IT Consultants Professional Indemnity Insurance
An IT project that fails does so publicly and expensively. A migration that loses data, a system that does not go live on time, an integration that never worked properly: the client's loss is the project cost plus the disruption to their business, and both are far larger than the fee.
Contractual requirements are a significant underwriting consideration in this class. Customers present their own terms, and those terms often include service credits, liquidated damages, uncapped liability for data breach and indemnities for third party claims. These obligations may fall outside the scope of standard professional negligence cover, and a professional indemnity policy does not generally answer obligations accepted by contract.
Two policies are needed and they are commonly confused. Professional indemnity answers the customer's loss caused by your work; cyber answers an attack on your own systems and the costs that follow. A consultancy holding customer data and delivering projects has both exposures at once, which is why combined technology policies exist.
We can advise IT consultancies and software businesses on professional indemnity, cyber cover and the contract terms customers ask them to accept before they are signed.
Common claims and risk exposures
The exposures that produce claims in this trade, rather than a generic list.
Implementation and migration failure
A common claim scenario. A go live that slips, a migration that corrupts or loses records, an integration that never delivers. The customer quantifies the loss as the whole project spend plus the cost of operating without the system.
Downtime and business interruption for the customer
Where a system you built, host or support goes down, the loss is the customer's trading, not yours. Service credits agreed in the contract are a separate and usually uninsured obligation on top.
Customer data in your care
Consultancies routinely hold copies of live customer databases for testing and migration. A breach involving that data is your breach of somebody else's records, with notification obligations and the customer's own regulatory exposure behind it.
Third party software and licensing
Solutions built on other people's components carry their defects and their licence terms. Deploying code without the right licence, or a component with a known vulnerability, is a claim that does not involve your own work being wrong.
Contractual liability beyond negligence
Liquidated damages, service credits, uncapped data breach liability and broad indemnities. Standard customer terms in this sector routinely ask for all four, and a policy answers none of them.
The cover we arrange
We arrange professional indemnity and related insurance around the services you provide, the clients you work with and the contractual requirements you face. The appropriate cover and limits will depend on your individual activities and the terms available from insurers.
Professional indemnity
Claims arising from negligent advice, development, implementation and support. Should extend to breach of contract claims as well as negligence, since technology disputes are usually pleaded both ways.
- Negligent advice and development
- Failed implementations
- Breach of contract where covered
- Defence costs included
Cyber and data
Attack on your own systems: ransomware, extortion, breach response, forensics and notification. Answers a different event from professional indemnity and is not a substitute for it.
- Ransomware and extortion
- Breach response and forensics
- Notification and regulatory costs
- Your own business interruption
Customer data liability
Third party claims where customer or end user data held by you is exposed. This is where cyber and professional indemnity meet, so the two wordings need reading together.
- Claims from customers and their users
- Regulatory investigation costs
- Sits between cyber and indemnity
- Best placed with one insurer
Intellectual property and licensing
Claims alleging infringement of code, content or licence terms in what you delivered. Common where solutions combine open source, licensed components and your own work.
- Code and content infringement
- Open source licence compliance
- Third party component defects
- Usually within the indemnity limit
Run off
Continuing cover after the business ceases or is sold. Software stays in service after the developer moves on, and a claim can arrive long after the last release.
- Continues after the business ceases
- Software outlives the project
- Commonly six years
- Relevant on a sale or acquisition
What an underwriter will ask
Having these to hand shortens the process considerably, and usually improves the terms.
- Income split between consultancy, development, implementation, support and hosting
- The largest contract by value, and the largest customer by share of income
- Sectors served, with financial services, healthcare and public sector stated separately
- Whether customer data is held or processed, and where
- Whether the business hosts systems or provides managed services
- Whether customer contracts are signed as presented, and whether liability is capped
- Whether service credits or liquidated damages are agreed
- Claims and notified circumstances over the last six years
What affects the cost of your insurance?
The main factors insurers consider when assessing the premium.
Contract values and customer size
Rated on the size of the projects and the customers rather than your own turnover, because the loss is measured on the customer's operation.
Data held
Volume and sensitivity of records you hold or process. Payment card, health and financial data are rated well above ordinary business records.
Hosting and managed services
Running systems for customers, rather than building and handing over, extends your exposure to every day the service runs and is rated accordingly.
Contracting discipline
Your own terms, capped liability and defined acceptance criteria are the strongest control in this class. Signing every customer's paperwork unamended is the opposite.
Conditions and exclusions to consider
Terms vary between insurers, so treat these as the questions to ask rather than a description of any one policy.
Service credits and liquidated damages
Agreed sums payable on failure are contractual debts rather than damages for negligence, so they fall outside professional indemnity. They are a pricing decision, not an insurance one.
Guaranteed uptime and performance
A promise of availability or throughput goes beyond reasonable skill and care. Where a service level agreement warrants a figure, the shortfall is generally uninsured.
Known vulnerabilities left unpatched
Cyber policies commonly condition cover on patching and on supported software. A breach through a vulnerability with an available fix is where claims are most often reduced or declined.
Fines and penalties
Regulatory fines on your own business are generally uninsurable, though investigation costs usually are. The customer's fine may be claimable against you as their loss, which is a different matter.
Common questions
We have cyber cover. Do we still need professional indemnity?
Yes, because they answer different events. Cyber responds when your systems are attacked. Professional indemnity responds when your work causes a customer a loss, which includes a project that failed with no attack involved at all. Most technology businesses have both exposures live at the same time.
Our customer contract has uncapped liability for data breach. Can we insure it?
Only up to your policy limit, and the obligation itself is unlimited, so the gap is yours. Negotiate a cap, even a high one, since an uncapped obligation on a data breach is the one term most likely to exceed any limit you could buy.
Are service credits covered?
No. Service credits are sums you agreed to pay if a target is missed, which makes them a contractual debt rather than damages for negligence. Treat them as a cost of the contract and price them in, rather than assuming insurance stands behind them.
A customer says our migration lost their data. Where do we stand?
That is a professional indemnity claim, and it turns on your backup and testing procedure rather than on the loss itself. Notify immediately, preserve logs and the rollback evidence, and do not attempt remediation work as a goodwill gesture before speaking to your insurer, because it can complicate the position.
How do I get a quote from True Risk Solutions?
Call 01304 262880 and speak to a broker, or email info@truerisksolutions.co.uk with what you do, what you need cover for and a phone number with the best time to call, and a broker will call you back. We need a phone number to quote, because the cover and the price depend on questions that are quicker to answer on a call than by email.
Speak to a specialist who understands your industry
Tell us about your business and the work you undertake, and we will come back to you with cover options built around it. Call 01304 262880, or email us with a phone number and the best time to call and a broker will ring you back.