The integration of third-party artificial intelligence tools into mid-market business operations has accelerated faster than the legal and insurance frameworks designed to manage the resulting liabilities. Founders, operators and general counsel at firms with revenues between £10m and £500m now face a practical question: when an AI vendor's model produces a harmful output, who pays?
This article examines how mid-market firms are using indemnity clauses and specialised insurance products to transfer or mitigate liability from third-party AI vendors. It analyses the contract structures emerging in the market, the coverage gaps that persist, and the commercial implications for both buyers and vendors.
The Liability Gap in Third-Party AI
Standard software-as-a-service contracts have long included limitation of liability clauses that cap vendor exposure at the value of fees paid, often with exclusions for gross negligence or intellectual property infringement. AI tools introduce a new category of risk: the model itself may generate outputs that are defamatory, biased, infringing, or otherwise harmful.
A 2024 survey by the law firm Gunderson Dettmer found that 68 per cent of AI vendor contracts reviewed by its corporate practice contained no specific indemnity for model-generated outputs. This leaves the customer bearing the full cost of any downstream harm, including regulatory fines, litigation defence, and reputational damage.
Mid-market firms lack the bargaining power of enterprise clients but face similar exposure. A single employment tribunal claim arising from an AI-driven hiring tool that produced discriminatory outputs could cost a firm £200,000 or more in legal fees and settlement costs, according to estimates from employment law specialists.
Indemnity Clauses: The First Line of Defence
Indemnity clauses are contractual provisions requiring one party to compensate the other for specified losses. In the AI context, buyers are increasingly demanding that vendors indemnify them against losses arising from the vendor's model outputs.
The typical structure emerging in mid-market contracts includes:
- Output indemnity: The vendor agrees to cover losses caused by the model's outputs, including claims for defamation, copyright infringement, or violation of data protection law.
- Training data indemnity: The vendor warrants that the training data used to build the model did not infringe third-party rights, and indemnifies the buyer if it did.
- Security indemnity: The vendor covers losses from a data breach or unauthorised access to the model or its training data.
Negotiation leverage varies. A mid-market firm purchasing a widely used AI tool from a large vendor such as OpenAI, Anthropic, or Google will typically receive a standard form contract with limited indemnity. Smaller AI vendors, particularly those serving niche verticals, are more willing to negotiate specific indemnity terms to win business.
Insurance Products for AI Liability
Indemnity clauses are only as valuable as the vendor's ability to pay. Mid-market firms are therefore turning to insurance products that cover AI-related losses directly.
The market for AI-specific insurance remains nascent but is growing. Lloyd's of London syndicates and several Bermuda-based insurers now offer policies that cover:
- Model output liability: Defence costs and settlements for claims arising from harmful model outputs.
- Regulatory defence: Costs of responding to investigations by the Information Commissioner's Office, Equality and Human Rights Commission, or other regulators.
- Business interruption: Losses from a model failure that disrupts operations.
- Cyber and data breach: Coverage for incidents involving AI systems, including prompt injection attacks or data leakage through model outputs.
Premiums vary widely based on the use case. A customer-facing chatbot in a regulated sector such as financial services may attract a premium of 3-5 per cent of the policy limit, according to brokers specialising in technology risk. Internal productivity tools carry lower premiums, typically 1-2 per cent.
Commercial Impact on Mid-Market Firms
The cost of transferring AI liability is becoming a line item in procurement budgets. A mid-market firm deploying three to five AI tools across marketing, HR, and customer service functions may spend £50,000 to £150,000 annually on AI-specific insurance premiums and legal fees for contract negotiation.
This cost is material but small relative to the potential exposure. A single regulatory fine under the UK GDPR for an AI-related data breach can reach the higher of £17.5m or 4 per cent of global turnover. For a firm with £100m in revenue, that is £4m.
Firms that fail to secure adequate indemnity or insurance face a choice: accept the risk or limit AI adoption. Some are choosing the latter. Anecdotal reports from law firms indicate that mid-market clients are increasingly rejecting AI tools that do not offer output indemnity, particularly in regulated sectors.
Risks and Unknowns
The current approach to AI liability transfer has several weaknesses.
First, indemnity clauses are only as strong as the vendor's balance sheet. A startup AI vendor with limited capital may be unable to honour a large indemnity claim. Insurance policies can mitigate this, but the vendor must have purchased the policy and maintained it.
Second, insurance policies contain exclusions. Standard commercial general liability policies often exclude claims arising from AI systems, particularly those involving algorithmic bias or intellectual property infringement. Buyers must read policy wordings carefully and may need specialist brokers.
Third, the legal landscape is unsettled. No UK court has yet ruled on the enforceability of an AI output indemnity clause. If a court finds that a vendor's limitation of liability is reasonable under the Unfair Contract Terms Act 1977, the indemnity may be unenforceable.
Fourth, regulatory guidance is evolving. The Information Commissioner's Office published guidance on AI and data protection in 2023, but it does not address contractual liability allocation directly. The Equality and Human Rights Commission has not issued specific guidance on AI indemnities.
Why It Matters
For mid-market firms, the decision to adopt a third-party AI tool is no longer purely a technology or cost decision. It is a risk management decision with direct financial consequences. The terms of the contract and the availability of insurance determine whether the firm bears the liability or transfers it to the vendor.
Founders and operators who ignore this dimension expose their firms to uncapped liability. Those who address it systematically gain a competitive advantage: they can adopt AI tools faster and with greater confidence than peers who have not negotiated adequate protections.
FY Outlook
Over the next 12 to 18 months, we expect three developments:
- Standardisation of AI indemnity clauses: Industry bodies such as TechUK and the Law Society of England and Wales are likely to publish model clauses for AI vendor contracts, reducing negotiation friction.
- Growth of the AI insurance market: More insurers will enter the market, driving premium competition and broader coverage. Lloyd's has identified AI liability as a priority growth area.
- Regulatory intervention: The UK government's AI Safety Institute and the Information Commissioner's Office may issue guidance on liability allocation, potentially creating safe harbours for firms that adopt specified contractual protections.
Mid-market firms should review their existing AI vendor contracts and insurance policies now, rather than waiting for a claim to arise.
Conclusion
The transfer of AI model liability from vendors to mid-market buyers is not a theoretical concern. It is happening today through the terms of standard form contracts and the absence of adequate insurance. Firms that treat AI procurement as a risk management exercise, negotiating indemnity clauses and purchasing specialist insurance, will be better positioned to capture the benefits of AI while limiting downside exposure. Those that do not will bear the cost of the industry's growing pains.
