# AI risk insurance in Estonia: silent and affirmative cover URL: https://insurancelawestonia.ee/guides/ai-risk-insurance-estonia/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-09 > How PI, product liability, cyber, crime, D&O and property wordings respond to AI losses under Estonian law; AI exclusions and EU dates. Losses caused by the use of artificial intelligence are not a separate class of insurance. They fall into existing lines: professional and technology errors and omissions, product and general liability, cyber, crime, D&O, and property and business interruption. For each line the question is the same as it was for cyber a decade ago: does the wording cover the AI exposure silently, exclude it, or cover it affirmatively? This guide sets out the Estonian liability background, how each line is likely to respond under Estonian law, how AI exclusions will be read, and the EU dates that matter for underwriting. ## 1. Liability background in Estonian law Estonian law has no AI-specific liability regime. Claims rest on contract, on fault-based tort liability or on strict liability provided by statute. A person who unlawfully causes damage to another must compensate it if at fault or if liable under the law.[^1] The person in control of a source of greater danger is strictly liable for damage resulting from the danger characteristic of a particularly dangerous thing or activity; whether an autonomous system qualifies depends on its nature and use.[^1] Producers are strictly liable for personal injury caused by a defective product. Under the current VÕS, property damage is recoverable only for items ordinarily intended for private use, used mainly privately, and above EUR 500.[^1] The new Product Liability Directive (EU) 2024/2853 applies to products placed on the market or put into service from 9 December 2026 (Article 2(1) as corrected by the corrigendum of 7 May 2026: after 8 December 2026). It treats software, including AI systems, as a product, lists property damage without a lower threshold, and makes the lack of software updates within the manufacturer's control a ground on which the manufacturer cannot escape liability.[^2] See [product liability in Estonia](https://insurancelawestonia.ee/guides/product-liability-estonia). The doctrinal questions behind these rules (whether insurance could eventually replace tort liability for autonomous systems, and whether AI should have legal personality) are discussed in two articles I co-authored in *Juridica*; English summaries are on the blog.[^3] ## 2. How each line responds ### 2.1 Professional and technology E&O The first question is whether an AI-assisted service is within the insured professional activity. Narrow activity descriptions may not capture new AI-based services. The second is whether the claim is for negligence or for breach of a contractual promise: a guaranteed accuracy or performance level is a contractual warranty, and contractual-liability exclusions are common in E&O wordings. ### 2.2 Product and general liability For manufacturers of devices and software, the new directive widens the exposure: software-only products, post-sale updates and data loss become relevant. General liability wordings often exclude or limit software, data and electronic-data losses; these exclusions should be checked against the new heads of damage. ### 2.3 Cyber Attacks on AI systems (data poisoning, model theft, prompt injection) are usually security events if "computer system" and "security failure" are defined broadly. A model that simply produces wrong output without any attack is a performance failure rather than a security event, and cyber system-failure cover may be limited. ### 2.4 Crime Deepfake CEO fraud is, legally, social engineering: an employee makes the payment, having been deceived. Whether it is covered depends on the wording of the policy's computer-fraud, funds-transfer-fraud and social-engineering (fraudulent instruction) provisions and their exclusions. Many crime policies respond to such losses mainly through a social-engineering extension, usually with a sublimit and verification conditions such as call-backs. A specific extension is advisable to reduce uncertainty, but it is not necessarily the only route to cover under every wording (see the [crime court cases](https://insurancelawestonia.ee/specialty-lines/handbook/cases/crime-court-cases)); foreign decisions on computer-fraud clauses are comparative material and do not bind Estonian courts. Banks generally do not refund authorised payments under current law; the forthcoming EU Payment Services Regulation shifts liability for impersonation fraud in defined cases. See [crime and fidelity claims](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia). ### 2.5 D&O Two exposures stand out: failure of oversight of AI use (including compliance with the AI Act, data protection and anti-discrimination rules) and misleading statements to investors about AI capabilities. D&O wordings rarely address AI expressly; the risk is that such claims fall under technology or cyber exclusions. See [D&O claims in Estonia](https://insurancelawestonia.ee/guides/d-and-o-claims-estonia). ### 2.6 Property and business interruption Property cover generally requires physical loss or damage. An AI malfunction that stops production without physical damage will usually not trigger business interruption cover; a malfunction that causes a fire or machinery breakdown will, subject to exclusions. The position mirrors silent cyber. ## 3. Reading AI exclusions under Estonian law Standard terms are interpreted as a reasonable person in the position of the other party would have understood them in the same circumstances; in case of doubt, against the party that supplied the term.[^1] AI is not a defined term in the market, so broad exclusions ("arising out of or in connection with the use of artificial intelligence") risk being read narrowly or against the insurer. Standard terms that are unreasonably disadvantageous to the policyholder are void,[^1] and Estonian courts classify clauses by substance: a clause whose effect depends on the insured's conduct may be treated as an obligation subject to fault and causation tests. See [policy wording review](https://insurancelawestonia.ee/guides/policy-wording-review-estonian-law) and [exclusions vs obligations](https://insurancelawestonia.ee/estonian-insurance-contract-law/exclusions-vs-obligations). Drafting points for insurers: define the AI system by reference to function rather than technology, separate the exclusion of uninsurable performance guarantees from the exclusion of all AI use, and state expressly how the exclusion interacts with cyber and crime sections. ## 4. Affirmative AI cover The market also offers affirmative cover, for example model-performance insurance that pays when a model fails to achieve an agreed accuracy, or extensions covering liability for AI output and deepfake fraud. Affirmative cover settles the coverage question but raises new ones: how performance is measured, who proves the model error, how retentions apply and how aggregation is handled when many insureds use the same model. ## 5. EU regulatory dates - **AI Act (Regulation (EU) 2024/1689).** Generally applicable from 2 August 2026. After Regulation (EU) 2026/1744, the high-risk rules apply to Annex III systems from 2 December 2027 and to systems embedded in Annex I products from 2 August 2028. Annex III point 5(c) covers risk assessment and pricing in life and health insurance.[^4] - **Product Liability Directive (EU) 2024/2853.** Transposition deadline 9 December 2026.[^2] - **Cyber Resilience Act (Regulation (EU) 2024/2847).** Manufacturers' reporting obligations from 11 September 2026; full application from 11 December 2027. See [EU regulations](https://insurancelawestonia.ee/legal-framework/eu-regulations). ## 6. Claims and recovery For claims handlers, the evidence in AI cases is the model's logs, versions, training-data documentation and the records of human oversight. Preservation duties should be built into the policy conditions. Recovery against model vendors and producers will be easier for products placed on the market or put into service from 9 December 2026, because the new directive provides for disclosure of evidence and rebuttable presumptions of defectiveness and causation in defined circumstances.[^2] See [subrogation and recovery](https://insurancelawestonia.ee/guides/subrogation-recovery-estonia). ## Related pages - [AI liability and autonomous cars: will insurance replace tort?](https://insurancelawestonia.ee/blog/2026-11-01-ai-liability-autonomous-vehicles-insurance) - [Product liability in Estonia](https://insurancelawestonia.ee/guides/product-liability-estonia) - [Cyber claims in Estonia](https://insurancelawestonia.ee/guides/cyber-claims-estonia) - [Crime and fidelity claims in Estonia](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia) - [D&O claims in Estonia](https://insurancelawestonia.ee/guides/d-and-o-claims-estonia) - [EU regulations](https://insurancelawestonia.ee/legal-framework/eu-regulations) ## References [^1]: Law of Obligations Act (võlaõigusseadus, VÕS) §§ 39 lg 1, 42 lg 1, 1043, 1056 lg 1–3, 1061 lg 1–2 and 5. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: . [^2]: Directive (EU) 2024/2853 on liability for defective products, arts 2(1), 4(1), 6(1)(b), 9, 10 and 11(2). . [^3]: O.-J. Luik, R. Kinkar. Tehisaru ja lepinguväline vastutus: kas kindlustussüsteem asendab tulevikus deliktisüsteemi? Autonoomsete sõidukite näide. – Juridica 2024/7, pp 496–508 ; O.-J. Luik, K. Saluste, M. Volberg. Kas tehisarule tuleks anda õigussubjektsus? – Juridica 2026/4, pp 331–341 . [^4]: Regulation (EU) 2024/1689 (AI Act), Annex III point 5(c). ; Regulation (EU) 2026/1744 of 8 July 2026 amending Regulation (EU) 2024/1689 (in force 27 July 2026). .