Future Proof Intelligence · Published 12 August 2026 · 11 minute read

Does your online store need AI agent insurance in 2026?

A shopping assistant that answers product questions, applies discount codes, or quotes a delivery estimate looks like a convenience feature. To an insurer, it is closer to an employee who never sleeps, never asks a supervisor, and can make a commitment to a customer in under a second. Most online store owners have not asked whether their existing cover follows that employee around.

What an AI shopping assistant can actually get wrong

Online store owners tend to think about AI risk in the abstract, as a distant compliance topic, until they list out what their assistant is actually allowed to do. A typical shopping assistant or support chatbot on an SME storefront can quote a price, explain a return policy, recommend a product, apply or invent a discount code, promise a delivery window, and in more advanced deployments, issue a partial refund or adjust an order without a human reviewing the action first. Each of those is a small commercial decision. None of them looked risky when the assistant was switched on. Each one is a place where a wrong answer becomes a real cost.

The pattern that keeps showing up in public incidents is not a dramatic model failure. It is a plausible-sounding wrong answer, delivered confidently, that a customer reasonably relied on. That is precisely the failure mode insurance underwriters describe as the hardest to price, because it does not look like fraud, does not look like a data breach, and does not look like negligence in the way a human employee's mistake usually does.

Two public incidents worth learning from before they happen to you

In December 2023, a customer testing a dealership's website chatbot, built on a general-purpose AI model with no restriction on what it could promise, got it to agree to sell a new vehicle for one US dollar and to state that the offer was a legally binding agreement with "no takesies backsies." The exchange was posted publicly and covered widely, including by Business Insider. The dealership was not compelled to honor a one-dollar sale, but the incident became a case study in how quickly an unconstrained AI agent can create commitments the business never intended, and how public that failure can become within hours.

In January 2024, a UK parcel delivery company's customer service chatbot was manipulated by a frustrated customer into swearing at the company and writing a poem criticizing its own service, an exchange the customer then posted online. It was reported by the BBC and other UK outlets. No contract was at stake, but the reputational cost of an assistant behaving badly in public, while wearing the company's name, was immediate and highly visible. For a small online store, the same dynamic scales down but does not disappear: a screenshot of your assistant confirming a false promise or behaving unprofessionally can spread through a niche customer community just as fast as it spread nationally in these two cases.

Read alongside these two incidents, the ruling in Moffatt v. Air Canada (British Columbia Civil Resolution Tribunal, February 2024) is the legal anchor. The tribunal held that Air Canada was responsible for a bereavement fare policy its chatbot invented, rejecting the airline's argument that the chatbot was a separate entity from the business. The combined lesson for an online store is simple: what your assistant says to a customer is treated, legally and reputationally, as what your business said.

The pricing-algorithm lesson from outside e-commerce

Retailers do not need to look only at chatbots to see what an unsupervised algorithm can cost a business. Zillow, the US real estate marketplace, shut down its Zillow Offers home-buying programme in November 2021 after its automated pricing algorithm, the Zestimate-based iBuying model, systematically overpaid for homes because it could not adjust quickly enough to a shifting market. Zillow reported a inventory write-down of roughly USD 304 million in the third quarter of 2021 alone and total losses connected to the programme exceeding half a billion US dollars, and the company cut around a quarter of its workforce as it wound the division down. Zillow was not a small operator, and its algorithm was not a customer-facing chatbot, but the underlying failure, an automated system making commercial decisions at a speed and scale no human was reviewing in real time, is exactly the risk an online store takes on when a shopping assistant is allowed to set prices, apply discounts, or approve orders without a check. The lesson scales down: a pricing bot with a bug does not need a national real estate market to lose money, it only needs an unsupervised loop and enough transaction volume.

Which of your existing policies might respond, and why the answer is usually "partially"

General liability, the policy most SME e-commerce operators carry as standard, is built for bodily injury and property damage. A pricing error or a false promise from a chatbot is neither, so general liability is rarely the right instrument here, though it may still respond if an AI-driven product recommendation contributes to a physical injury claim.

Cyber liability, increasingly bundled into e-commerce SaaS platform insurance add-ons, responds to unauthorised access, data breach, and network-driven business interruption. An assistant that gives a wrong answer while functioning exactly as configured is not a breach event, so cyber cover typically does not respond to a pricing or promise error either, even though many store owners assume "the AI stuff" falls under cyber by default.

Professional indemnity or errors and omissions cover is the closest conceptual fit, since it is built around a negligent act causing financial loss to a client or customer. The practical barrier is definitional: most PI and E&O wordings define the insured event as a negligent act by a person, and an autonomous agent is not a person under most current policy language. Insurers have also been adding explicit AI exclusion endorsements to PI and E&O renewals through 2026, which means even where the definitional question might have gone in your favour, a specific exclusion increasingly closes the door before it is tested. For the full mechanics of why each of these policies falls short, see our companion piece on whether business insurance covers AI mistakes.

What the EU AI Act now requires if you sell into Europe

A shopping assistant or support chatbot is typically classified as a limited-risk AI system under the EU AI Act, Regulation (EU) 2024/1689, rather than a high-risk one. The obligation that matters most for an online store is Article 50, the transparency duty: a customer interacting with an AI system, including a shopping assistant or support chatbot, must be able to tell they are talking to an AI rather than a human, unless it is obvious from the context. This obligation is now in force following the 2 August 2026 application date. A store that runs an unlabelled AI chat widget on its checkout or product pages is not meeting this duty, independent of any insurance question.

The classification can shift if your assistant does more than answer questions. An assistant that makes automated decisions about credit terms, eligibility for a loyalty programme, or differential pricing based on inferred customer characteristics moves closer to a higher-risk category with materially heavier documentation duties. For SME operators uncertain where their deployment sits, the plain-language overview at EU AI Act SME obligations is the right starting point, and the fuller regulatory detail behind it is maintained on agentliability.eu's operator obligations guide.

A pre-launch checklist before you switch on autonomous actions

Most of the risk in this article is not a reason to avoid AI shopping assistants. It is a reason to be deliberate about what you let them do without a human in the loop. Before allowing your assistant to take an action rather than just answer a question, it is worth confirming five things: whether the action has a hard ceiling, such as a maximum discount percentage or a maximum refund amount, that cannot be overridden by clever prompting; whether every promise the assistant makes is logged and reviewable, so a dispute can be checked against a record rather than a customer's screenshot alone; whether the assistant discloses that it is an AI system, satisfying the Article 50 duty; whether your insurance broker has confirmed in writing how your current policies respond to an action-taking, rather than just an answering, AI system; and whether a human is notified promptly when the assistant takes an unusual or high-value action, so problems are caught in hours rather than after a public complaint.

None of these five checks require an enterprise compliance programme. They are the kind of list a founder or operations lead can complete in an afternoon, and they are precisely the documentation a broker or underwriter will ask for once dedicated AI agent coverage products become more widely available to SME operators. The diagnostic on The Questions page walks through the same territory in more depth, and the coverage pathway page explains how certification and the insurer waitlist fit together for operators who want to get ahead of this.

Frequently asked questions

Does my online store need separate insurance for its AI shopping assistant?

Most standard e-commerce insurance packages, general liability, cyber, and professional indemnity, were not written with an autonomous shopping assistant in mind, so the honest answer is that you likely have a gap rather than a policy that clearly responds. A shopping assistant that quotes a wrong price, applies a discount code it should not have, or promises a delivery date the warehouse cannot meet creates a real financial exposure that most existing SME e-commerce cover does not clearly address. Confirming this with your broker in writing before your next renewal is the practical next step.

What happens if my store's AI chatbot honors a price it should not have offered?

In several widely reported 2023 and 2024 cases, customers persuaded dealership and retail chatbots to agree to prices or terms the business never intended, and the businesses involved faced public pressure to honor the exchange even where they were not always legally required to. The Moffatt v. Air Canada decision in 2024 established that a business is legally responsible for what its customer-facing agent tells a customer, which strengthens the case that a clear, mistaken price quote from your shopping assistant carries real contractual and reputational risk, not just an awkward customer service moment.

Does the EU AI Act apply to a small online store using an AI shopping assistant?

In most cases the obligations are lighter than for a high-risk deployer, but they are not zero. A shopping assistant or customer service chatbot is typically a limited-risk system under the EU AI Act, which means the main duty under Article 50 is transparency: customers must be able to tell they are interacting with an AI system rather than a human. This obligation is now in force. If your assistant also makes automated decisions about pricing, credit, or eligibility for a service, it can move closer to a higher-risk category, which is worth checking with a compliance professional rather than assuming.

Will my professional indemnity or cyber policy cover an AI pricing error?

Usually not by default. Cyber policies respond to unauthorised access, data breach, and network-based business interruption, not to an AI system doing exactly what it was configured to do and producing a wrong price or a wrong promise. Professional indemnity cover is a closer fit in principle, but most wordings define the insured event as a negligent act by a person, and insurers have been adding explicit AI exclusions to renewals through 2026. A written, clause-by-clause confirmation from your broker is the only reliable way to know your position.