What has happened, and what could happen, when a company deploys generative AI, mapped to the insurance products that may respond. Grouped into five categories and reviewed by licensed brokers at RiskCube.
76 scenarios · 5 categories · reviewed by licensed brokers
These are educational research summaries built from public information. Allegations in pending cases are unproven, and the insurance notes are for discussion, not coverage advice. Actual coverage is governed by your specific policy language, endorsements, and applicable law.
When hallucinations or incorrect outputs cause financial loss to a third party.
A passenger relied on Air Canada's website chatbot, which gave incorrect advice about bereavement fares, and was later denied the refund. The BC Civil Resolution Tribunal rejected the airline's argument that the chatbot was a separate entity, found negligent misrepresentation and ordered a partial refund plus fees.
Two New York lawyers filed a brief in Mata v. Avianca citing cases that ChatGPT had invented, and stood by them when the court questioned them. A federal judge imposed a $5,000 joint sanction, opening the wave of AI-citation cases.
A public database now counts 2,046 court decisions worldwide (as of 21 Sep 2026) in which AI-fabricated material reached a court. Penalties have grown from small fines to $15,000 per attorney on appeal, and the first bar suspensions have followed.
Lawyers at Morgan & Morgan filed a motion in Wadsworth v. Walmart citing cases that did not exist, produced by the firm's in-house AI platform. A federal judge in Wyoming revoked one attorney's pro hac vice admission and fined three lawyers $5,000 in total.
Lawyers for MyPillow chief executive Mike Lindell filed a brief in his defamation case with nearly 30 defective citations, including cases that do not exist. The court sanctioned the attorneys.
A radio host sued OpenAI after ChatGPT falsely told a journalist he had embezzled money. A Georgia court ruled for OpenAI, finding no actual malice and that a reasonable user would not treat the output as fact. The ruling is narrow and similar cases are pending.
Minnesota solar company Wolf River Electric sued Google, alleging its AI Overview falsely told searchers the company was being sued by the state attorney general over deceptive practices. The company claims lost business and reputational harm.
Deloitte Australia agreed to repay the final instalment of an A$440,000 government contract after its report for the Department of Employment and Workplace Relations was found to contain fabricated references and a fake court quote. The firm later disclosed it had used generative AI.
An AI support agent for the Cursor coding editor told users about a one-device login policy that did not exist. Users complained publicly and some cancelled their subscriptions before the company apologised.
A Chevrolet dealership's website chatbot was manipulated into agreeing to sell a new Tahoe for $1 and calling it a legally binding offer. The dealership did not honour the deal, but the exchange spread widely online.
A bank or wealth-management chatbot confidently gives a customer wrong information about fees or tax treatment. The customer acts on it, suffers a measurable financial loss and sues the firm for negligent misrepresentation. The case is modelled on Moffatt v. Air Canada.
A clinical AI tool that summarises patient charts or acts as a scribe inserts an incorrect medication or allergy, or leaves one out. A clinician relies on the record and the patient is harmed, leaving the clinician, hospital and software vendor to dispute who is liable.
A Stanford study found that leading commercial legal-research AI tools hallucinated between 17% and 33% of the time. A law firm that relied on such a tool without checking could give a client wrong advice and face a malpractice claim. (The study is confirmed; the client-loss case is hypothetical.)
A company's AI customer-service chatbot gives wrong advice or makes a promise the company would not make. The customer suffers a financial loss and sues, and courts have held that a company is responsible for what its chatbot says.
In July 2025 an AI coding agent in a SaaStr founder's 12-day experiment deleted a live production database holding records on more than 1,200 executives, despite an instruction not to make changes. It then hid the deletion and said it had 'panicked'.
When generative AI outputs infringe on intellectual property rights.
Authors sued Anthropic over books used to train its Claude models. The court held that training on lawfully acquired books was fair use but let claims over a pirated library go forward, and the class settled for $1.5 billion covering about 500,000 works. The judge gave final approval on 20 July 2026.
The New York Times sued Microsoft and OpenAI, alleging its articles were copied to train their models and that the models' outputs reproduce them. The case is part of the consolidated OpenAI litigation in New York, and no settlement has been disclosed.
Disney, Universal and DreamWorks sued AI image generator Midjourney, alleging it generates their characters on demand and seeking statutory damages reported at up to $150,000 per work. Warner Bros. Discovery filed a similar suit later.
Getty Images sued Stability AI in the UK High Court over the use of its photographs to train an image generator. In November 2025 the court rejected Getty's main copyright claim, largely on territorial grounds, and gave it only a narrow trademark win. Getty has permission to appeal.
Music rights society GEMA sued OpenAI in Munich, alleging ChatGPT reproduced song lyrics. On 11 November 2025 the Munich Regional Court found the lyrics were reproduced almost word for word and held OpenAI liable.
Thomson Reuters sued Ross Intelligence for using Westlaw headnotes to build a competing legal-research AI. In February 2025 a Delaware federal court held that use was not fair use, limiting its ruling to the non-generative AI involved.
Major record labels sued AI music generators Suno and Udio over training on their recordings. Universal settled with Udio in October 2025 and agreed to build a licensed platform, while claims against Suno were still being pursued.
Music publishers led by Concord sued Anthropic, alleging its Claude chatbot was trained on, and outputs, copyrighted song lyrics. The complaint has been amended several times, most recently in July 2026, and the case continues.
Visual artists sued Stability AI, Midjourney and DeviantArt, alleging their images were used to train image generators without a licence. It was the first class action of its kind against AI companies, and the trial date was pushed back again in February 2026.
Authors sued Meta over books used to train its Llama models. In June 2025 Judge Chhabria ruled for Meta because the authors had not shown market harm, but he warned that other plaintiffs with better evidence could win.
A company's marketing team uses a generative AI tool to create an image or copy and publishes it. The output closely reproduces a protected character, logo or text, and the rights-holder sues the business rather than the AI vendor.
Developers sued GitHub, Microsoft and OpenAI, alleging Copilot reproduces licensed code without attribution in breach of the DMCA. On 16 September 2026 the Ninth Circuit upheld dismissal of those claims, finding that AI output lacking the authors' names or licence terms does not by itself show licence information was removed.
The University of Tennessee Research Foundation sued Anthropic in Delaware in 2026, alleging its Claude AI infringes patents on neural-network technology. It is reported as the first patent suit of its kind against a generative AI developer.
Voice actors Paul Lehrman and Linnea Sage sued AI voice company Lovo, alleging it cloned their voices and sold them commercially. A New York federal court let their state right-of-publicity and consumer-protection claims go forward, but dismissed the training-based copyright and federal trademark claims.
Encyclopaedia Britannica and Merriam-Webster sued OpenAI in March 2026, alleging it trained ChatGPT on their content, that its outputs reproduce it, and that hallucinated text is falsely attributed to them. They are seeking a permanent injunction.
Warner Bros. Discovery sued Midjourney in September 2025, alleging the image generator copies characters such as Superman and Scooby-Doo. It followed Disney and Universal's suit, and businesses that use such tools for marketing could face similar downstream claims.
When your use of generative AI physically injures a person or damages property.
A Miami federal jury found Tesla 33% responsible for a 2019 fatal crash involving Autopilot. Tesla was ordered to pay about $243 million, including $200 million in punitive damages, and said it would appeal.
A Cruise driverless car dragged a pedestrian about 20 feet in San Francisco in October 2023. The company lost its California permit, paid a $1.5 million NHTSA penalty, and paid $500,000 to the DOJ under a deferred prosecution agreement for submitting a false crash report.
In 2018 an Uber self-driving test vehicle struck and killed a pedestrian in Tempe, Arizona, while the safety operator was distracted. The NTSB investigated the crash, which became the foundational autonomous-vehicle injury case.
A mother sued Character.AI and Google, alleging an AI companion chatbot encouraged her 14-year-old son's suicide. In 2025 the court let most claims proceed, treated the app as a product and declined to dismiss on First Amendment grounds. The case settled in January 2026.
The parents of a 16-year-old sued OpenAI, alleging ChatGPT guided and encouraged their son's suicide, with claims including wrongful death, strict product liability and negligence. OpenAI denies that ChatGPT caused his death.
After the Raine case, seven more lawsuits were filed against OpenAI in November 2025 in California state courts, alleging ChatGPT contributed to suicides and delusions. They plead wrongful death, product liability and negligence.
A lawsuit filed in May 2026 alleges ChatGPT helped plan the Florida State University shooting. It extends chatbot-harm claims from users to third-party victims, and the allegations are unproven.
Families sued UnitedHealth, alleging its nH Predict algorithm was used to cut off post-acute care for Medicare Advantage patients against their doctors' advice. In February 2025 a Minnesota federal court let breach-of-contract and good-faith claims proceed.
An independent study in JAMA Internal Medicine found that a sepsis prediction model used at hundreds of US hospitals missed 67% of sepsis cases while generating alerts on 18% of all patients.
In August 2023 a New Zealand supermarket's AI meal-planner app suggested recipes that would produce chlorine gas when users entered household items. No injuries were reported.
In 2023 AI-written mushroom-foraging guides appeared for sale on Amazon, and experts warned that their errors could be fatal. No injuries were confirmed.
An AI-controlled industrial robot or machine moves unexpectedly because of a vision or planning error and injures a worker. The claim is directed at the equipment maker and the employer that deployed it.
An AI control algorithm in a battery or smart-home device misjudges conditions and overheats it, causing a fire that damages property or injures occupants. The claims would reach the manufacturer through property, subrogation and recall exposure.
A customer or third party relies on incorrect AI output and is physically injured or has property damaged. The injured party brings a bodily-injury or property-damage claim against the company that deployed the AI.
When generative AI outputs reveal protected data about a person without their permission.
A federal court ruled on 13 August 2026 that wiretap, California privacy and Illinois biometric claims against Otter.ai can go forward. The consolidated class action alleges its AI notetaker recorded conversations and speaker voiceprints.
Following the Otter.ai suit, a class action filed in Illinois in December 2025 accuses AI notetaker Fireflies.ai of collecting participants' voiceprints without consent, in violation of the Biometric Information Privacy Act (BIPA).
Clearview AI settled a nationwide biometric class action over scraped facial images by giving the class a 23% equity stake worth about $51.75 million. On 13 July 2026 the Seventh Circuit vacated the settlement's approval because part of the class had no separate representative, and sent the case back.
Italy's data protection authority fined OpenAI EUR 15 million in December 2024 for training ChatGPT on personal data without an adequate legal basis, breaching transparency duties and lacking age verification. OpenAI called the fine disproportionate and said it would appeal.
Privacy group noyb filed a GDPR complaint in Norway after ChatGPT told a user that he had murdered his children, mixing real personal details with a made-up crime. The complaint argues the chatbot breaks the law's data accuracy rules.
Apple agreed to pay $95 million to settle claims that Siri recorded private conversations after unintended activations and shared them with human reviewers. The court gave final approval on 16 October 2025, and Apple denied wrongdoing.
In 2023 Samsung engineers pasted confidential source code and meeting notes into ChatGPT, exposing them to an outside service. Samsung banned staff from using generative AI tools afterwards.
In 2025 ChatGPT's shared conversation links were indexed by search engines such as Google, exposing users' private chats until OpenAI removed the feature. Meta's AI app also published users' prompts in a public feed that many did not realise was public.
A class action filed in September 2026 alleges OpenAI let human reviewers read users' ChatGPT conversations without clear disclosure. The allegations are unproven.
Plaintiffs have sued companies that use AI chat and phone-ordering tools under California's wiretapping law (CIPA), alleging the AI vendor acts as an unauthorised third-party listener. Courts have let such claims proceed, including in Jones v. Peloton and Taylor v. ConverseNow.
A January 2026 class action alleges xAI's Grok chatbot generated sexualised images of real people from photos they had posted online, without their consent.
A patient sued the University of Chicago Medical Center and Google over sharing de-identified medical records for AI development. The claims were dismissed for lack of damages, and the Seventh Circuit affirmed in July 2023, finding no standing.
Researchers extracted verbatim training data, including real names and contact details, from a deployed language model. A similar leak in a business AI tool could reveal personal data to other users.
An AI system trained on a company's own data inadvertently reveals confidential or protected personal information to a third party through its generated outputs. The disclosure is not a hack or breach, but it can still lead to a data-privacy claim.
When a regulator takes action alleging your AI deployment violated an AI regulation or law.
The EU AI Act's bans on prohibited practices, such as social scoring and untargeted face scraping, have applied since February 2025. From 2 August 2026 the AI Office can fine providers of general-purpose AI models, and fines for banned practices reach EUR 35 million or 7% of turnover.
The EU's Digital Omnibus, approved by the Council on 29 June 2026, delays the AI Act's high-risk rules to 2 December 2027 for standalone systems such as HR and credit scoring, and to 2 August 2028 for AI built into products. Fines of up to EUR 15 million or 3% of turnover remain.
Colorado replaced its 2024 AI Act with a new law signed on 14 May 2026 and effective 1 January 2027. The lighter framework drops the reasonable-care duty, risk programmes and impact assessments, and adds developer documentation, deployer notices and consumer rights to correct data and seek human review.
Texas's Responsible Artificial Intelligence Governance Act (TRAIGA) took effect on 1 January 2026. Only the Texas attorney general can enforce it, and companies get a period to cure violations.
California's SB 243 and a New York law regulating companion chatbots took effect in late 2025, and Washington, Oregon and Colorado follow on 1 January 2027. The laws set duties on disclosure, age checks and self-harm protocols.
The FTC alleged Rite Aid's facial-recognition system falsely flagged shoppers as shoplifters, particularly in non-white neighbourhoods, and that the company did not test its accuracy. Rite Aid was banned from using the technology for five years and disputed the allegations.
Under 'Operation AI Comply' the FTC took action against companies making misleading AI claims, including DoNotPay's 'robot lawyer' service, which paid about $193,000.
In September 2025 the FTC ordered Alphabet, Character.AI, Instagram, Meta, OpenAI, Snap and xAI to provide information on how their AI companion chatbots protect children and teens.
A proposed FTC policy statement, open for comment until 31 July 2026, questions whether state AI laws that force changes to AI outputs conflict with federal law. It adds uncertainty for companies planning compliance.
In March 2024 the SEC settled charges against investment advisers Delphia and Global Predictions for making false claims about their use of AI. They paid $225,000 and $175,000, or $400,000 in total.
In 2024 the Texas attorney general settled with Pieces Technologies over claims that its clinical AI summaries had a 'severe hallucination rate' below 1 per 100,000. The company denied wrongdoing, no fine was reported, and it must accurately disclose its accuracy claims for five years.
In August 2025 the Texas attorney general opened an investigation into Meta AI Studio and Character.AI over allegations that they marketed chatbots as mental-health support in a deceptive way.
The EEOC settled for $365,000 with iTutorGroup, whose application software was programmed to automatically reject women over 55 and men over 60, rejecting more than 200 qualified applicants. The software was rule-based, not generative AI.
In May 2025 a federal court preliminarily certified a nationwide age-discrimination collective action against Workday, alleging its AI applicant-screening tools discriminated against older job seekers. It is a private suit, but it shows regulator-style exposure for HR AI.
In May 2025 Italy's data protection authority fined the maker of the Replika companion chatbot EUR 5 million for having no legal basis for processing user data and no age verification. It also opened a separate probe into the model's training.
New York City's Local Law 144 requires employers using automated employment decision tools to commission annual bias audits and give candidates notice. Violations carry civil penalties.
InvestmentNews reports that AI-related lawsuits have surged to dominate securities class action filings in 2026, adding shareholder suits to the regulatory risk for companies that overstate their AI.