FAR 28.307 Insurance Requirements for Defense Contractors

FAR 28.307-2 sets the minimum insurance a defense contractor must carry, and it does so using categories built for workers, trucks, and crewed aircraft. The regulation was never written with autonomous ground robots, unmanned aerial systems, or AI-driven hardware in mind, and that gap now sits at the center of how contractors deploying frontier technology must think about risk.

What FAR 28.307-2 requires, line by line

FAR 28.307-2, under FAC 2026-01, effective March 13, 2026, lays out five liability coverage categories that contracting officers may or must require of a contractor: workers' compensation and employer's liability, general liability, automobile liability, aircraft public and passenger liability, and vessel liability. Each comes with its own floor. Employer's liability coverage must run at least $100,000, except that private carriers cannot write workers' compensation in a state with an exclusive or monopolistic fund. General liability requires bodily injury coverage written on a comprehensive policy form at $500,000 per occurrence; property damage coverage is not automatic, and an agency adds it only when special circumstances call for it. Automobile liability sets minimum per-person and per-occurrence limits for bodily injury, along with a property-damage floor per occurrence, for any vehicle operated in the United States in connection with the contract. Aircraft liability ties its bodily injury floor to a per-person and per-occurrence minimum separate from passenger liability, which instead scales with the number of seats or passengers, whichever is greater, and it sets its own property-damage minimum per occurrence. Vessel liability covers collision and protection-and-indemnity exposure, with the type and amount left to agency discretion.

A single assumption runs through all five categories: each one maps to a physical actor working under human supervision. A worker on a job site. A driver behind the wheel. A pilot in the cockpit. A crew aboard a vessel. FAR 28.307-2, as published at acquisition.gov, remains the primary source for every figure and category name above, and nothing in that text contemplates a system that makes its own decisions without a person directly operating it.

Why the FAR floor is not the contract number

The figures in FAR 28.307-2 are floors, and the FAR itself gives contracting officers the authority to set limits well above them based on contract risk, the location of the work, and agency policy. The insurance section of the contract schedule controls over the regulatory baseline every time, so a contractor who reads only the FAR and stops there is reading half the document.

The gap between the two numbers appears constantly in compliance reviews. If you perform a service contract at a federal facility, you commonly need $1 million per occurrence in general liability coverage, double the FAR floor, plus a separate, higher aggregate limit on top of that. DoD IT contracts, and any cleared contract that touches controlled unclassified information, routinely demand professional liability coverage well above the FAR baseline. DFARS-driven IT solicitations increasingly carry their own separate cyber liability requirement at elevated limits, often specifying coverage for ransomware, data exfiltration, breach notification costs, and regulatory fines by name. The most common compliance failure traces back to this exact gap: a contractor secures a policy that satisfies the FAR 28.307 minimum, submits the certificate of insurance, and watches the contracting officer reject it because the contract schedule called for a higher limit the contractor never checked.

DoD layers one more mechanism onto this picture. DFARS 228.304 establishes the National Defense Projects Rating Plan, also known as the Special Casualty Insurance Rating Plan, as a risk-pooling arrangement meant to minimize the government's cost of the liability insurance listed in FAR 28.307-2. That plan shapes how carriers price DoD risk and how contractors interact with the defense insurance market more broadly. The FAR floor is filtered through a pricing mechanism before it ever reaches a contractor's bid.

The five FAR categories and the autonomous systems they never contemplated

Each of the five FAR 28.307-2 categories assumes a human at the controls, and that assumption quietly excludes the risk profile of autonomous ground robots, unmanned aerial systems, and AI-driven hardware performing on a contract. Workers' compensation and employer's liability exist to cover a human worker who gets hurt during performance. If an autonomous system injures a third party or damages property, workers' comp still responds to any human operator who gets hurt in the process, but it has nothing to say about the autonomous system's own decisions as a source of loss. The employer's liability piece governs the relationship between employer and employee, so it was never built to address liability flowing from a machine's own judgment.

General liability looks, on its face, like it should cover a robot that causes third-party harm, since CGL responds to bodily injury and property damage regardless of what caused them. That assumption no longer holds uniformly. As of January 2026, ISO released form CG 40 47 01 26, which strips CGL policies of coverage for bodily injury, property damage, and personal or advertising injury tied to generative artificial intelligence, building that exclusion directly into the standard policy form. Berkshire Hathaway, Chubb, and Travelers have each sought and received state regulatory approval to exclude AI-related damages from general liability policies, and the majority of those requests have gone through.

Automobile liability was written for vehicles a human drives, and the word "operation" in the FAR text assumes a person at the wheel. Autonomous ground vehicles moving freight or supplies on base fall into a gray zone: they are not automobiles operated by a person in the conventional sense, yet they travel on land and create the same collision risk a human-driven vehicle would. Standard auto policies were written for a human driver and were never revised to contemplate a vehicle whose steering, braking, and routing decisions come from an AI model.

Aircraft liability makes the gap even sharper. The regulation ties its coverage to "aircraft used in connection with performing the contract" and calculates passenger liability by counting seats, a figure that is zero for an unmanned aerial system. A UAS carries no pilot and no passenger, so the seat-based multiplier that drives the FAR's passenger liability floor produces no coverage obligation at all, even though an uncontrolled unmanned aircraft striking a person or structure on the ground creates real third-party risk. Pirker both confirm that unmanned aircraft systems meet the legal definition of aircraft. Standard aviation liability underwriting, though, was built around manned flight, and the aircraft liability floor in FAR 28.307-2 simply does not map onto unmanned operations.

Vessel liability is left almost entirely to agency discretion, so contracting officers get flexibility, but if you deploy unmanned surface vessels or autonomous underwater vehicles, you get no consistent standard to design toward. Vessel collision and protection-and-indemnity coverage was built around crewed vessels with a captain and crew aboard, and an unmanned maritime system raises a basic question: do standard P&I terms even apply when there is no crew to indemnify?

The blended-claim problem that no single FAR category captures

An autonomous system's failure rarely stays inside one FAR category. A single incident splinters across several policy lines at once, and the seams between those lines are where claims get denied. Consider an autonomous logistics system that executes a command and causes physical damage. The loss is a general liability event, because physical damage occurred. It's also a technology errors and omissions event, because the proximate cause was an algorithmic decision. If a recent software update introduced the fault, it may be a cyber event as well. Each policy a contractor holds looks to the others to pick up the claim, and none of them treats it as squarely its own.

Software updates compound the problem in a way traditional underwriting was never built to track. A single update can shift a system's physical risk profile between the date a policy was underwritten and the date of a loss. A fleet priced in one quarter can be running entirely different decision logic the next, with no new human risk decision behind the change, just a shipped update that silently invalidates the assumptions the underwriting was based on. Traditional underwriting has no mechanism for continuous re-rating as that decision logic evolves.

A related trap runs in the opposite direction: a cyberattack against an autonomous robot that results in property damage can fall outside a property policy's cyber exclusion while also falling outside a cyber policy's property damage exclusion, leaving the loss uncovered by both. Identifying that kind of gap before a loss occurs, rather than discovering it in a claim denial, requires reading the two policies against the actual risk profile of the system, not against each policy's own internal logic.

Product liability adds a further wrinkle. When AI software is embedded in physical hardware, product liability coverage may respond to injury and property damage in jurisdictions that treat the AI software itself as a product. Financial losses stemming from that same software failure, though, such as lost revenue or contract penalties with no accompanying physical damage, typically receive no coverage from any of these lines.

The coverage lines FAR 28.307-2 does not mention that defense contracts increasingly require

A program that satisfies FAR 28.307-2 to the letter still leaves an autonomous systems contractor exposed on the lines that matter most for this kind of risk. The regulation's silence on professional liability, cyber, and space risk doesn't excuse a contractor from carrying them. Contracting officers and enterprise customers increasingly require these lines separately, outside what the FAR itself says.

Technology errors and omissions coverage is not addressed anywhere in FAR 28.307-2, yet contracting officers require it on most service, engineering, and IT contracts. Typical limits run into the millions per claim for civilian agency work, and they climb to $5 million or more on DoD IT contracts and contracts touching controlled unclassified information. For an autonomous system, Tech E&O is the line that responds when an algorithmic decision, rather than a mechanical failure, is the proximate cause of a loss. Affirmative AI coverage within Tech E&O remains available from only a narrow set of carriers as of 2026. CFC's June 2026 policy update names model hallucination, AI-generated content, and model drift as affirmatively covered exposures across seven product lines, including technology E&O. Beazley added its own affirmative AI endorsement inside its cyber and technology E&O policies on September 17, 2026. A policy that stays silent on AI exposures is not automatically one that excludes them, but given the ISO CG 40 47 01 26 exclusion form and the carrier exclusions already moving through state regulators, that silence increasingly resolves against the contractor holding the policy.

Cyber liability shows the same pattern of growing demand outside the FAR's text. Separate cyber coverage at elevated limits appears with increasing frequency in DFARS-driven IT solicitations, commonly requiring protection for ransomware, data exfiltration, breach notification costs, and regulatory fines. For an autonomous system, cyber coverage and Tech E&O have to function as a pair. Neither one is sufficient by itself, and the reciprocal exclusion gap described above means a broker has to read both policies against each other before binding coverage, not after a claim arrives.

Inland marine coverage, sometimes called equipment coverage, fills a different gap: moving prototype systems, test equipment, and robotic hardware between facilities and field sites. Standard property policies often undervalue or simply exclude mobile, uniquely valuable equipment like this, so inland marine policies are built around the value and mobility of the specific hardware instead. McConkey's contractor outlook notes that even contractors with a history of adverse claims are seeing only manageable, single-digit rate increases on inland marine, making it one of the more accessible lines in the current market.

Space insurance is a category FAR 28.307-2 never created. If you work on satellite programs or space-adjacent autonomous systems, you have to source this coverage from specialist underwriters entirely outside the standard FAR insurance program. The Aon Space Insurance Market Report put premium income to the space insurance market for risks attaching in 2025 at more than $650 million, an increase over prior years. Rates for launch and in-orbit risks more than doubled in some cases in late 2023 and have stayed elevated through 2024 and 2025, with that pressure expected to persist into 2026, while competitive capacity for novel or difficult risks remains well below what prime-asset risks can command.

Directors and officers coverage rounds out the list, and its relevance is growing as SEC and Department of Justice scrutiny of AI-related disclosures, cybersecurity, and ESG claims expands. The D&O market in 2026 has grown more selective than it was two years earlier. Venture-backed autonomous systems contractors pursuing defense programs carry board-level exposure that a FAR-compliant insurance program, built around workers, trucks, and crewed aircraft, was never designed to reach.