Software and web developer insurance: is IT liability enough, or do you need a technology package?

Key points

• "Software developer" covers a contractor writing code on a client's site and a business selling its own platform. What you actually do decides the policy.
• IT liability insurance puts professional indemnity and public and products liability in one policy. The standard wording we place has no cyber insuring clause.
• That wording lists the IT services it covers. Work it does not name, an AI product for example, may need to be agreed and added by endorsement.
• A technology package adds cover for your own losses after a cyber event, and its definitions can name software development, AI development and hosting.
• Clients in the United States or Canada are worth raising before the policy is bound.

Do software developers need professional indemnity insurance?

Usually your contracts decide it for you. Client agreements, recruitment agency terms, government panels and tenders routinely require professional indemnity and set the limit, and most ask for public liability in the same paragraph.

The reason they ask is easy to follow. Your code fails. Your client's systems go down, their staff cannot work and they cannot trade. The loss builds by the hour and it traces back to you. That loss is your client's, not yours, so the claim for it is professional indemnity territory. A cyber policy pointed at your own systems does not answer it.

So professional indemnity insurance for software developers is rarely bought on its own. Most developers meet it as one half of an IT liability policy, which holds professional indemnity for your code, advice and project work, and public and products liability for injury or property damage.

The work you do decides the policy, not your job title

"Software developer" covers a lot of ground. A contractor writing code on a client's site, a two-person studio building websites and a business selling its own platform by subscription all use the title. They are three different risks.

That is why the description of your business matters so much. Writing software, configuring hardware and holding admin access to client networks are each priced differently, and a loose description costs more.

The standard IT liability wording we place works from a list. It covers the IT services it names, among them software design, development and specification, computer programming, systems integration and testing, data processing and data hosting, internet services, and network consulting and support. Other services are covered only if they are agreed and confirmed by endorsement. If you start building AI products, or any work that list does not name, tell us before you start so it can be added.

Technology packages work from a wider definition. One technology package wording defines the services it covers as including, but not limited to, software development, artificial intelligence development and data and application hosting, as more fully described in the schedule.

What we check: each thing you actually do, against the services the wording covers and the description of your business on the schedule.

IT liability or a technology package: how do they compare?

They are two classes of cover, not a cheap version and a good version. The label on the front tells you little. The wording and your schedule decide what you hold.

Is IT liability insurance enough for a sole developer?

Often, yes. A sole developer with no client data to speak of, no systems anyone else depends on, and a contract asking for professional indemnity and public liability is exactly who IT liability insurance was written for. Moving that business into a package it does not need is not better broking.

We arrange IT liability cover at $1 million, $2 million, $5 million and $10 million. The contracts you sign and the work you do decide which one is right.

When has a software business outgrown IT liability insurance?

When the shape of the business changes, not when turnover passes a number. These are the signs:

• You host or hold client data, or a lot of personal information about other people's customers.
• Your revenue stops when your own systems stop, because your product is delivered through them.
• Client contracts now ask for cyber cover as well as professional indemnity and public liability.
• Contracts carry service credits, delay penalties or warranty obligations.
• You hold administrative access to clients' systems, and have moved from building them to running them.

Each of those changes the class of cover you need, not just its price. A technology package builds cover for your own losses as insuring clauses of its own: responding to a breach, notifying the people affected, the income you lose while your systems are down, restoring your data, and extortion demands. An extension to an IT liability policy cannot create those, because an extension can only widen a cover the policy already gives. What a package answers for is on our technology insurance page.

Contract penalties need their own read. The standard IT liability wording we place does not count liquidated damages as a loss it pays, and technology packages take different positions, from granting them to removing them. An endorsement at placement can remove cover a wording grants, so we read your policy against the contract before you sign.

Do software developers need cyber insurance as well?

The standard IT liability wording we place has no cyber insuring clause, so it is not built for ransomware, restoring your own data or notifying people after a breach. Your schedule and any endorsements on it decide what you actually hold, so check them rather than assume either way.

A standalone small business cyber policy is not always the fix. Those wordings are written for a business that uses IT, not one that sells it, and one widely used wording excludes claims brought because IT services you provide to others for a fee have failed. For a technology business, the package is usually the cyber policy. For a business that uses technology rather than selling it, cyber insurance is the standalone version.

Is web developer insurance any different?

Mostly, no. A web developer's question is the same one: what you do, whose data you hold and what your contracts ask for. Internet services and data hosting are both named on the standard IT liability list.

Two things can move a web developer up sooner. Hosting the sites you build puts your clients' data, and often their customers' personal information, on systems you run. And if you host and maintain those sites, your clients' websites stop when your systems stop. Both are signs on the list above.

What if your clients are in the United States or Canada?

Raise it before the policy is bound, because where a client can sue you is a wording question. Of the seven technology and IT liability wordings we compared, one answers professional indemnity claims only in Australian or New Zealand courts unless the schedule adds more. Two others exclude claims in the United States or Canada: one lets you buy that cover back, and on the other we found no way to.

A client who sues at home can land outside your cover. That is why where your clients are is one of the first things we ask.

Does the cover that comes with ACS membership work for a software developer?

For some developers, at the start. ACS includes IT liability cover with membership and describes it as designed for people starting out as independent consultants, or doing limited consulting alongside their main job. As published when we checked in October 2026, it needs an ABN, paid membership, no legal demand, claim or disciplinary proceeding in the past five years, and prior-year taxable gross consulting fees of $125,000 or less, or $400,000 or less for Certified Professional members.

ACS also lists work that is not automatically covered and has to be dealt with separately. The items that matter most to developers are SaaS hosting more than 10,000 records, managed services, cyber security services, multimedia work including social media, responsibility for large amounts of personal information, and payment processing. Its FAQ adds an exclusion for legal proceedings brought in the United States or Canada.

So a developer whose platform passes 10,000 records, or whose fees pass the cap, has moved past what the member cover was designed for. That is a good time to talk to us.

Writing code for clients and not sure which side of the line you are on?

Tell us what you build, whose data you hold, what your contracts ask for and where your clients are. We will tell you whether IT liability still fits or a technology package is the next step. If IT liability is still right, we will say so.

Talk to a broker on 07 3292 1111

Or ask for a call back

Frequently asked questions