Insurance & Risk Transfer

By the time you reach this chapter you have a workload (Chapter 1.1), a financing structure (Chapter 2.5), and a contract stack (Chapter 2.4). Insurance sits underneath all three, and it is routinely treated as the boring last form to sign. That instinct is wrong, and in 2026 it is expensively wrong. The risk-transfer market is now a second underwriting desk — running in parallel with your lenders — that grades the same design they grade, on a different axis: not 'will this earn its cost of capital' but 'how badly does this lose money when it fails, and how correlated is that loss with every other policy on our book.' When that desk says no, or says yes-but-sub-limited, or says yes-but-only-if-you-change-the-cooling, the consequence lands on the financing schedule and the engineering basis, not on a renewal spreadsheet.

We work through the lifecycle the way the policies do — builder's risk / construction-all-risk (CAR) and delay-in-startup (DSU) during the build; property and business-interruption (BI) in operation; the liquid-cooling and lithium/BESS insurability problem that has repriced the pool; how insurability now drives design through FM-class loss-prevention approvals; the GPU-collateral insurance package that lenders bolt onto every financed cluster; and the tail covers — parametric, environmental, and cyber — that sit outside the property tower. The through-line: an AI campus has concentrated more replaceable value, more novel failure modes, and more catastrophe-correlated accumulation into a single footprint than almost any asset class the property market underwrites, and the market has noticed.

During construction the asset is covered by builder's risk (US) or construction-all-risk (CAR) (international) — first-party physical-damage cover on the works, materials, and (critically) the long-lead equipment in transit and storage. For an AI build this is already non-trivial, because the most valuable, most fragile, longest-lead items — the GPUs, the liquid-cooled NVL-class racks, the 50–100 MVA transformers, the switchgear — are in motion or in storage for months before they are energized, and a transit or warehouse loss on a sold-out component (CoWoS-constrained accelerators, >12-month-lead HV transformers) does not merely cost the replacement value; it costs the schedule. → long-lead exposure in Chapter 2.3.

That schedule exposure is exactly what the delay-in-startup (DSU) overlay — sometimes ALOP, advance loss of profits — is built to address. DSU is time-element cover that triggers when an insured physical-damage event during construction pushes back the date the facility can begin earning. The mechanism matters: DSU does not pay for the damaged transformer (builder's risk does that); it pays the revenue you lose because the damaged transformer delayed energization. For an AI campus whose revenue is a signed hyperscaler take-or-pay or a credit-tenant lease, the DSU exposure can dwarf the physical-damage exposure. A practitioner-cited illustration: a 50 MW facility leased at ~$150/kW-month loses roughly $45M of revenue over a six-month delay (Commercial Risk, 2025) — and a gigawatt campus scales that by 20x.

Here is the consequence that surprises first-time AI developers: DSU, not physical-damage capacity, is the binding ceiling on the whole builder's-risk tower. Underwriters treat the DSU sum insured as a PML-like (probable-maximum-loss) exposure and curb their line sizes against it even when physical-damage capacity looks abundant; they regard DSU as disproportionate to premium and ration it accordingly (Aon; Commercial Risk, 2025). And the most common DSU trigger on an AI build is not a fire — it is the power-supply delay: the utility or third-party generation developer who must build the substation misses its date. Whether that off-site, off-contract delay is even covered is a drafting fight, and a 'pressure point' brokers now flag explicitly. → the interconnection-and-energization risk this insures against in Chapter 3.4.

Once the campus is live, the cover shifts to property + business interruption, and the AI build breaks two assumptions the property market spent decades calibrating. The first is value concentration. A legacy data hall concentrated maybe $5–15k/rack of IT value; an NVL72-class rack concentrates $3–4M of accelerators behind a single liquid loop, and a gigawatt campus stacks tens of billions of replaceable silicon into one geofence. Swiss Re flags individual campuses reaching ~$20B of construction value before equipment is even installed, and projects global data-center-linked premium rising to ~$24.2B by 2030 from ~$10.6B — the fastest-growing line in commercial property (Swiss Re Institute, 2026). S&P projects construction-related coverage alone could reach ~$10B of premium in 2026, roughly twice the global aviation market.

The second broken assumption is BI structure. Conventional BI pays lost net income while a damaged facility is repaired. An AI campus's income, though, is tied to computing capacity and to interconnected-campus dependencies — a substation or a CDU loss can strand goodput across racks that suffered no physical damage, and the revenue is governed by SLAs and goodput contracts, not by floor area. Worse, the dominant outage cause is upstream: power supply drives ~45% of data-center outages (Uptime Institute), and a grid-down or contingent-BI event is exactly where standard property BI carries exclusions. The result is a coverage gap precisely over the most likely loss — which is why operators increasingly bolt on contingent-BI, service-interruption, and parametric grid-down covers, and why the goodput-vs-availability framing of Chapter 12.2 is also an insurance argument.

And then there is the loss-history shock that has actually moved premiums: fire and water. FM's 15-year study finds fire drives ~42% of loss costs from only ~11% of events — fire is rare but catastrophic. The new entrant is liquid: liquid-related losses now represent ~24% of total data-center loss costs (Swiss Re), a category that barely existed in air-cooled facilities. A leak in a direct-to-chip loop is not a mopping job; it is a high-value, energized-electronics water event. That single statistic is why liquid-cooled halls now see per-occurrence water sub-limits and higher retentions, and why the cooling decision in Chapter 5.4 is also a premium decision.

Two engineering choices that define the 2026 AI campus — pervasive direct-to-chip liquid cooling and rack-integrated or facility-scale lithium-ion energy storage (BBUs and BESS) — are precisely the two the insurance market understands least and fears most. They have repriced the risk pool, and they did so for sound actuarial reasons, not market panic.

Liquid cooling introduced water (and, in dielectric designs, specialty fluids) into the immediate vicinity of the most valuable energized electronics ever installed at density. The loss data caught up fast: ~24% of data-center loss costs are now liquid-related (Swiss Re). Underwriters respond with per-occurrence water sub-limits, leak-detection and CDU-redundancy requirements, and credit for designs that physically separate the technology-cooling and facility-water loops — which means the leak-detection and concurrent-maintainability engineering of Chapter 5.4 earns a premium credit, and skipping it earns a surcharge or a decline.

Lithium-ion is the sharper problem because its failure mode is thermal runaway — a self-sustaining, propagating, hard-to-suppress fire that, when sited rack-level inside the data hall, sits next to the silicon it is meant to protect. This configuration did not exist in legacy halls. FM's loss-prevention guidance now treats it as a first-class hazard: data sheets DS 5-32 (data centers) and DS 5-33 (Li-ion BESS), an April-2025 interim revision adding FM-Approved off-gas detection, raised fire-resistance wall ratings (one hour to two), and the pointed instruction not to rely on clean-agent or water-mist systems where Li-ion is present (FM, 2025). The two-phase-immersion saga is the cautionary tale: 3M's exit from PFAS-based Novec fluids amid ~$12.5B of liability exposure (ServeTheHome; C&EN) did not just disrupt a cooling supply chain — it demonstrated how fast a fluid choice can become an environmental-liability problem the market will not insure. → fire-design and suppression strategy in Chapter 6.5.

In 2026, insurability runs upstream of design, not downstream of it. The mechanism is the loss-prevention approval. Carriers in the FM-style 'highly protected risk' tradition (FM, plus IRI/GXS-lineage and carrier-specific equivalents) do not merely price a finished design — they publish data sheets that specify what they will insure, conduct plan review before construction, and gate favorable terms on the use of FM-Approved components and configurations. A design that conforms is insured at standard terms; a design that deviates is repriced, sub-limited, or declined.

The practical effect is that the insurer's data sheet becomes a de facto design code that sits alongside NFPA, ASHRAE, and the local AHJ — and on the novel hazards (Li-ion placement, DLC leak control, off-gas detection) it is often stricter and more current than the building code, because the carrier carries the loss. The forks this creates are concrete: choose a battery chemistry and placement that clears DS 5-33, or accept a fire sub-limit and a higher retention; specify FM-Approved off-gas detection and two-hour-rated separation, or pay the surcharge; separate the cooling loops and instrument them for leak detection, or eat a water sub-limit. None of these is a post-design negotiation. Each is a design input that, if discovered late, forces a re-engineering or a worse policy — the same one-way-door dynamic the cooling cliff creates in Chapter 5.1, except the gate here is an underwriter's signature.

When the silicon is the collateral — and with $20B+ of GPU-backed debt outstanding by early 2026 (Quartz; secondary analyses), it increasingly is — the lender's insurance requirement becomes a financing covenant, not an operational nicety. The structure mirrors decades-old aircraft and equipment finance: every financed GPU must carry a property policy naming both the borrowing SPV and the lender as loss payee / additional insured, written for full replacement value (not the outstanding loan balance), so a physical-damage or theft event makes the lender whole regardless of the amortization state of the loan. → the financing structures this protects in Chapter 2.5.

The harder problem is not the fire that destroys a rack — it is the slow-motion total loss the property policy does not cover: economic obsolescence. A GPU that still works perfectly can be worth a fraction of its book value because a successor part displaced it, and that residual collapse is the central credit risk of GPU-backed debt (see the depreciation debate in Chapter 1.8). The market's answer is residual-value insurance (RVI): at origination, valuers set a warrantied value schedule for the collateral across the loan life; if a liquidation event realizes value below the schedule, the shortfall up to ~80% of the warrantied amount is covered by institutional reinsurance. The warranty costs on the order of 150 bps/yr, netted from the interest yield (American Compute; USD.AI, 2025). The consequence for the deal is direct: the RVI floor becomes the baseline for collateral valuation — the lender no longer has to guess what the GPUs are worth in 2029; it knows the insured minimum at each year — which lets it advance more against the asset and price tighter than it could against an unhedged, thin secondary market.

The fork, then, is whether your financing can actually source the RVI floor it assumes. The reinsurance appetite for GPU residual risk is real but young and thin; if the secondary market for a given generation is too illiquid to underwrite a credible floor, the RVI is unavailable or punitive, the lender reverts to a conservative haircut (advancing 50–70% at 12–15% to reflect the depreciation risk it cannot transfer), and the capital stack gets smaller and more expensive. This is the cleanest example in the build of insurability and financing being the same decision.

Three exposures sit awkwardly inside a standard property/BI tower, and the AI campus pushes each hard enough that operators increasingly transfer them separately.

• Parametric weather / seismic / grid-down. Where indemnity BI is slow, contested, and exclusion-riddled (especially for grid-down and contingent losses), parametric cover pays a fixed sum on an objective index trigger — a measured wind speed, ground acceleration, or grid-frequency/outage event at the site — with fast, dispute-free settlement. The price is basis risk: the index can trigger when you had no loss, or fail to trigger when you did. For the ~45%-of-outages power-supply tail, a parametric grid-down policy is often the only efficient transfer, and it pairs naturally with the BYOP/island-mode resilience of Chapter 3.4.
• Environmental liability. Coolants, dielectric fluids, refrigerants, diesel, and battery electrolytes are all pollutants under environmental law. The PFAS reckoning around two-phase immersion fluids (3M's exit; ~$12.5B exposure) is the live warning: a fluid choice can become a long-tail liability the property market explicitly excludes, requiring a dedicated environmental-impairment / pollution-legal-liability policy — and a coolant choice that carries PFAS exposure may be effectively uninsurable on the liability side regardless of its thermal merits.
• Cyber. An AI campus is a high-value cyber target whose compromise can cause physical and business-interruption loss, not just data loss. Data-center cyber premiums rose 25–40%/yr from 2022–2025 (Hotaling, 2026), and the underwriter's fear is accumulation: a single exploited control-plane or OT vulnerability replicated across a fleet is a correlated, systemic loss, which is why cyber capacity is rationed and sub-limited much like nat-cat.

The common thread: each of these is a tail the commercial property market either excludes or prices punitively, which is why large operators stand up a captive insurer — a wholly-owned vehicle that formally retains the layers the market won't price efficiently, converting an uninsurable gap into a funded, balance-sheet-managed retention. The captive is not a way to avoid insurance; it is the structure that makes self-insuring the uninsurable tail explicit, capitalized, and auditable.

A risk-transfer position that survives lender diligence and board scrutiny is not a stack of certificates — it is a set of decisions, made at the basis-of-design stage and carried through close, that the rest of the project inherits:

• An insurability-gated design basis. The cooling, battery, and fire-design choices are validated against the carrier's loss-prevention data sheets before the basis-of-design freezes — the loss-prevention engineer reviews alongside the AHJ and the lender's independent engineer, so FM-class conformance is designed in, not litigated at bind.
• A placed, layered program matched to the financing schedule. CAR + DSU sized to the energization-date revenue at risk, an operational PD/BI tower syndicated across enough A-rated capacity to cover the campus value, with the retentions and per-occurrence sub-limits (water/liquid, fire, cyber, nat-cat) understood and accepted as financing inputs.
• A collateral-protection package the lender's covenant actually requires. Full-replacement-value property naming the lender as loss payee, plus a sourced RVI floor on the financed GPUs — with the floor stress-tested independently, not taken on faith.
• An explicit tail strategy. A named decision on which tails (grid-down, environmental/PFAS, cyber) are transferred parametrically or via dedicated liability cover, and which are retained in a capitalized captive — so the uninsurable gap is funded, not discovered.

The recurring anti-pattern is treating insurance as procurement instead of design: choosing the cooling, the battery placement, and the fire-suppression on engineering grounds alone, then discovering at bind that the configuration is sub-limited or declined — at which point the only levers are a worse policy or a re-engineering that slips the energization date the entire capital stack depends on. Insurability is a design input. The cheapest place to clear the underwriter's bar is the design review; the most expensive is financial close.