Insurance & Liability Bridge

1 · Why this document exists

Every regulated AI deployment reaches a point — usually week 4 of a 90-day pilot — where the buyer's GC / CISO / Insurance Broker demands to see DEFONEOS's risk-transfer posture. The three questions, in order:

1. "If your model hallucinates a safety-critical output, who pays?"
2. "What is your cyber cover and does it extend to AI-induced bodily injury / property damage / financial loss?"
3. "What contractual liability cap do you accept, and what carve-outs do you refuse?"

This document is the one-page answer to all three, with the appendix depth to survive CISO/GC/insurance-broker scrutiny. It is not a substitute for binding policy wordings — those are exchanged at MSA signature — but it tells the buyer exactly what cover is in place, which brokers placed it, and what the buyer can claim against in any of 7 named failure modes.

2 · The 4-layer sovereign risk-transfer ladder

DEFONEOS uses a 4-layer ladder to bound buyer exposure. Each layer has its own evidence trail, SIGIL anchor, and named accountable owner.

The four layers stack, not substitute. A buyer faces: prevention has worked (no fault) → indemnity picks up the gap → insurance pays the indemnity → escrow ensures continuity even if DEFONEOS ceases trading. This is what "sovereign" means in a contract.

3 · The 12-line policy schedule (named, dated)

Every line below is a real, in-force policy. Schedules are shared with the buyer under NDA at MSA signature. The schedule is reviewed annually and re-rated at renewal.

Year-1 total in-force limits: £67M aggregate (excluding #9 per-consignment). Renewal target Year 2: £100M aggregate as headcount and signed ARR grow.

4 · The 6 SLA tiers (Bronze → Sovereign-Air-Gap)

DEFONEOS offers six contractual SLA tiers. Each tier maps to a fixed monthly fee band, a defined uptime / response / resolution commitment, and a credit ladder if we miss.

All tiers include: (a) monthly PMS attestation, (b) quarterly BFT-33 council review, (c) named SIGIL receipt per incident, (d) public advisory feed subscription. Sovereign and Sovereign-Air-Gap add (e) single-tenant deployment, (f) named account TAM, (g) 24/7 SEV-1 hotline with the CISO on rotation.

5 · The 7 named failure modes (what the warranty covers)

DEFONEOS's contractual warranty explicitly names 7 failure modes. If any of them occur, the buyer has a defined remedy and a SIGIL-anchored evidence trail:

1. Hallucinated safety-critical output — model returns content that, if acted on, would cause SEV-1 harm. Remedy: full refund + 12-month credit + independent root-cause postmortem.
2. Bias / fairness regression — model performance degrades on a protected characteristic beyond the agreed baseline. Remedy: model rollback + remediation sprint + ISO 42001 PMS entry.
3. Data breach via model — model output enables exfiltration of buyer data or PII. Remedy: 72h disclosure + Beazley cyber claim + forensic cooperation.
4. Regulatory finding — UK ICO / EU AI Office / ISO 42001 cert body finds non-conformity. Remedy: cooperation + remediation plan + cap negotiated in MSA Schedule 4.
5. IP infringement — model output reproduces third-party copyrighted material at scale. Remedy: indemnity (L2) + takedown + retraining sprint.
6. Adversarial exploit — model is jailbroken by named attack class. Remedy: emergency patch within 24h + PMS entry + 33-agent BFT review.
7. Availability miss — uptime falls below tier commitment for any calendar month. Remedy: tier-appropriate credit + postmortem + corrective action plan.

6 · The 4 risk-transfer mechanisms (contractual)

7 · Carve-outs we refuse vs. accept

8 · SIGIL-anchored warranty matrix (the 42 entries)

Every warranty claim is evidenced by a SIGIL receipt. The matrix below is the contractual reference: 6 tiers × 7 failure modes = 42 named remedies, each with a SIGIL template ID.

Each WRM-ID resolves to a SIGIL template: {wrm_id, tier, failure_mode, remedy, evidence_required, attestation_period, max_credit_pct, bft_vote_required}. Buyers verify any WRM via curl https://csoai.org/warranty/verify/{wrm_id}/{incident_id}.

9 · Insurance broker engagement (the 5 named partners)

DEFONEOS maintains active relationships with 5 broker partners. A buyer's own broker can interface with any of them for confirmation of cover:

Buyer's brokers are entitled to confirm cover, request subrogation waivers, and add DEFONEOS as additional insured on the buyer's own policies (where commercially reasonable). The standard additional-insured request is processed within 5 business days.

10 · Sovereign Escrow mechanics (the L4 layer)

Source code, model weights, SIGIL keys, training data hashes, and operational runbooks are escrowed with NCC Group (UK) under UK law and Iron Mountain (US) under Delaware law. Escrow agreement gives the buyer release rights on any of:

• DEFONEOS enters administration, liquidation, or ceases trading
• Material breach of MSA uncured for 60 days
• Material change of control without buyer consent
• Failure to release a critical security patch within 30 days

Escrow verification is quarterly: NCC Group confirms deposit integrity via SHA-256 hash check + canary release test. The buyer receives a SIGIL-anchored verification receipt every quarter.

11 · Cross-walk to existing DEFONEOS artefacts

12 · The 5 Anti-Patterns (Risk-Transfer Failures We Refuse)

1. No "we'll get to insurance later." All 12 lines are in force at MSA signature. Schedules shared within 5 business days of request.
2. No "uncapped liability for AI outputs." Unknowable exposure cannot be insured; we cap at contract value + indemnity carve-outs.
3. No "NDA-only incident response." Material incidents are public on csoai.org/advisories per PMS plan.
4. No "broker may not speak to buyer." Our brokers are authorised to confirm cover on request.
5. No "escrow is symbolic." Escrow is quarterly verified with SHA-256 canary tests; buyer receives SIGIL receipt.

13 · Buyer Next Steps

1. Verify this document hash: curl https://csoai.org/defoneos-mod-insurance-liability-bridge.html | shasum -a 256
2. Request policy schedules (NDA required): procurement@csoai.org
3. Request a 60-minute broker call: Aon / Marsh / WTW / Howden / Lockton (your choice)
4. Browse the warranty matrix: csoai.org/warranty/{wrm_id}
5. Verify escrow status: csoai.org/escrow/verify
6. Subscribe to material-incident advisories: csoai.org/advisories/subscribe