By Ryan Windt | Head of Growth Marketing | Updated June 2026
An MSP rolls out Microsoft Copilot for a client, tunes the permissions, and trains the staff. Three months later, the client discovers Copilot surfaced salary data and a confidential acquisition memo to employees who should never have seen them. The client’s lawyer sends a letter. It is addressed to the MSP, not to Microsoft.
This is the question almost no MSP has a clean answer to yet: when the AI you deployed, managed, or recommended causes a client harm, whose policy pays? The work has changed faster than the coverage written to protect it. MSPs are being asked to manage client AI the way they once managed servers and networks, but the liability that comes with that role sits in a gap between the policies most providers carry.
The New Thing MSPs Are Being Asked to Do
For most of the last decade, the MSP job was clear: keep systems running, keep them secure, keep them updated. AI has quietly rewritten the scope. Clients now expect their provider to help them adopt AI safely, and that means doing things that look nothing like traditional support.
That work includes deploying and configuring tools like Microsoft Copilot, setting the permissions that decide what an AI assistant can read, integrating AI features into client workflows, tuning agentic tools that take actions on a client’s behalf, and recommending which AI products a client should adopt in the first place. Some MSPs are also layering AI into their own delivery, AI-enabled RMM, automated ticket triage, AI helpdesk responses, which touches client environments directly.
Every one of those activities is a professional judgment the MSP is now making on the client’s behalf. And professional judgments are exactly what liability attaches to.
Three Ways an MSP Gets Exposed When Client AI Fails
The exposure is not theoretical, and it is not one single risk. It shows up in three distinct ways, each of which lands on a different part of an MSP’s coverage.
1. The AI you deployed produces a harmful output
An AI tool the MSP configured generates a wrong answer, bad advice, or a damaging automated action, and the client acts on it. An AI agent set up to manage inventory orders ten times what was needed. An AI assistant gives a client’s customer incorrect compliance guidance. The client’s loss traces back to a system the MSP stood up and tuned.
2. The AI you manage exposes client data
This is the most common one today. An AI assistant is over-permissioned and surfaces sensitive data to the wrong people, the Copilot scenario above. An agent reaches into a system it should never have touched. The exposure is a direct result of how the MSP scoped the tool’s access, which is squarely the MSP’s responsibility.
3. The AI you recommended fails, and the client looks to you
Even when the MSP did not build or manage the tool, recommending it can be enough. If a provider advised a client to adopt a specific AI product and that product causes a loss, the client may argue the MSP’s recommendation was negligent. The MSP did not write the software, but it put its professional name behind the choice.
Where the Liability Actually Lands
This is where most MSPs discover their coverage was not built for the work they are now doing. Three different policies could respond, and which one does depends on the nature of the failure, not on what anyone assumed when the policy was bound.
| Type of failure | Which coverage typically responds |
|---|---|
| The AI gave bad advice or made a flawed decision the client relied on | Technology errors and omissions (tech E&O), because this is a professional-services failure |
| The AI exposed or leaked client data | Cyber liability, because this is a data and security event |
| The AI caused the client a financial loss with no data breach and no clear professional error | Often nobody’s policy, this is the gap |
The coordination between tech E&O and cyber is the heart of the problem. Tech E&O responds to the failure of professional services the MSP provided. Cyber responds to security and privacy events. An AI failure can look like both at once, or like neither, and the policies were generally written before anyone was pricing AI as a managed service. For a deeper look at how these two coverages divide responsibility, see tech E&O for MSPs and how it coordinates with cyber.
The Gap Most MSP Policies Have Right Now
The exposure hides in the seam between the two policies, and the seam is widening as AI takes more autonomous action.
Many tech E&O forms were written before agentic AI existed. Their language contemplates human-delivered professional services, not a tool that acts on its own after the MSP configured it. Whether a policy responds to harm caused by an autonomous agent the MSP deployed is, in many cases, an open question that depends entirely on the wording.
Cyber policies, meanwhile, frequently carry a professional-services exclusion. If the loss is deemed to stem from the MSP’s professional advice or services rather than from a security failure, the cyber policy may decline it, pointing to the tech E&O policy, which may in turn argue the loss was a data event belonging to cyber. The client is harmed, the MSP is on the hook, and the two policies point at each other.
This is the same structural problem that shows up whenever responsibility is shared, which is why it echoes the coordination issues in co-managed IT arrangements. The difference is that with AI, the party making the decision in the moment may not be a person at all.
What MSPs Should Do Now
The AI work is not going away, and waiting for the insurance market to fully catch up is not a plan. A few concrete steps close most of the exposure.
- Define your AI scope in the MSA. Spell out exactly what AI work you do and do not take responsibility for. If you configure a tool but the client owns the decision to use its output, say so in writing.
- Confirm your tech E&O language covers AI-driven advice and actions. Ask your broker directly whether harm caused by an AI tool you deployed or recommended would be covered, and get the answer in terms of the actual policy wording, not a general assurance.
- Clarify who owns the AI decision. The more clearly the client owns the choice to rely on an AI output, the less the loss looks like your professional error. Document the human-in-the-loop step wherever one exists.
- Review cyber and tech E&O together, for the seam. The question is not whether each policy is good on its own. It is whether a loss can fall between them. That is a coordination review, not a checklist.
- Treat AI like any other managed service in your risk program. If you are embedding AI into client environments, it belongs in the same risk and coverage conversation as everything else you manage. See embedding cyber insurance into your MSP services for how to fold this into your offering.
Frequently Asked Questions
If I only recommended an AI tool, am I really liable when it fails?
Possibly. A recommendation is a professional judgment, and if a client relied on your advice and suffered a loss, they may argue the recommendation was negligent. You did not write the software, but you put your professional standing behind the choice. Whether your tech E&O responds depends on the policy language and how the claim is framed.
Does my cyber policy cover an AI tool exposing client data?
It may, because a data exposure is the kind of event cyber coverage is built for. But if the insurer views the exposure as resulting from your professional services rather than a security failure, a professional-services exclusion could apply. This is exactly the seam between cyber and tech E&O that needs to be reviewed together.
What is different about agentic AI specifically?
Agentic AI takes actions on its own after it is set up, rather than just generating output a person reviews. That means a harmful action can occur with no human in the loop at the moment it happens, which complicates the question of whose decision caused the loss. Many existing policy forms were written before this was a live concern.
How is this different from regular tech E&O exposure?
Traditional tech E&O contemplates a person delivering a professional service. AI introduces a tool that makes decisions and takes actions on its own after you configure it. The exposure is similar in spirit but the policy language often does not clearly address it, which is why the wording matters more than usual.
Related Resources
- When AI Gets It Wrong: How Cyber Insurance Responds to AI-Related Liability
- Tech E&O for MSPs: How It Coordinates with Cyber and What to Look For
- Co-Managed IT: Where Liability Falls When You Share a Client Stack
- AI Liability and Model Errors: Where Your Coverage Actually Responds
- Cyber Insurance Built for How Managed Service Providers Actually Operate
If you are deploying or managing AI for clients, the time to find the gap in your coverage is before a claim, not during one. Talk to our team about reviewing your tech E&O and cyber together so the seam between them does not become your exposure.