FRANCE Trends and Developments Contributed by: Emmanuèle Lutfalla and Louis Fer, Signature Litigation AARPI
The Cyber-War Exclusion and Systemic Risk French law provides no specific legal definition of a cyber act of war. When an insurer invokes a war exclusion against a state-sponsored cyber-attack, the burden of proving that the attack qualifies as an act of war falls on the insurer. In the absence of clear legal criteria, this burden is substantial. State attribu- tion in cyber-operations is inherently uncertain, and even where intelligence agencies attribute an attack to a state actor, the legal characterisation of that act as “war” rather than espionage, sabotage or criminal activity remains deeply contested. The AIUC/Anthropic/OpenAI report published in 2025 draws an instructive comparison. After the attacks of 11 September 2001, insured losses exceeded USD40 billion and triggered a near-total withdrawal of ter- rorism cover from the commercial market. Govern- ments intervened with public backstop mechanisms (GAREAT in France, Pool Re in the United Kingdom, TRIA in the United States) to restore insurability. The report warns that a comparable dynamic could unfold in respect of AI-related losses, where a single cata- strophic event might cause insurers to withdraw from the market unless structural mechanisms are put in place. The scale of the exposure is difficult to overstate. According to the same report, over 90% of insurers’ AI-related exposure is embedded in conventional poli- cies that were never designed to cover autonomous systems. This “silent” cover is largely unpriced and invisible to the insurers themselves. A major loss event would crystallise liabilities that no one has budgeted for. GAREAT, the French public-private terrorism rein- surance pool, is frequently cited as a potential model for a cyber or AI catastrophe mechanism. Whether the political will exists to create such a pool, and whether the private market would accept the constraints it would impose, are questions that have moved from the academic sphere to the practical agenda of the French insurance industry. Generative AI: The next frontier of Liability From technical error to autonomous liability At the European level, two instruments are reshaping the liability landscape. Directive (EU) 2024/2853 on liability for defective products now expressly includes
software and digital files in the definition of “product”, effective from 9 December 2026. The EU AI Act, which entered into force in 2024 and is being implemented in phases, establishes a risk-based classification for AI systems. The proposed AI Liability Directive, however, was withdrawn by the European Commission in 2025.. Together, these two instruments are creating a regula- tory architecture in which the developer, the deployer and the end user each face distinct but potentially overlapping obligations. The litigation is not hypothetical. Google is defending a claim exceeding USD110 million after its AI Over- views feature allegedly defamed Wolf River Electric, a US solar installation company. Arup, the British engineering consultancy, lost HKD200 million after fraudsters deployed AI-generated deepfakes of senior executives to authorise fraudulent payments. Insurance Coverage Adaptation and the Preventive Role of the Insurer Algorithmic harm does not sit comfortably within any single policy category. A defamatory output from a generative AI system might trigger a media liability policy. A flawed automated financial recommendation could engage professional indemnity cover. A deep- fake fraud falls squarely within cyber-insurance. A chatbot-induced suicide raises product liability ques- tions under the new EU directive. The classification problem is not academic; it determines which insurer pays, which exclusions apply, and whether there is coverage at all. Faced with this fragmentation, some insurers are beginning to condition AI-related coverage on com- pliance with governance requirements: bias test- ing, audit trails, human oversight protocols, incident response procedures. The insurance contract, once again, assumes a regulatory function. By specifying the conditions under which coverage attaches, the insurer shapes the insured’s approach to algorithmic risk management. This is the same dynamic observed in cyber-insurance, applied now to a broader and less well-defined category of exposure. AI is now likely to generate insurance litigation in its own right. The silent-cover problem is particularly acute: more than 90% of insurers’ AI exposure is
122 I NSURANCE L I T IGATI O N 2026
CHAMBERS.COM
Powered by FlippingBook