Nobody is insuring the machine

In 1863 a boiler exploded in Calcutta and killed several people. Within a year the Bengal Council had passed Act VI of 1864, India's first boiler law, requiring inspection of steam boilers in the city. Two years later, in Connecticut, engineers founded the Hartford Steam Boiler Inspection and Insurance Company on a different idea: they would pay for the next explosion, provided they could inspect the boiler first. The law said what must be inspected. The insurer, with money on every verdict, set out to learn what an explosion cost and how to prevent the next.India has reached the first of those moments with artificial intelligence. In February 2025 SEBI amended its regulations so that any regulated entity using AI tools, built or bought, is "solely responsible" for their output, and its chairman has promised a tiered framework with kill switches and human oversight. Whatever form that takes, the principle is in the rulebook: a firm answers to the regulator and to its investors for what its AI does. It may pursue the vendor under contract afterwards; it cannot point the regulator to the vendor.That is the right principle, and only a beginning. Owning a liability and knowing its size are different things. Assigning responsibility, measuring losses, estimating future ones, controlling them and transferring part of them to an insurer are five separate jobs. India has done the first. The other four need what its financial system does not yet hold in usable form: comparable records of how, how often and how badly AI systems fail, and of who shares the systems that failed.What a kill switch cannot doOn November 5 Visa published the first results of its Agentic Commerce Benchmark: 22 AI models from 12 labs, given 15 shopping tasks in simulation, failed 42.8 per cent of their runs, and in more than half of those failures the agent still proceeded to a purchase decision. No money moved. The inference is short: an agent that reaches a consequential decision without establishing the conditions for a correct one is the agent a lender or broker should fear. Two days earlier CrowdStrike had shipped an AI Kill Switch that lets a security team cut a rogue agent's access to its models and block it from relaunching, with device-level termination promised later. Stopping an agent prevents further harm; it does not undo what has been done. Some actions can be disputed and reversed; many settled trades, disbursed loans and completed transfers can only be compensated for afterwards, by the institution answerable for them.Why underwriters hesitateIn November 2025 the Financial Times reported that AIG, Great American and WR Berkley had sought US regulators' permission to exclude AI-related liabilities from standard corporate policies, though AIG later said it had no plans to use its filing. Meanwhile a Lloyd's syndicate began writing standalone AI liability cover with Armilla in 2025 and Munich Re has guaranteed AI performance since 2018. Cover exists, but it is bespoke, with published limits modest beside a large institution's exposure. The obstacle is not correlation; insurers write earthquake and cyber cover and reinsure the accumulation. It is that AI losses, above all failures reaching many institutions through one shared system, cannot yet be characterised with comparable evidence. As an Aon executive put it, the industry can absorb a single $400 million loss, but not ten thousand simultaneous claims traced to one AI provider's error. Pricing that means knowing how often such failures occur, what they cost, who bears them, and how many institutions sit on the same model. Indian institutions hold operational loss records, incident logs and vendor registers; what they rarely hold in comparable form is the last answer. What remains missing is a comparable, system-wide picture of which brokers, lenders and payment apps depend on the same foundation models.India's starting pointThree facts converge. First, from April 1, 2027, a revised RBI framework will calculate operational-risk capital using a measure of bank activity, adjusted for historical losses where the relevant requirements apply. An AI-caused loss booked as a generic processing error will still count towards that capital. What disappears is the information that matters for the next failure: whether AI caused it, which provider was involved and how many other institutions share the exposure. A bank can account fully for yesterday's loss while remaining blind to tomorrow's common shock.Second, India has already drafted the remedy. The RBI's FREE-AI committee report of August 2025 recommended formal AI incident reporting and a graded supervisory approach, under which good-faith reporting, audit and red-teaming may earn tolerance for a first lapse without excusing negligence or reducing what an institution owes its customers. MeitY's November 2025 India AI Governance Guidelines similarly recommended a national AI incident database designed to encourage reporting without the threat of penalties for reporting itself. The guidelines have been issued, but the proposed national incident database and the FREE-AI recommendations await implementation.Third, scale. India accounted for 49 per cent of the world's real-time payment transactions in 2023, and its IT services firms build AI for banks across the world, so AI indemnities will flow into Indian contracts from both directions.The ledgerWhat India should build is not another framework but a ledger. Existing operational-risk records can capture causes and consequences, but they do not necessarily identify AI involvement or make shared model dependencies comparable across institutions. Each regulated entity would report AI incidents and material near misses: the use case, what went wrong, the severity, the loss and any recovery, the model, vendor and infrastructure involved, the control that failed and the fix. A common core taxonomy would carry those fields, with sector-specific extensions and severity thresholds set by each regulator for its own entities. No new authority is needed: the Financial Stability and Development Council's sub-committee, which already brings the RBI, SEBI, IRDAI and MeitY together on matters such as KYC, is the natural place to agree the core, though nobody has yet asked it to.Access comes in three layers: full reports to the supervisor; anonymised aggregates to the industry, with thresholds where an incident is so rare or an exposure so concentrated that anonymity fails; and derived statistics, stripped of customer data and model secrets, to insurers and actuaries. FREE-AI's graded approach supplies the incentive without which the ledger stays empty. And a few years of incidents is evidence, not an actuarial table. Its first uses will be better controls, sharper vendor contracts and supervisory sight of concentration. Priced cover, with reinsurance capacity GIFT City's international insurance offices are licensed to bring in, is a later possibility that depends on underwriters' appetite, not the ledger alone.A small business refused a loan because a model misread its accounts, or an investor whose instruction an agent mishandles in a volatile hour, is harmed first and the institution that must correct it second; whether the same flaw is repeating across other firms goes unanswered unless someone is keeping count.The lesson of the boilerHartford's inspectors turned decades of experience with boiler failures into engineering specifications, which the American Boiler Manufacturers Association adopted in 1889. The ASME boiler code followed with its 1914 edition, published in 1915, and the National Board of inspectors was established in 1919 to bring consistency to inspections. The Council in Calcutta required inspection. The lasting institution was the inspector.SEBI has answered who. Accountability is a direction, not a number. The RBI, SEBI and IRDAI could agree a common AI incident taxonomy before April 2027, so that the new operational-risk methodology starts life with records that can tell a model failure from a clerical one, and a shared dependency from an isolated mistake. Calcutta decided what would be inspected. Hartford worked out what an explosion was worth. India has made the first decision about the machine. The second will decide whether it can put a price on the risk.Dr. Aditya Vikram Kashyap is an AI governance researcher and practitioner whose work focuses on institutional accountability, agentic AI, model risk, and the governance of AI in regulated institutions. His broader work examines emerging technology, financial services, and systemic technology risk. Views expressed are his own.- Ends