Technology E&O insurance for software, SaaS and IT firms

Technology errors and omissions (tech E&O) insurance pays defense costs and covered damages when a customer or other third party says your software, platform or IT service failed to perform and caused them financial loss. It is a claims-made liability policy built for technology vendors, and it is not the same thing as cyber insurance, although many carriers sell the two together. The traps are usually in the contract and intellectual property wording, not the headline coverage.

What tech E&O covers

IRMI defines tech E&O as coverage for providers of technology services or products, with major liability insuring agreements for losses resulting from technology services, technology products, media content and network security breaches. Services include data storage and web design; products include software and hardware.

In practice the core insuring agreement is a failure-to-perform grant. A wrongful act might be:

• A software bug that corrupts a customer's billing run
• A managed service provider that misconfigures a firewall and a client's systems go offline
• A SaaS platform outage that stops a customer taking orders
• A consultant's migration plan that loses data
• A custom build delivered late and missing agreed functionality

The harm is financial: lost revenue, wasted spend, remediation costs, customers' own claims. That is why the general liability insurance: what it covers and what it does not policy generally does not respond. The CGL covers bodily injury, property damage and a few offenses, and its impaired-property exclusion, plus a professional services exclusion where one is endorsed on, takes most software failures outside it. See E&O vs general liability: what each one covers.

Tech E&O vs cyber insurance

The overlap confuses buyers because policies are often packaged. A rule of thumb: tech E&O covers what you owe your customers when your product or service fails; cyber covers your own response costs and your liability for a breach of data you hold. IRMI notes tech E&O is often confused with cyber and privacy insurance, and that cyber policies are aimed at consumers of technology though they may include some of the same insuring agreements.

The July 2024 CrowdStrike outage illustrated the split. CyberCube estimated global insured losses of $400 million to $1.5 billion, and Moody's said claims would be driven by business interruption under cyber "systems failure" coverage, with a smaller number of claims emerging from technology errors and omissions policies. Those were early estimates, but the structure explains why a vendor and its customers can end up on different policies. See Cyber insurance vs tech E&O: which policy pays when, first-party and third-party cyber coverage and System failure, cloud outages and the CrowdStrike lesson.

Contract language is where claims turn

Technology vendors work under signed agreements: master services agreements, licenses, SLAs, statements of work. A customer suing over a failed implementation often pleads both negligence and breach of contract. Travelers makes the point on its technology E&O risks page that a policy covering only one theory can leave the company exposed when a lawsuit rests on both.

What to read:

1. The contractual liability exclusion. Most forms exclude liability assumed under contract, with a carve-back for liability you would have had without the contract. Look for a carve-back for your obligation to perform the services, since otherwise a claim that you failed to deliver as promised may be argued to be contractual.
2. Warranties and guarantees. Promises beyond the standard of care, such as performance guarantees, uptime promises and fitness warranties, are commonly excluded.
3. Liquidated damages and SLA credits. Service credits and contractual penalties are often excluded. Some carriers advertise coverage for them; confirm the wording.
4. Return of fees. Refunding what the customer paid is rarely covered as damages.
5. Delay. Travelers notes that many technology E&O forms contain a delay exclusion. If a late go-live is your most likely claim, ask for the exclusion to be removed or narrowed.
6. Limitation-of-liability and consequential-damages clauses in your own contracts. These limit what the customer can collect and, with it, what the insurer pays. They also signal good underwriting. See contractual risk transfer: shifting liability by contract and insurance.

Your customers write their own insurance demands into the paper. Large buyers commonly specify minimum tech E&O or cyber limits, and many ask for additional-insured status and notice of cancellation. Run their requirements through the contract insurance requirements checker before you sign, because a requirement that the policy be "occurrence" or have no sublimits may be impossible to meet.

Intellectual property and software copyright

Copyright infringement is one of the more common allegations against software and content vendors, and it is the one carriers often exclude. Travelers flags that software copyright infringement is commonly excluded from technology E&O forms and advises buyers to check that the exposure is not. Patent infringement and trade secret misappropriation are frequently excluded or available only by endorsement, and open-source and licensed third-party code make the question harder. Ask whether coverage reaches code written by contractors and offshore teams. For firms whose main risk is content or advertising claims, see media liability insurance: defamation, copyright and content claims and Intellectual property insurance: defense, enforcement and what a CGL misses.

Other exclusions and gaps

• Bodily injury and property damage. Excluded on most forms, and they belong on the CGL. If your software controls a device, a vehicle or industrial equipment, discuss this gap with your broker.
• Known defects and prior knowledge. If you knew of a bug before the policy began, the claim it causes is usually excluded.
• Product recall. Often excluded, though some forms restore the customer's loss-of-use damages.
• Regulatory fines and penalties and punitive damages where uninsurable.
• AI-related errors. Policies are changing; ask whether generative-AI outputs count as your professional service. See AI liability insurance: how insurers are treating artificial intelligence risk.

How the policy is structured

Tech E&O is written on a claims-made policy basis with a retroactive date. Software ships continuously, so the date matters: a claim about code written in 2023 and first made in 2026 is covered only if the retro date reaches back that far. A policy that covers "products released or changed after renewal," as Travelers asks buyers to confirm, matters for companies that deploy weekly. Defense usually erodes the limit and a retention applies. Keep a extended reporting period option in mind for a sale or wind-down, because acquirers will want one.

What underwriters ask

Applications focus on the revenue split between software products, SaaS, hardware and services, customer industries (healthcare and financial services draw more scrutiny), customer concentration, standard contract terms (limitation of liability, consequential damages waiver, indemnities, warranties and SLAs), quality assurance and change management, incident response and backup practices, use of subcontractors, and claims or circumstances in the past five years. A company that cannot show signed limitation-of-liability clauses on its contracts should expect pointed questions. Readiness with security controls helps both policies; use the cyber insurance readiness checklist.

A hypothetical claim

Say a 25-person SaaS company serving payroll departments ships an update that miscalculates withholding for 40 clients over two pay cycles. Clients owe penalties and spend staff time on corrections, and one files suit. Its master agreement limits liability to 12 months of fees and waives consequential damages. Under a typical form:

• The insurer defends once the claim is reported and pays covered damages above the retention, inside the limit.
• The contractual cap may reduce what the client can recover, and with it what the insurer pays.
• Refunded subscription fees and service credits are typically not covered.
• The vendor's own cost of fixing the bug is a business expense, not a claim.

The facts and numbers are invented to show how the layers interact; an actual outcome depends on the contract, the form and the state's law.

Buying checklist

1. Confirm the policy covers both breach of contract and negligence claims.
2. Review the contractual liability, delay, warranty and fee exclusions.
3. Confirm software copyright, trade secret and patent treatment in writing.
4. Check that new products, acquired businesses and subsidiaries are covered automatically.
5. Align limits with your largest customer contracts and your cyber policy, and avoid a gap or fight between them.
6. Check the retroactive date, retention and extended reporting terms.
7. Ask your broker to approach several carriers with technology programs, such as Travelers, The Hartford, Chubb and Beazley, and compare the wording, not the brand.

Key takeaways

• Tech E&O covers a customer's financial loss when your product or service fails; cyber covers breach and outage losses on your side. Many companies need both.
• Contract wording drives most disputes: contractual liability, warranty, SLA credit, delay and fee-return provisions can each remove the coverage you assumed.
• Software copyright and patent infringement are often excluded or sublimited.
• The retroactive date and the claims-made structure matter more for continuously updated software than for one-off projects.
• Match your policy limits to the minimums in your biggest customer contracts before you sign.