Stan Sterna, who leads risk control at Aon for the AICPA Member Insurance Program, put the current state plainly to Accounting Today in April. There really has not been a lot of claims, or large dollar amounts paid on claims, involving AI at accounting firms.
What They Are Already Asking
That is the honest position, and it is worth holding on to when the topic gets breathless. No wave of AI malpractice suits has arrived.
Now read the second half of the same reporting, which is where it gets interesting. Underwriters have changed what they ask anyway.
The questions that came up in that reporting, across Aon, McGowan and Camico, are not abstract. Does the firm use AI. Does it police its usage. What protocols exist for oversight.
The controls the same people recommend are equally concrete. Disclose AI usage in engagement letters. Give clients a way to opt out. Put a human review step over AI output. Verify what the tool produced against traditional research. Have data security protections around what goes in.
None of that is a technology position. It is a governance checklist, and the firms that can answer it will be answering it from a document rather than from memory.
The Exclusions Have Started, Just Not Here Yet
The other thing moving is policy wording, and precision matters because this is where a lot of commentary gets it wrong.
ISO filed forms effective January 2026 that let carriers exclude generative AI exposures, including CG 40 47 01 26, which removes bodily injury, property damage and personal or advertising injury arising out of or attributable to generative AI. Berkley has introduced what it calls an absolute AI exclusion in specialty liability lines, worded broadly enough to reach the use, deployment, development, integration or failure of AI.
Those are commercial general liability and specialty forms. They are not accountants professional liability forms, and no equivalent exclusion has landed on the CPA program. Anyone telling you your professional liability policy already excludes AI is ahead of the facts.
What they establish is direction. The market has built and filed the machinery. Whether it gets applied to professional liability for accountants is a question of loss experience, which brings us back to the first paragraph.
Why This Runs Ahead of the Claims
Professional liability is written on a claims made basis, and the gap between doing the work and being sued over it in this profession is routinely measured in years. A return prepared this spring can produce a claim in 2029.
So underwriters cannot wait for the loss data before pricing. They price the exposure they think is accumulating, using the only observable signal available, which is how the firm behaves now. The renewal questionnaire is not curiosity. It is the underwriting file.
That inverts the usual order of operations. A firm that plans to sort out its AI governance once the risk becomes real will be documenting that governance to a carrier who has already formed a view of it, at a price already set.
What This Asks a Firm to Be Able to Show
Read the recommended controls again as evidence requirements rather than as policies, and a pattern falls out. Every one of them is a question about what the firm can demonstrate: which engagements disclosed AI use, which clients opted out, who reviewed what, and where the client data went while the tool was working on it.
That last one is the least discussed and the most awkward to answer honestly, because it depends on infrastructure rather than intent. A firm can write a policy saying client data must not leave approved systems. Showing which files were opened, by whom, and in what tool is a different capability.
MetaWurks covers part of that ground. Documents ingested into the platform are not used to train models and are not exposed to other users, so the client file stays inside the firm's control while an accountant queries it in plain English. Role based access controls decide who can open which client's records, and audit logs record who opened what and when, which is the artefact an underwriter, a client, or a plaintiff's lawyer eventually asks for.
It does not write the AI policy or the engagement letter clause. Those are the firm's to draft, and they are the cheapest part of the exercise.
The claims have not arrived. The questions have. Firms tend to prepare for the first and get assessed on the second.
Join the Conversation
When your professional liability renewal next asks whether your firm polices its use of AI, what document would you attach?