The AI Risk Timeline

This is a dated map of how AI risk became a discipline. It tracks the moments that built the field across three threads, assurance and standards, regulation, and insurance, from the first AI cover in 2018 to the regulatory deadlines staged out to 2028. Dates are verified to primary sources as of June 2026; forward-looking dates are marked as scheduled.

The foundations (2018 to 2023)

2018. Munich Re launches aiSure, an insurance-backed performance guarantee for AI models. It is the earliest widely cited AI insurance product and, for years, close to the only one.
January 2023. NIST releases the AI Risk Management Framework in the United States, giving the field its first widely adopted shared vocabulary for AI risk.
December 2023. ISO/IEC 42001 is published, the first certifiable international standard for managing AI. It sets the trajectory toward AI governance becoming an auditable credential.

The frameworks land (2024)

February 2024. Armilla raises a seed round to build AI-specific insurance, an early signal of venture interest in the category.
July 2024. NIST adds a Generative AI Profile to the AI RMF, extending it to the systems then driving adoption.
August 2024. The EU AI Act enters into force, the world’s first binding, horizontal AI law, with obligations staged over the following years.
September 2024. Cisco acquires Robust Intelligence, an early move in what becomes a wave of security-for-AI consolidation.

Regulation and the market take shape (2025)

February 2025. The EU AI Act’s prohibited practices and AI literacy obligations begin to apply.
April 2025. Armilla launches a standalone AI liability policy as a Lloyd’s coverholder, one of the first of its kind.
1 July 2025. Australia’s APRA CPS 230 operational risk standard takes effect, capturing AI as operational and service-provider risk.
July 2025. AIUC emerges from stealth to build a standard-plus-insurance stack for AI agents; New Zealand publishes its national AI strategy, “Investing with Confidence.”
August 2025. The EU AI Act’s obligations for general-purpose AI models begin to apply.
Q4 2025. Security-for-AI consolidation accelerates: Palo Alto Networks completes its acquisition of Protect AI, and Check Point acquires Lakera.
October 2025. The EU withdraws its proposed AI Liability Directive, leaving the question of liability for AI harm to existing national law. Australia releases its Guidance for AI Adoption (the “AI6”), and the UK publishes a regulation “Blueprint” centered on an AI Growth Lab.

The market accelerates (2026)

January 2026. Armilla expands its AI liability cover to limits of up to USD 25 million per organization.
February 2026. ElevenLabs goes live with AI-agent insurance backed by certification to the AIUC-1 standard, the clearest public example of embedded AI cover. In the same month, Munich Re extends aiSure to AI vendors through a partnership with Mosaic Insurance.
May 2026. Coalition and Allianz Commercial expand their partnership, with Allianz transferring portions of its standalone cyber book to Coalition, a reminder of the active-risk-intelligence model that AI insurance is now borrowing.
June 2026. The European Parliament approves the Digital Omnibus package, deferring the EU AI Act’s later deadlines.

What is ahead (scheduled)

These dates reflect the EU AI Act as revised by the Digital Omnibus, agreed by the European Parliament in June 2026 and awaiting Official Journal publication.

December 2026 (scheduled). EU AI Act transparency obligations (Article 50), including watermarking of synthetic content.
December 2027 (scheduled). EU AI Act high-risk obligations for Annex III stand-alone systems.
August 2028 (scheduled). EU AI Act high-risk obligations for AI in regulated products (Annex I).

Either of two events, a regulatory change that compels AI insurance or a high-profile reported AI loss, would likely accelerate the market well ahead of these dates. That is the pattern across every emerging insurance category of the last fifty years.

How to read this

The three threads move together. Standards and regulation set the baseline; assurance tooling matures to meet it; and insurance follows once the risk is measurable and the demand is real. For the disciplines behind the dates, see What Is AI Assurance?, What Is AI Insurance?, and The Standards Landscape Explained. The Landscape directory maps the players by category and region.

Common questions

When did AI insurance start? Munich Re launched its aiSure AI performance guarantee in 2018, making it the earliest widely cited AI insurance product. The market stayed small until 2025 and 2026, when standalone AI liability policies, embedded agent cover, and hyperscaler-led programs appeared in quick succession.

What are the key upcoming AI risk dates? The main scheduled milestones are EU AI Act deadlines, as revised by the Digital Omnibus: transparency rules in December 2026, high-risk Annex III systems in December 2027, and high-risk AI in regulated products in August 2028. These dates were agreed by the European Parliament in June 2026 and await Official Journal publication.