Document Type : Original Research Paper

Authors

• Fatemeh Najibzadeh Vamegh Abadi ¹
• Sayyed Mohammad Hadi Ghabooli Dorafshan ²
• Hosein Naseri Moghaddam ³

¹ PhD Student, Department of Islamic Jurisprudence and Principles of Islamic Law, Faculty of Theology and Islamic Studies, Ferdowsi University of Mashhad, Mashhad, Iran.

² Associate Professor, Department of Islamic Jurisprudence and Principles of Islamic Law, Faculty of Theology and Islamic Studies, Ferdowsi University of Mashhad, Mashhad, Iran.

³ Professor, Department of Islamic Jurisprudence and Principles of Islamic Law, Faculty of Theology and Islamic Sstudies, Ferdowsi University of Mashhad, Mashhad, Iran.

Abstract

BACKGROUND AND OBJECTIVES: The expansion of artificial intelligence (AI) and Internet of Things (IoT) systems, characterized by data-dependence, learning capabilities, continuous updating, and multi-actor interaction across supply and operational chains, has challenged classical models of liability allocation and the logic of insurability with new forms of uncertainty. Because AI and IoT systems often evolve after deployment, operate through interconnected hardware and software layers, and distribute control across manufacturers, developers, deployers, operators, importers, and service providers, they complicate the identification of the legally relevant act, the responsible person, and the causal path linking malfunction to damage. These characteristics challenge the assumptions on which traditional civil liability and insurance have long relied, namely relative stability of product configuration, clearer boundaries between product and service, and a more direct relationship between conduct, fault, defect, and harm. In the European Union, the consolidation of risk-based regulation under the Artificial Intelligence Act and the redesigning of product-defect liability under the revised Product Liability Framework have strengthened the capacity to translate technological risk into legally auditable and actuarially priceable risk. Yet this transformation is not linear. The same reforms that clarify certain duties may also broaden the circle of potentially liable actors, expand recoverable damage, and intensify disputes over evidentiary access, causation, and allocation of loss in complex socio-technical ecosystems. This article therefore assesses the extent to which the emerging legislative architecture enhances liability predictability and supports the insurability of AI-IoT-related risks, while identifying the points at which interpretive and enforcement heterogeneity, together with aggregated and correlated risks, may undermine insurability. The article also asks whether the EU’s current model merely improves ex ante risk governance, or whether it can also sustain ex post compensation through insurance markets under the conditions of technological opacity, cross-border litigation, and systemic exposure.
METHODs: Adopting a legislative-interpretive approach and a normative analysis of the core EU instruments, the study proceeds along three axes: (1) the construction of risk and compliance obligations in the AI Act; (2) the redefinition of “product,” “liable person,” the scope of compensable harm, and related evidentiary mechanisms in the revised Product Liability regime; and (3) the implications of the absence of an EU-wide harmonized layer of proof in fault-based liability following the abandonment of the AI liability initiative. On the first axis, the analysis focuses on how the AI Act turns technical and organizational requirements into legally reviewable obligations, including data governance, documentation, logging, transparency, human oversight, post-market monitoring, and traceability across the system lifecycle. On the second axis, it examines how the revised Product Liability Framework accommodates software-intensive and update-dependent technologies by extending the concept of product, broadening the category of accountable economic operators, and facilitating the production and disclosure of evidence in disputes involving technical opacity. On the third axis, it evaluates the legal and insurance consequences of leaving fault-based claims subject to divergent national procedural and evidentiary regimes, especially regarding standards of proof, access to information, judicial timing, and causation analysis. These legal elements are then mapped onto the technical variables of insurance underwriting, including data and model auditability, the control of moral hazard and adverse selection, aggregation-risk management, premium differentiation, the design of compliance-based policy conditions, deductibles, limits of liability, exclusions, and the structuring of reinsurance responses to low-frequency and high-severity events.
FINDINGS: Clearer liability boundaries and measurable obligations, particularly in high-risk domains, enable insurers to rely more heavily on external compliance benchmarks, reduce dispute costs over causation and fault, and support more realistic risk-based pricing and contractual design. The AI Act contributes to this outcome by transforming broad expectations of safe and trustworthy AI into verifiable legal duties that can function as underwriting signals, policy conditions, and claims-handling reference points. The revised Product Liability Regime likewise improves legal intelligibility by clarifying the status of software and digitally integrated systems, by extending possible liability beyond the narrow figure of the traditional manufacturer, and by facilitating evidentiary access in contexts where defect and causation would otherwise remain difficult to establish. From an insurance perspective, these developments improve observability, reduce some information asymmetries, and create a more structured basis for calibrating premiums, exclusions, deductibles, and coverage triggers. Nevertheless, the findings also show that the same architecture generates new pressures on insurability. The expanded set of potentially liable actors, the rise of multi-defendant litigation, and the difficulty of quantifying certain data-related and non-pecuniary losses, combined with divergence in evidentiary standards and adjudicatory timelines across Member States, introduce divergent legal risk into pricing functions and place market capacity under strain, especially in low-frequency, high-severity, and highly correlated scenarios such as update shocks, security incidents, and systemic failures. This is particularly important where a single defect, update, model error, or cyber event may affect large numbers of devices or users simultaneously, thereby turning what appears to be isolated liability into accumulated exposure. The absence of a harmonized evidentiary layer for fault-based liability means that legal uncertainty remains unevenly distributed across jurisdictions, increasing reserve volatility, claims administration costs, and the difficulty of maintaining consistent underwriting standards across the internal market.
CONCLUSION: Effective insurance responses to AI-IoT risks depend on three concurrent linkages: (1) lifecycle traceability and auditability of data and models; (2) tying coverage to compliance-based conditions and robust incident-logging and event-recording obligations; and (3) a minimum degree of interpretive and institutional coordination to reduce evidentiary fragmentation and cross-border transaction costs. Absent these linkages, fault-shifting within ecosystemic chains and correlated risks may destabilize premiums and constrain market capacity. Accordingly, standardizing baseline disclosure and event-recording requirements, periodically reviewing regulatory regimes against insurability metrics, and strengthening reinsurance mechanisms and risk pools are central to sustaining insurability and ensuring continuity of compensation in an evolving technological environment.

Keywords

• Artificial intelligence
• Artificial intelligence act
• civil liability
• European union
• Insurability
• Internet of Things Risk

Main Subjects

• New Insurance Technologies