# European AI Risk Index 2026: Reference List Published by Future Proof Intelligence. Date: 2026-06-13. Revised: 2026-10-01. Version: 1.0. Every citation used in the Risk Index dataset and the data.html view is listed here with the real instrument, case, or announcement that underlies it. Items marked provisional require independent confirmation before use in published external material. --- ## Regulatory instruments **ref:1** Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 on laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, OJ L, 12 July 2024. Articles cited: 4, 5, 9, 10, 11, 12, 13, 14, 15, 25, 26, 27, 43, 50, 53, 55, 72, 73, 99. **ref:2** Directive (EU) 2024/2853 of the European Parliament and of the Council on liability for defective products and repealing Council Directive 85/374/EEC. Published in the Official Journal 18 November 2024. Member State implementation deadline: 9 December 2026. Applies to products placed on the market or put into service after the date of transposition in each Member State. AI software, including SaaS and cloud-based AI, is explicitly included within the definition of product. **ref:7** National competent authority status is drawn from: (a) Germany: the Gesetz zur Marktueberwachung und Innovationsfoerderung von kuenstlicher Intelligenz (KI-MIG), adopted by the Bundestag on 11 June 2026 and in force since 29 July 2026, with the Bundesnetzagentur as market surveillance authority, contact point and complaints body (bundesnetzagentur.de, bundestag.de); (b) Italy: Law No. 132/2025 of 23 September 2025, Gazzetta Ufficiale n. 223 of 25 September 2025, in force 10 October 2025; Article 20(2) designates AgID as notifying authority and ACN as market surveillance authority and single point of contact (normattiva.it); (c) Netherlands: draft Uitvoeringswet AI-verordening, internet consultation from 20 April to 1 June 2026, still a draft bill (rijksoverheid.nl); (d) France: DDADUE bill of November 2025 and subsequent withdrawal of competent authority provisions. The designation deadline in the dataset is the AI Act duty to designate national competent authorities by 2 August 2025; Italy's designation took effect on 10 October 2025, after that date. (Independent confirmation pending on the French authority designation before citing in published material.) --- ## Case law **ref:4** Moffatt v. Air Canada, 2024 BCCRT 149. British Columbia Civil Resolution Tribunal, decision dated 14 February 2024. Award: CAD 650.88 damages, CAD 36.14 pre-judgment interest, CAD 125 Tribunal fees. Holding: Air Canada liable for negligent misrepresentation by its chatbot. Operators cannot disclaim chatbot outputs by framing the AI as a separate entity. **ref:5** Mata v. Avianca, Inc., No. 22-cv-1461 (PKC) (S.D.N.Y. June 22, 2023). Decided by Judge P. Kevin Castel, United States District Court for the Southern District of New York. A single USD 5,000 sanction imposed jointly and severally on attorneys Peter LoDuca and Steven A. Schwartz and their firm Levidow, Levidow and Oberman P.C., payable into the Court Registry. The attorneys were also required to send corrective letters to every judge whose name appeared in the fabricated opinions. The sanction arose from submitting six AI-generated non-existent case citations. **ref:6** Mobley v. Workday, Inc., Case No. 3:23-cv-00770 (N.D. Cal.). July 2024: agency theory direct liability claim against AI vendor allowed to proceed. May 16, 2025: preliminary collective action certification under the Age Discrimination in Employment Act for applicants over 40 rejected via Workday platform since 24 September 2020. Status as of June 2026: in discovery. No merits ruling issued. --- ## Insurance market milestones > Source-verification pass 15 August 2026. Every entry below was re-checked at the named body's own domain. Where a claim could not be verified there, it was removed rather than reworded, and the removal is noted in the entry. **ref:8** Artificial Intelligence Underwriting Company (AIUC), out of stealth July 2025 with a USD 15 million seed round led by Nat Friedman, with Emergence, Terrain and an Anthropic co-founder also investing. AIUC-1 covers data and privacy, security, safety, reliability, accountability and societal risk, and AIUC states that it operationalises ISO/IEC 42001, the NIST AI RMF, MITRE ATLAS and the OWASP Top 10 for LLMs. AIUC-1 has 51 requirements, 130 controls and six pillars, and Schellman is its first accredited auditor. ElevenLabs announced the first AIUC-1-backed AI agent insurance policy in February 2026 (the day is contested between sources and is not stated), after more than 5,000 adversarial simulations. Verified at aiuc.com, 15 August 2026: https://aiuc.com/ and https://aiuc.com/research/elevenlabs-secures-first-of-its-kind-ai-agent-insurance. The carrier behind the ElevenLabs policy is not named at source; no carrier attribution is made in the dataset. **ref:9** Armilla. A Lloyd's of London coverholder, and by its own account the first coverholder dedicated exclusively to AI liability, from 2024. Affirmative AI Liability Insurance is underwritten by certain underwriters at Lloyd's, with limits up to USD 25 million per organisation. Armilla names Chaucer, Axis Capital, Convex, Greenlight Re and Swiss Re among its underwriters, and states that coverage may not be available in all jurisdictions and is offered only through properly licensed surplus lines brokers. Vanguard AI, launched with Chaucer, combines cyber, technology and AI liability in one coordinated structure. Verified at armilla.ai, 15 August 2026: https://www.armilla.ai/ai-insurance. Armilla launched Affirmative AI Liability Insurance with Lloyd's underwriter Chaucer on 30 April 2025, a date carried on the face of its own announcement page (verified 17 August 2026: https://www.armilla.ai/resources/armilla-launches-affirmative-ai-liability-insurance-with-lloyds-underwriter-chaucer). The Armilla and Trustible collaboration was announced on 8 October 2025 (verified at armilla.ai, 15 August 2026). The coverage exclusions previously carried here could not be verified at source and were removed. No claim is made that Armilla is the only MGA focused on AI liability. **ref:10** Munich Re aiSure. Mosaic Insurance announced its partnership with aiSure on 26 February 2026, providing up to EUR, USD or CAD 15 million in initial capacity against defined AI performance failures. Mosaic describes cover for errors or hallucinations of AI and GenAI models, with loss scenarios including lost revenue, business interruption and legal damages, settling on measurable performance data without a negligence finding. Munich Re does not describe aiSure as parametric, and the dataset does not. Verified at mosaicinsurance.com, 15 August 2026: https://www.mosaicinsurance.com/resources/press-releases/. The 2018 and 2019 coverage-history dates previously carried here could not be verified at munichre.com and were removed. **ref:11** HSB (Hartford Steam Boiler, Munich Re group) introduced AI Liability Insurance for small and medium-sized businesses on 18 March 2026. Standard limits are USD 25,000 or USD 50,000 with a USD 500 deductible, higher limits available. It covers liability for bodily injury and property damage caused by the insured's use of AI, and personal and advertising injury liability. Verified at munichre.com, 15 August 2026: https://www.munichre.com/hsb/en/press-and-publications/press-releases/2026/2026-03-18-introducing-ai-liability-insurance-for-small-businesses.html. Coalition has added a Deepfake Response Endorsement to its cyber policies globally, covering deepfake forensics, legal takedown work and crisis communications, available in the United States, the United Kingdom, Canada, Australia, Germany, Denmark, Sweden and France. Verified at coalitioninc.com, 15 August 2026: https://www.coalitioninc.com/announcements/coalition-adds-deepfake-response-endorsement. The Counterpart affirmative AI product, its carrier panel and its revenue threshold previously carried here are not published at yourcounterpart.com and were removed. **ref:12** Standard-market AI exclusions. ISO endorsement CG 40 47 is reported in trade sources as a standard-form AI exclusion for commercial general liability; this desk has not read the form, and neither its edition date nor its title is stated. Where an AI exclusion endorsement is attached at renewal, silent AI cover narrows. The previous entry attributed late-2025 restriction filings to AIG, Great American and WR Berkley on the strength of trade press reporting. No such filing could be verified at any of the three carriers' own domains and the named-carrier attribution was removed on 15 August 2026. **ref:13** Allianz, AXA and Zurich: no publicly announced standalone AI liability product as of June 2026. The earnings-call and summit attributions previously carried here were not verified at axa.com or zurich.com and were removed on 15 August 2026. The entry is a statement about the absence of a public product announcement, nothing more. --- ## Standards and supervisory instruments **ref:15** ISO/IEC 42001:2023. Information technology. Artificial intelligence. Management system. Published December 2023 by ISO/IEC. The standard specifies requirements and provides guidance for organisations to establish, implement, maintain, and continually improve an AI management system. **ref:16** NIST AI Risk Management Framework 1.0 (NIST AI 100-1). National Institute of Standards and Technology, January 2023. Four functions: Govern, Map, Measure, Manage. **ref:17** NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024. Twelve named GenAI risk categories. **ref:18** EIOPA Opinion on AI Governance and Risk Management. European Insurance and Occupational Pensions Authority, published 6 August 2025 (verified at eiopa.europa.eu, 15 August 2026). Addressed to national insurance supervisors. Reads AI use by insurance undertakings and intermediaries into the Solvency II Directive (2009/138/EC) and the Insurance Distribution Directive (2016/97/EC). Does not introduce new obligations. The document reference EIOPA-BoS-25-360 is contested between sources and is not cited as confirmed. --- ## Methodology documents **ref:3** Agent Certified methodology v2.0, published April 24, 2026, at agentcertified.eu. Seven canonical dimensions: Trust and Safety (weight 18), Context Integrity (weight 14), Distribution Control (weight 12), Product Maturity (weight 14), Governance (weight 16), AI Integration (weight 12), Autonomy Envelope (weight 14). Total weight: 100. Scoring, floor rule, and tier definitions published at the same source. Lineage maps to Future Proof Certified business framework (internal, investments/certified/methodology.md). --- ## Digital Omnibus note The deferral of Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and of Annex I obligations from 2 August 2027 to 2 August 2028, is adopted law: Regulation (EU) 2026/1744, proposed as COM(2025) 836 on 19 November 2025, political agreement 7 May 2026, Council final approval 29 June 2026, published at OJ L, 2026/1744 on 24 July 2026 and in force from 27 July 2026. Article 50 transparency was not deferred; the Article 50(2) marking duty for systems placed on the market before 2 August 2026 applies from 2 December 2026. Verified at digital-strategy.ec.europa.eu and the AI Act Service Desk, 17 August 2026. --- ## Items requiring independent confirmation before external publication The following items are used in the dataset with their current best-available form, but each should be independently confirmed by qualified legal counsel or through primary source access before appearing in published external material: 1. Omnibus Regulation: resolved. Regulation (EU) 2026/1744, in force 27 July 2026; Annex III from 2 December 2027, Annex I from 2 August 2028. 2. KI-MIG (Germany): resolved 15 August 2026. The Gesetz zur Marktueberwachung und Innovationsfoerderung von kuenstlicher Intelligenz (KI-MIG) was adopted by the Bundestag on 11 June 2026 and entered into force on 29 July 2026. Verified at bundesnetzagentur.de and bundestag.de. 3. French competent authority designation: DDADUE bill current status and any subsequent decree. 4. AIUC-1 policy: the carrier behind the ElevenLabs February 2026 announcement is still not named at source. No carrier attribution is made in the dataset. A previous attribution to Munich Re was removed on 15 August 2026. 5. Munich Re aiSure higher limits outside the Mosaic partnership (insurer-facing documents not publicly available). 6. GPAI copyright compliance cross-reference: the specific Directive referenced in Art. 53 of the EU AI Act. 7. Tesla Autopilot wrongful death litigation: not included in the dataset pending primary source verification. 8. Proposed AI Liability Directive (COM/2022/496, 2022/0303/COD): marked for withdrawal in the Commission work programme COM(2025)45 of 11 February 2025; withdrawal notice published in the Official Journal on 6 October 2025 (C/2025/5423). Do not imply the proposal is live. --- This document is a methodology and assessment framework reference published by Future Proof Intelligence. It is not a government accredited certification body, a licensed insurance provider, or an official EU registry. It is an independent evaluation intended to support organisational risk management and third party due diligence. Consult qualified professionals before making compliance, procurement, or coverage decisions based on it.