Technology Insurance

Yes, and this is the single most common gap we see in a tech company’s program. A general-liability policy is built for bodily injury and physical property damage, and it excludes the professional services you sell. When a client sues because your software failed, your project missed spec, or your advice cost them money, that claim falls to technology errors and omissions. The two policies cover different claims and a technology business needs both.

Technology errors and omissions covers the work you deliver, so a failure, a defect, or a missed commitment that costs your client money. Cyber covers the data and systems you hold, so a breach, ransomware, the notification and legal costs that follow, and the income you lose while you are down. A single incident often triggers both, so the two are usually written together on one policy and there is no argument about which one responds.

Yes. Send us the contract and we will read it instead of guessing. Enterprise and public-sector agreements commonly call for a set amount of commercial general liability, a matching or higher technology errors and omissions limit, cyber coverage, and wording that names the client and requires notice before the policy changes. We build the program to the agreement and issue the certificate quickly, because for most software companies no certificate means no signed deal.

Alberta’s Personal Information Protection Act requires you to report a breach to the Office of the Information and Privacy Commissioner without unreasonable delay. The test is whether a reasonable person would consider there is a real risk of significant harm to an individual, and the Commissioner can direct you to notify the affected individuals. If you handle personal information of people outside Alberta, the federal PIPEDA rules can apply as well, and Quebec’s Law 25 reaches you if any of your users live in Quebec. Cyber coverage pays for the forensics, the legal advice, and the cost of making those notifications.

That is dependent, or contingent, business interruption coverage, and it is separate from cover for an outage in your own systems. The Amazon Web Services disruption in October 2025 and the CrowdStrike update in July 2024 both showed how much of a business can stop because of someone else’s failure. Whether it helps you in practice comes down to two details. The first is whether the policy covers a plain systems failure and not only a malicious attack. The second is the waiting period, often around eight hours, before the loss starts counting.

Usually yes, through the funds transfer fraud and social engineering part of a cyber policy. Two things to know. It is normally a capped sublimit well below your main limit, and it carries conditions, typically verifying any change to banking details by a phone call to a known number. Some insurers will raise that sublimit when your team completes security awareness training, which is worth doing anyway since these claims are the most common ones there are.

Usually as soon as you sign your first real customer. The trigger is rarely your own size, it is the contract in front of you, and most mid-market and enterprise buyers will not sign without errors-and-omissions and cyber coverage in place. A home policy will not respond to a business claim or to company hardware. Early-stage limits are priced for early-stage revenue, so this is far cheaper before you scale than after.

It depends entirely on the wording, and the market is moving fast. Insurers have been adding AI exclusions and sublimits to errors-and-omissions and cyber policies at renewal. In January 2026 ISO, which writes the standard policy forms most of the North American market builds on, introduced an optional generative-AI exclusion for general-liability policies. At the same time a handful of insurers now write affirmative AI coverage that names AI failures as a covered event. If AI is anywhere in your product, tell us, and we will place the policy with a market that covers it instead of one that excludes it in the small print.

Technology errors and omissions and cyber are written on a claims-made basis, which means the policy in force when the claim is made responds, not the one in force when you did the work. The retroactive date sets how far back your past work is covered, and full prior acts coverage means there is no cut-off at all. If you switch insurers and the new policy resets that date, every project you delivered before it becomes uninsured, so check this before you move for a cheaper premium.

It depends on your revenue, what your product does for your customers, the data you hold, and the limits your contracts require. We build the program around how the business runs, and most technology companies go from first conversation to bound coverage within a few business days, with certificates issued as soon as a client asks for one.