Software and web developer insurance: is IT liability enough, or do you need a technology package?

Key points

• A client who blames your code or advice for a loss is the claim IT liability is built for, and most client contracts that ask for insurance want it.
• Some IT liability policies cover a set list of services, so we check new work, AI included, against the list and what the insurer has agreed.
• Hosting client data, or earning through your own platform, is the usual sign you need cover for your own losses as well.

Do software developers need professional indemnity insurance?

Usually yes. Professional indemnity can help when a client says your code or your advice caused them a financial loss, and your contract may require it too. Client agreements, recruitment agency terms, government panels and tenders routinely ask for professional indemnity and set the limit. Most ask for public liability in the same paragraph.

Say a release you ship breaks a client's ordering system on a Monday morning. Their staff cannot work and the business cannot trade, and the loss builds by the hour until it is fixed. It traces back to your code.

The loss is your client's, and they claim it from you. That is a claim for professional indemnity, and a cyber policy written for your own systems does not answer it.

Public and products liability, the other half of IT liability, covers injury or damage your business causes.

Does the kind of development you do change the policy?

Yes. The work you do decides the policy an insurer offers you, whatever you call yourself.

Some IT liability policies we arrange cover only a set list of IT services. Other work is covered once the insurer agrees to add it. On some, the list covers the usual design, development, integration, hosting and support work.

Some of those lists do not name artificial intelligence. That alone does not mean AI work is excluded, or that the insurer must add it in writing. If you develop AI products or add AI services, tell us what the work involves before it starts. Where it falls outside the policy, we take it up with the insurer.

A technology package can start wider. Its list of services can take in software development, artificial intelligence development, and data and application hosting. The detail sits in the schedule, the part of your policy that lists what you are covered for. We check each thing you do against the services the policy covers and the business description on your schedule.

IT liability or a technology package: how do they compare?

IT liability and a technology package are two classes of cover. You can also hold IT liability with a cyber policy beside it, and the signs below show when to compare a package with that.

Is IT liability insurance enough for a sole developer?

Often, yes. IT liability insurance suits a developer with no client data to speak of and no systems anyone else depends on.

Your contract usually names the limit you must hold. We arrange IT liability cover at $1 million, $2 million, $5 million and $10 million.

When should a software business look beyond IT liability alone?

The work and the contracts tell you more than turnover does. These are the signs we look for:

• Your platform, or the sites you host, hold your clients' data or personal details about their customers.
• Your income comes through your own platform, so an outage cuts it off.
• A client contract asks for cyber cover beside the other two.
• A contract makes you refund part of your fee when you miss a service level (service credits), or pay delay penalties.
• A contract has you give warranties about the software.
• You have gone from building a client's systems to running them, with administrative access.

In a technology package, your own losses can be covered in sections of their own. They include responding to a breach and notifying the people affected. They also include the income you lose while your systems are down, restoring your data, extortion demands and cyber crime. On the IT liability wordings we work with, those breach, downtime and data covers are not offered as options, though a cyber policy of its own beside your IT liability can carry them. Where a change is agreed with the insurer, your schedule and endorsements record it, so we check those before you rely on them. Our page on technology insurance sets out what a package holds and how each section is switched on.

Liquidated damages are a fixed sum a contract makes you pay for late or failed delivery. Most of the IT liability wordings we place do not cover them, and packages differ, so we read your policy and any agreed changes against the contract before you sign.

Do software developers need cyber insurance as well?

If an attack on your own systems would cost you money, yes. On the wordings we place, an IT liability policy has no section that covers cyber, so ransomware, restoring your own data and notifying people after a breach sit outside it. Some go further and exclude cyber outright, and that exclusion can reach a scam that changes the bank details on a payment. The schedule and any endorsements (the written changes added to your policy) decide what you have, so check them before an attack, not after.

Check any small business cyber policy before you rely on it. Such a policy can exclude claims that arise when the IT services you sell to clients fail.

We compare two ways to cover your own cyber losses: a technology package with cyber sections, or a separate cyber insurance policy beside your IT liability, checked for that exclusion. You see what each covers, what it leaves with you and what it costs.

Is web developer insurance any different?

Mostly, no. What you build, the data you hold and what your contract asks for decide it, the same as for any developer. Contracts commonly ask for public liability even if you work remotely, and one visit to a client's premises creates that risk.

If you host the sites you build, the package question comes sooner. Hosting puts your clients' data, and often their customers' personal information, on systems you run. Your clients' websites then go down with those systems, which is when a technology package starts to fit.

A technology package can exclude claims about website accessibility, including for sites built for others. A site you build could draw a complaint that people with a disability cannot use it. If that is a risk, say so when we look at your cover, because that exclusion would leave the claim with you.

What if your clients are in the United States or Canada?

Mention it before the policy starts, because the wording sets where a client can sue you and still be covered. On some of the policies we place, a claim brought in the United States or Canada is excluded unless you buy an extension, and on some the wording offers no extension, so we ask the insurer what it will agree. On others, professional indemnity answers only claims in Australian or New Zealand courts unless the schedule adds more. A technology package sets its territories on the schedule.

Is the cover that comes with a professional membership enough?

It can be, early on. The ACS, a professional body, includes IT liability cover with membership, designed for people starting out as independent consultants or doing limited consulting beside a main job. It applies only while last year's consulting fees stay under the fee limit in the membership terms.

Managed services, payment processing and hosting large numbers of records on a software platform are not automatically covered, and its terms exclude legal proceedings brought in the United States or Canada. Once your fees pass that limit, or your work moves into any of that, it is time for a policy of your own.

Who handles it if a client blames your code?

If a client ever complains about your work and we look after your policy, tell us straight away. A specialist claims manager on our team handles the claim with the insurer, and your broker stays involved. The following up with the insurer is ours, so you can keep your business running. The insurer decides the claim.

Frequently asked questions