Liability for the autonomous act.
Autonomous Systems Liability is the line we underwrite where a physical system — a robot, a vehicle, a counter-UAS effector, an agricultural sprayer, a surgical arm — takes an action that produces bodily injury, property damage, or consequential financial loss. Coverage attaches to the autonomous decision itself, not to the operator who deployed the system or the platform on which it ran.
The form is written affirmatively. Where the legacy general liability tower defers to the cyber tower, and the cyber tower defers to the AI exclusion, this line answers in the first person. It is the primary or excess layer for the autonomous act.
What we mean by an autonomous system.
- Counter-UAS effectors — kinetic and non-kinetic
- Industrial robotics fleets, warehouse autonomy
- Autonomous mobility — Level 3 and above
- Surgical robotics, autonomous diagnostic agents in-loop
- Agricultural autonomy — sprayers, harvesters, scouts
- Autonomous maritime, port and yard logistics
- Defense and dual-use autonomy with permit
- Pure software decision agents → AI Agent E&O
- First-party model drift → Model Performance Warranty
- EU AI Act & civil regulatory inquiry → Regulatory Defense
- Cyber intrusion and data exfiltration → existing cyber tower
- Workers’ compensation, employer's liability → existing tower
- Recall of the underlying physical asset → existing product recall
Where the form attaches and excludes.
| Deployment context | Primary limit | Excess available | Standard retention | Telemetry tier |
|---|---|---|---|---|
| Industrial robotics — warehouse, manufacturingFleet of 50 to 5,000 units, fixed perimeter. | $5M | to $25M | $50K | Tier A |
| Counter-UAS — non-kineticRF, optical, acoustic. Permitted operator. | $5M | to $25M | $100K | Tier A |
| Counter-UAS — kineticBy referral. DoD or allied permit required. | $2M | to $15M | $500K | Tier S |
| Autonomous mobility — on-road L3+Geofenced or open-road, by jurisdiction. | $2M | to $20M | $250K | Tier A |
| Surgical roboticsFDA-cleared, hospital deployment. | $3M | to $20M | $100K | Tier A |
| Agricultural autonomySprayers, harvesters, autonomous scouts. | $2M | to $10M | $25K | Tier B |
| Autonomous maritime & yardPorts, container yards, harbor craft. | $2M | to $15M | $100K | Tier A |
| Exclusion | Form reference | Buy-back available | Notes |
|---|---|---|---|
| War, terrorism, and sovereign hostilityStandard LMA market exclusion. | § 5.1 | No | Sovereign coverage by separate facility. |
| Undeclared model substitutionA model swapped post-bind without notice. | § 5.2 | No | Notify within 5 business days to preserve cover. |
| Out-of-jurisdiction operationOperation in a region not on the schedule. | § 5.3 | By endorsement | See Jurisdictions for bindable states. |
| Bodily injury arising from intentional kinetic useWhere use is sanctioned but not permitted. | § 5.4 | By referral | Permitted defense use considered separately. |
| Loss arising from cyber intrusionInserts a sublimit when no cyber tower exists. | § 5.5 | Sublimit | Reciprocal carve-in with cyber carrier on request. |
| Recall of the autonomous platformCost of physical recall of the asset itself. | § 5.6 | No | Refer to existing product recall placement. |
| Aggregated punitive damages, where uninsurableWhere law of the seat does not permit. | § 5.7 | No | Defense costs of underlying still covered. |
What we ingest, and on what cadence.
This line binds against a telemetry contract executed at policy inception. The contract obliges the insured to deliver three streams. Castra does not ingest prompts, inputs, outputs, model weights, training data, or end-user personal information. Where a stream is missing or stale, premium adjusts at the next quarterly cycle.
Transport is mTLS to a Castra-managed ingestion gateway or signed SFTP. Data residency is US-East and Frankfurt at the insured's election. The full schema and a sample manifest are part of the broker submission package.
The methodology and the three instruments are described in detail on the Underwriting page.
A sample loss, worked end to end.
The fleet that misread the floor.
A warehouse autonomy fleet of 1,200 mobile units operated by a third-party logistics provider. The fleet ran a perception model that segmented the floor against fixed reference markers. A reflective film was added to the floor during a Friday-evening cleaning cycle. By Monday morning, the fleet's perception model registered the film as a navigable lane and began crossing it. Two pedestrians were injured before the operator triggered a manual stop. Property damage to inventory was significant; bodily injury was non-fatal.
Cause was not malicious. It was a distribution shift introduced by an environmental change the fleet operator did not flag in its permit register. The classification stability signal had registered a 4.1 PSI delta on the relevant feature on Saturday morning and a 5.8 PSI delta by Sunday afternoon, both above the Annex-A review threshold. No notice was filed.
A model that was safe at bind can drift by Friday. The contract is for what happens between Friday and Monday.
Coverage attached under § 2.1.a for bodily injury and § 2.3 for first-party property damage to the insured's inventory. The exclusion at § 5.2 (undeclared model substitution) did not apply — the model was unchanged. The carve-in to cyber at § 5.5 did not apply — the loss was environmental, not intrusion. Defense was tendered to the insured's panel counsel from our directory.
Indemnity paid: $4.2M (bodily injury), $1.8M (property damage to insured inventory). Defense paid: $640K. Total within limit, applied retention $50K. The placement was renewed at the next anniversary at a premium adjustment of +12.4% against the telemetry-priced base, reflecting the realized drift envelope.
Note. This claim example is a composite, drawn from sample patterns. It is not based on any single insured. Amounts are illustrative. The actual application of any policy form depends on the specific facts of a loss and the specific language of the policy as bound.