis or delayed treatment is a coverage question the hospital's risk officer cannot answer until a claim is filed and the insurer takes a position. AI integration raises critical questions about accountability and coverage, and traditional malpractice policies, often crafted before the advent of AI, may not adequately address scenarios where AI tools contribute to errors or omissions, necessitating a reassessment of policy language to ensure it encompasses AI-related risks.

The professional liability policy covering physician malpractice is a separate instrument, and it may not contain the same exclusion. But it covers the clinician's decision, not the hospital's vicarious liability for a device failure or the institutional negligence claim that the hospital deployed an inadequately validated tool. The gap is not hypothetical.

The number the hospital balance sheet now carries

The global medical AI software liability insurance market was valued at $1.32 billion in 2024 and is expected to reach $5.47 billion by 2033, expanding at a CAGR of 17.1%. That figure measures the premium spend, not the exposure. US hospitals spent $9.4 billion on professional liability insurance in 2022, the last year for which Census data is available. The AI liability market is now roughly 14% of that baseline, and it is growing faster.

A 2024 study by the American Medical Association found about 66% of physicians surveyed said they currently use AI in their practice, up from 38% in 2023. In one claims sample, unique patients receiving AI-enabled services rose from 6,300 in January 2024 to almost 17,000 by December 2025, while total allowed amounts increased from $1.6 million in January 2024 to a high of $6.3 million in October 2025. Utilization is climbing, billing codes are in place, and reimbursement is flowing. The liability question is not whether the technology will be used at scale. It is already used at scale. The question is who pays when a patient is harmed and the device carried FDA clearance, the clinician followed the output, and the hospital's insurer declines coverage because the claim arose out of generative AI.

The question of whether liability falls on the healthcare provider, the AI developer, or both remains a contentious issue, influencing underwriting practices and claims management. WHO states that governments may wish to consider strict liability for large multimodal models used in healthcare, though that is a policy option, not a rule that currently makes all developers and deployers liable regardless of fault. No such regime exists in the United States. The hospital signs the contract, deploys the device, and holds the clinical credential of the physician who relied on its output.

Where the clearance stops and the claim starts

Congress required FDA to, within 90 days of passage of the FY2026 appropriations, conduct an assessment of its existing authorities and provide a report identifying changes to its statutory authorities necessary for FDA to conduct oversight of post-deployment performance and patient safety monitoring of AI/ML-enabled devices. In September 2025, FDA published a request for public comment, with comments due December 2025, requesting information on best practices, methodologies, and approaches for measuring and evaluating real-world performance of AI-enabled medical devices. The agency does not yet have settled answers on how to measure real-world device performance after clearance.

FDA's September 2025 request for public comment on best practices for measuring real-world AI device performance suggests the agency itself does not yet have settled answers. A device cleared via the 510(k) pathway demonstrates substantial equivalence to a predicate device. As of May 2024, 97% of approved AI/ML-enabled devices, 856 out of 882 approved devices, followed the 510(k) pathway in the US. Substantial equivalence is a regulatory standard, not a clinical validation standard, and it does not generate evidence of performance in the deploying hospital's patient population, with that hospital's imaging protocols, scanner models, and case mix.

A study covering 100 AI pathology studies revealed that many pathology AI tools suffer from a high risk of bias due to lack of external validation, poor dataset diversity, and incomplete reporting of patient and imaging characteristics; in dermatology, models showed 29% to 40% reductions in ROC-AUC when assessed on darker skin tones and uncommon diseases; and performance degradation caused by domain shifts, such as variable staining, scanner models, and slide quality, has been repeatedly documented when used outside the development center. FDA clearance does not remedy those risks. The hospital that deploys the device owns them.

The contract the vendor will not revise usually contains a liability cap, indemnification carve-outs, and a force majeure clause that includes changes in law or regulation. FDA authorization is not a malpractice safe harbor, does not establish local clinical benefit, and does not decide civil liability. The clinical director who recommended the purchase, the CFO who approved the budget, and the risk officer who reviewed the contract all understood that FDA clearance was necessary but not sufficient. What changed in 2025 is that the hospital's own liability carrier can now exclude the claim before it is filed.

The conversation the board will eventually require

A Congressional Research Service report noted that with roughly 1,450 AI-enabled medical devices already authorized for marketing and generative AI tools beginning to enter clinical settings, Congress must confront if the existing regulatory framework built for a world of static hardware is capable of governing software that learns, adapts, and can produce false outputs. That is a federal policy question. The hospital board's question is narrower and more urgent: if we deploy an FDA-cleared AI diagnostic tool, a patient is harmed, our clinician followed the AI output in good faith, and our insurer invokes the generative AI exclusion, who pays the settlement or verdict?

California AB 2575 would prevent AI developers and deployers from avoiding liability by arguing that a clinician's failure to override an AI output broke the causal chain, keeping potential responsibility on AI companies even when a clinician is involved in the patient-care decision. That bill was introduced and referred to the Committee on Finance in early April 2025 and has not progressed. It is a single state, a single bill, not in force. The hospital deploying the device today operates under the law as it is, not as it might become.

The clinical upside of the AI system is measurable: faster triage, fewer missed findings, earlier escalation. The financial risk is now asymmetric. The vendor's liability is capped contractually. The hospital's liability is capped only by the damages a jury awards, and the hospital's own insurer has the option to exclude the claim. The device cleared FDA review, but FDA review does not close the coverage gap. The chief medical officer who championed the deployment can describe the clinical benefit in a two-page memo. The general counsel cannot, in the same number of pages, describe who will defend the hospital and pay the claim if the benefit does not materialize and a patient is harmed.

That asymmetry will not survive the first high-profile case. A missed cancer diagnosis, a delayed stroke triage, a misclassified cardiac event. The claim will name the hospital, the attending physician, the device manufacturer, and possibly the algorithm developer if it is a separate entity. The hospital's motion to the insurer for defence and indemnification will produce a reservation-of-rights letter citing the generative AI exclusion. The vendor will point to the liability cap and the indemnification carve-out for claims arising from the hospital's use of the device outside its cleared indication. The physician will point to the clinical protocol that required reliance on the AI output for workflow efficiency. The question of who pays will go to coverage counsel, then to mediation, then possibly to a declaratory judgment action, while the underlying plaintiff's claim continues in parallel.

The hospital CFO who approved the AI contract in late 2025 could not have known in advance which insurer would adopt the ISO exclusion, or whether their own carrier would. By mid-2026, the answer is in the policy renewal, and the contract is already signed. The technology is in production, the clinicians are trained, the workflows are redesigned, and the liability structure is now visible. What is not visible is the reserve the hospital should carry for the claim the exclusion will not cover.

Tarry Singh is the founder and CEO of Real AI (realai.eu), an enterprise AI advisory and deployment firm working with global enterprises on production agent systems, model risk, and AI sovereignty strategy. He also leads Earthscan (earthscan.io) for Energy AI, and is a founding contributor to the EU-funded HCAIM and PANORAIMA programmes for responsible AI education across European universities. He writes at tarrysingh.com.