Insurance & Risk Transfer

By this chapter you have a workload (Chapter 1.1), a financing structure (Chapter 2.5) and a contract stack (Chapter 2.4). Insurance sits underneath all three, and it is routinely treated as the boring last form to sign. In 2026 that instinct is expensive. The risk-transfer market is now a second underwriting desk, running in parallel with your lenders, that grades the same design on a different axis. Lenders ask 'will this earn its cost of capital'. Underwriters ask 'how badly does this lose money when it fails, and how correlated is that loss with every other policy on our book.' When the underwriter says no, or yes-but-sub-limited, or yes-but-only-if-you-change-the-cooling, the consequence lands on the financing schedule and the engineering basis, not on a renewal spreadsheet.

The policies track the lifecycle, and so does the chapter: builder's risk / construction-all-risk (CAR) and delay-in-startup (DSU) during the build; property and business-interruption (BI) in operation; the liquid-cooling and lithium/BESS insurability problem that has repriced the pool; how insurability now drives design through FM-class loss-prevention approvals; the GPU-collateral protection terms some financings require; and the tail covers (parametric, environmental and cyber) that sit outside the property tower. What changed is the pool itself. An AI campus concentrates more replaceable value, more novel failure modes and more catastrophe-correlated accumulation into a single footprint than almost any asset class the property market underwrites, and the market has noticed. For each loss scenario, find the insured interest, apply the trigger, retention and limit, then name the committed cash that covers the uncovered loss and the wait until the insurer pays. Neither an engineering approval nor a large headline limit guarantees a recovery.

During construction the asset is covered by builder's risk (US) or construction-all-risk (CAR) (international). Either one covers insured physical damage to the works and declared materials. Include transit and off-site storage explicitly for long-lead equipment, with the covered journeys, locations and limits matched to the shipment and storage values. For an AI build this is non-trivial, because the most valuable, most fragile, longest-lead items (the GPUs, the liquid-cooled NVL-class racks, the 50–100 MVA transformers, the switchgear) are in motion or in storage for months before they are energized. A transit or warehouse loss on a sold-out component (CoWoS-constrained accelerators, or US substation transformers, whose lead times Wood Mackenzie's 2026 assessment puts beyond 160 weeks) does not merely cost the replacement value. It costs the schedule. → long-lead exposure in Chapter 2.3.

That schedule exposure is what the delay-in-startup (DSU) overlay, sometimes called ALOP (advance loss of profits), is built to address. DSU is time-element cover that triggers when an insured physical-damage event during construction pushes back the date the facility can begin earning. DSU does not pay for the damaged transformer (builder's risk does that). It pays the insured financial loss from the delayed start-up that damage caused, on the basis the policy states. For an AI campus whose revenue is a signed hyperscaler take-or-pay or a credit-tenant lease, the DSU exposure can dwarf the physical-damage exposure. A practitioner-cited illustration: a 50 MW facility leased at ~$150/kW-month puts roughly $45M of gross revenue at risk over a six-month delay (Commercial Risk, 2025), and a gigawatt campus scales that by 20x. That figure is the exposure, not the indemnity. Bridge it to the insured sum before you set the limit: DSU commonly insures gross profit or specified standing charges and debt service (a loss-of-rent formulation differs), net of saved expenses and subject to the time excess, indemnity period and sub-limits. Size the maximum indemnity period to the replacement lead of whatever can burn rather than a stock 12 months, since a burned-out transformer can delay energization by about three years.

Check the defects exclusion and testing cover before counting recovery. LEG 1/96 excludes loss or damage caused by defects. LEG 2/96 can cover resulting damage but excludes the rectification costs that would have been incurred immediately before that damage. Under LEG 3/06, once damage occurs, the excluded replacement or rectification cost is the cost of improving the original material, workmanship, design, plan or specification. A defect's existence alone does not establish covered damage. DSU depends on delay from covered damage and its own exclusions, so separate excluded defect repairs from covered resulting damage. Price broader defects cover against its retention, and match both physical-damage and DSU testing-and-commissioning terms to hot testing and the IST schedule in Chapter 2.1.

DSU can cap a construction placement even when physical-damage capacity is available. Aon's May 2026 construction conference identified damage-driven start-up exposure as a constraint for some insurers. Some underwriters treat the DSU sum insured as a PML-like (probable-maximum-loss) exposure, curb their line sizes against it and regard it as disproportionate to premium (Aon; Commercial Risk, 2025). Test the available DSU limit against the insured financial loss and lender covenant alongside the works limit. The recurrent drafting fight is a power-supply delay: DSU responds only when insured physical damage causes the delay, so an off-site utility or third-party generation loss needs explicit coverage, and a schedule miss without covered damage does not trigger DSU. Marsh’s September 2026 analysis spells out the gap: a missed interconnection date with no physical loss typically falls outside the DSU trigger, while supplier liability is usually limited to repair, replacement or equipment value. Pure supply-chain or interconnection delay therefore sits between the contract remedies and the policy; allocate it in the EPC and supply contracts, or carry it and price it. → the interconnection-and-energization risk this insures against in Chapter 3.2.

Calculate the landlord’s lost interest, then the policy response. Rent is 10 MW × 1,000 kW/MW × $100/kW-month = $1.0m per 30-day policy month, and insured gross profit is that rent less the 20% saved expense, $0.80m a month. The whole 90-day delay costs 90/30 × $0.80m = $2.4m. The fire adds 90 − 30 = 60 days beyond the permit delay. The 15-day time excess leaves 45 payable days, worth 45/30 × $0.80m = $1.2m, well inside the six-month maximum period. The $1.0m limit binds, so the policy pays $1.0m. The landlord keeps $1.4m: $0.80m for the permit delay, $0.40m for the time excess and $0.20m above the limit.

Two variants show where the boundaries sit. If the same 90-day slip has no covered damage behind it (the permit or a utility delay, not the fire), nothing is recoverable and the landlord bears the whole $2.4m. Raising the limit to $1.2m recovers only the $0.20m shortfall; the permit delay and the excess stay with the landlord. The transformer repair is a works-cover claim, and debt service is paid out of gross profit, so it is not added again. Fund the retained loss and the months before the claim pays: the schedules come from Chapter 2.1, custody and recoveries from Chapter 2.4, and the funding from Chapter 2.5. The damage, gross-profit and time-deductible method follows Munich Re’s DSU training.

Once the campus is live, cover shifts to property + business interruption, and the AI build breaks two assumptions the property market spent decades calibrating. The first is value concentration. SemiAnalysis's August 2025 hyperscaler model puts a GB200 NVL72 rack-scale server at $3.1M, before networking, storage and other deployment costs. Value the hardware generation you are buying, and its cooling fault domain, in the property-loss scenario. A gigawatt campus stacks tens of billions of replaceable silicon into one geofence. Swiss Re flags individual campuses reaching ~$20B of construction value before equipment is even installed, and projects global data-center-linked premium rising to ~$24.2B by 2030 from ~$10.6B (Swiss Re Institute, March 2026, citing Aon). S&P projects construction-related coverage alone could reach ~$10B of premium in 2026, roughly twice the global aviation market.

The second broken assumption is BI structure. Business-income cover commonly measures lost net income plus continuing normal operating expenses during the policy's period of restoration; extra-expense cover addresses insured additional costs of maintaining or restoring operations. An AI campus's income, though, is tied to computing capacity and to interconnected-campus dependencies. A substation or CDU loss can strand goodput across racks that suffered no physical damage, and revenue is governed by SLAs and goodput contracts, not floor area. Power is also the largest single cause category. In Uptime Institute's 2026 outage analysis, power caused ~45% of respondents' most recent impactful outages in 2025 (down from 54% in 2024), most often on-site UPS failures rather than the utility. Both halves land awkwardly. On-site electrical failure belongs to equipment breakdown and machinery BI, while a utility interruption or dependent-property loss is exactly where standard property BI carries exclusions. The result is a coverage gap over the most likely loss, which is why operators increasingly add contingent-BI, service-interruption and parametric grid-down covers, and why the goodput-vs-availability framing of Chapter 12.2 is also an insurance argument.

Then there is the loss-history shock that has actually moved premiums: fire and water. FM's 15-year study finds fire drives ~42% of loss costs from only ~11% of events, so fire is rare but catastrophic. Water is the other: liquid- and water-related damage accounts for ~24% of data-center loss costs across that same multi-year review (Swiss Re). The category predates direct-to-chip cooling, since it counts sprinkler leakage and facility-water events, and DLC now adds a new mechanism. A leak in a direct-to-chip loop is not a mopping job; it is a high-value, energized-electronics water event. That loss history, plus the new exposure a pressurized loop puts inside the rack, is why liquid-cooled halls now see per-occurrence water sub-limits and higher retentions, and why the cooling decision in Chapter 5.4 is also a premium decision.

Two engineering choices that define the 2026 AI campus, pervasive direct-to-chip liquid cooling and rack-integrated or facility-scale lithium-ion energy storage (BBUs and BESS), give underwriters distinct leak, fire and accumulation scenarios to price. Get the carrier's terms before either design is frozen.

Liquid cooling put water (and, in dielectric designs, specialty fluids) next to the most valuable energized electronics ever installed at density. Water was already ~24% of data-center loss costs on the sprinkler and facility-water history above (Swiss Re), and DLC adds a pressurized loop at the rack. Underwriters respond with per-occurrence water sub-limits, leak-detection and CDU-redundancy requirements, and credit for designs that physically separate the technology-cooling and facility-water loops. The leak detection and isolation of Chapter 5.11 and the CDU redundancy and concurrent maintenance of Chapter 5.6 therefore belong in the underwriting submission. Whether they earn a premium credit, a surcharge or a decline is for the carrier to say in its written offer.

Lithium-ion is the sharper problem because its failure mode is thermal runaway, a self-sustaining, propagating, hard-to-suppress fire that, when sited rack-level inside the data hall, sits next to the silicon it is meant to protect. Distinguish that rack-integrated configuration from a separated stationary BESS: location and propagation boundaries change the loss. FM's loss-prevention guidance treats it as a first-class hazard through two data sheets. FM DS 5-33's April 2025 revision added approved off-gas detection and clarified outdoor-container BESS protection; its current edition is April 2026. Its two-hour cutoff-room construction applies to indoor facility ESS. DS 5-32's July 2026 edition separately covers data-hall BBUs and room compartmentation, and it directs that rooms with distributed Li-ion BBUs be protected with automatic quick-response sprinklers or an FM Approved HC-2 water-mist system, not clean-agent or hybrid water/inert-gas systems as the BBU fire strategy (FM DS 5-32, 2026). Apply the installation-specific controls in Chapter 6.5, including that BBU sprinkler or HC-2 water-mist protection.

The two-phase-immersion episode shows how fast a fluid choice can become a supply-continuity and environmental-liability problem. 3M's exit from PFAS manufacturing, including its Novec fluids, was completed at the end of 2025 (ServeTheHome; C&EN), and it disrupted a cooling supply chain. The liability side, and what the pollution policy has to say about it, is in the tail covers below.

In 2026, insurability runs upstream of design, not downstream of it. The mechanism is the loss-prevention approval. Carriers in the FM-style 'highly protected risk' tradition (FM, the IRI and GAPS lineage now at AXA XL Risk Consulting, and carrier-specific equivalents) do not merely price a finished design. They publish data sheets that specify what they will insure, conduct plan review before construction, and tie favorable terms to FM-Approved components and configurations. Data-sheet conformance and approved products support underwriting, but the carrier accepts the installed project, not the product. Get its written acceptance, limits, retentions and conditions for the design you are building. Record whether each recommendation is a condition to bind, a condition after binding or advisory, and what leaving it open costs.

The insurer's data sheet becomes a de facto design code beside NFPA, ASHRAE and the local AHJ, and on the novel hazards (Li-ion placement, DLC leak control, off-gas detection) it is often stricter and more current than the building code, because the carrier carries the loss. The forks this creates are concrete: choose a battery chemistry and placement that clears DS 5-33, or accept a fire sub-limit and a higher retention; follow the installation-specific separation and detection controls in Chapter 6.5, or accept the consequence the carrier writes into its offer; separate the cooling loops and instrument them for leak detection, or eat a water sub-limit. None of these is a post-design negotiation. Each is a design input that, if discovered late, forces a re-engineering or a worse policy. It is the same one-way-door dynamic the cooling cliff creates in Chapter 5.1, except the gate here is an underwriter's signature.

When silicon secures a loan, the lender's insurance requirements become financing covenants, not an operational nicety. CoreWeave's March 31, 2026 disclosure identifies an $8.5B delayed-draw facility secured by HPC infrastructure and a customer contract. Facility capacity is distinct from debt drawn. The structure mirrors decades-old aircraft and equipment finance: the financing documents specify required property coverage, the valuation and settlement basis, insured parties, loss-payee status, limits, deductibles and exclusions. A covered physical-damage or theft recovery can still differ from replacement cost or the loan balance, and naming a lender does not create an unconditional make-whole result. → the financing structures this protects, including that facility, in Chapter 2.5.

The harder problem is not the fire that destroys a rack. It is the slow-motion total loss the property policy does not cover: economic obsolescence. A GPU that still works perfectly can be worth a fraction of its book value because a successor part displaced it, and that residual collapse is the central credit risk of GPU-backed debt (see the depreciation debate in Chapter 1.8). One disclosed structure is USD.AI's Barkr-backed collateral warranty. At origination, valuers set a warrantied value schedule for the collateral across the loan life, and if a liquidation event realizes value below the schedule, institutional reinsurance covers the shortfall up to ~80% of the warrantied amount. USD.AI disclosed an approximately 150 bps/yr cost, netted from interest yield, for that program (USD.AI, May 2026); it is not a market-wide price. The conditional warranty schedule can inform collateral valuation, which lets a lender advance more against the asset and price tighter than against an unhedged, thin secondary market. Recovery still needs a qualifying liquidation and is limited by realized value, the cap and the program terms, so model it as conditional cash, not an insured minimum.

The fork, then, is whether your financing can actually source the residual-value insurance (RVI) floor it assumes. If a deal cannot place the residual protection its credit model assumes, the lender must haircut recovery, reduce the advance, reprice or reject the structure. Here, insurability and financing are the same decision.

Three exposures sit awkwardly inside a standard property/BI tower, and the AI campus pushes each hard enough that operators increasingly transfer them separately.

• Parametric weather / seismic / grid-down. Where indemnity BI is slow, contested and exclusion-riddled (especially for grid-down and contingent losses), parametric cover pays on an objective index trigger (a measured wind speed, ground acceleration or grid-frequency/outage event at the site), with faster settlement using independent trigger data and the policy's payment conditions. The price is basis risk: the indexed payout and your economic loss can diverge, including a real loss that never trips the trigger. Parametric fits the utility-interruption slice of the power tail, an off-site event an index can measure, while on-site electrical failure belongs to equipment-breakdown and machinery BI and a dependent-property loss to contingent BI. Match the cover to the cause. It pairs naturally with the BYOP/island-mode resilience of Chapter 3.4.
• Environmental liability. Coolants, dielectric fluids, refrigerants, diesel and battery electrolytes create spill, cleanup and liability exposures. Identify each substance's legal classification and the policy's pollution and PFAS wording. 3M completed its PFAS-manufacturing exit at the end of 2025; its 2025 Form 10-K reports $10.5–12.5B payable during 2024–2036 for the US public-water-supplier settlement. Those payments are not a two-phase-immersion loss estimate, but they show how a fluid choice can become a long-tail liability. Before counting on a liability recovery, get the dedicated environmental-impairment / pollution-legal-liability policy to address the chosen fluid expressly.
• Cyber. An AI campus is a high-value cyber target whose compromise can cause physical and business-interruption loss, not just data loss. The underwriter's fear is accumulation: a single exploited control-plane or OT vulnerability replicated across a fleet is a correlated, systemic loss. Expect the carrier to underwrite that accumulation head-on, naming the covered events and exclusions and setting how the limits respond. Pricing is soft for now: Marsh's Q2 2026 index reports global cyber renewal rates down 4%, the twelfth consecutive quarterly decline, with stable capacity and continued insurer competition. That is a global series, not a data-center rate.

The common thread: each of these is a tail the property tower either excludes or prices separately, which is why large operators stand up a captive insurer, a wholly owned vehicle that formally retains the layers the market won't price efficiently and turns an unpriced gap into a funded, balance-sheet-managed retention. The captive is not a way to avoid insurance; it is the structure that makes self-insuring the tail explicit, capitalized and auditable.

A risk-transfer position that survives lender diligence and board scrutiny is a set of decisions, made at the basis-of-design stage and carried through close, that the rest of the project inherits:

• An insurability-gated design basis. The cooling, battery and fire-design choices are validated against the carrier's loss-prevention data sheets before the basis-of-design freezes. The loss-prevention engineer reviews alongside the AHJ and the lender's independent engineer, so FM-class conformance is designed in, not litigated at bind.
• A placed, layered program matched to the financing schedule. CAR sized to insured works values and DSU sized to the insured delayed-start financial loss after saved expenses, plus an operational PD/BI tower syndicated across enough A-rated capacity to cover the campus value, with the retentions and per-occurrence sub-limits (water/liquid, fire, cyber, nat-cat) understood and accepted as financing inputs.
• A collateral-protection package the lender's covenant actually requires. The property valuation basis, limits, deductibles, exclusions and lender status the financing documents require, plus any deal-specific collateral warranty, with its trigger, cap and recovery schedule stress-tested independently.
• An explicit tail strategy. A named decision on which tails (grid-down, environmental/PFAS, cyber) are transferred parametrically or through dedicated liability cover, and which are retained in a capitalized captive, so the gap is funded, not discovered.

The recurring anti-pattern is treating insurance as procurement instead of design: choosing the cooling, the battery placement and the fire suppression on engineering grounds alone, then discovering at bind that the configuration is sub-limited or declined. At that point the only levers are a worse policy or a re-engineering that slips the energization date the entire capital stack depends on. Insurability is a design input. The cheapest place to clear the underwriter's bar is the design review; the most expensive is financial close.