Skip to content

Business and technology

Technology Company Insurance

for UK AI, software, SaaS, IT, cloud, data and fintech businesses

One policy built around the claim a software business actually receives, which arrives as a breach of contract rather than as an allegation of negligence.

  • AI, software, SaaS, IT, cloud, data and fintech
  • Professional indemnity and cyber together
  • Written for companies with customers and contracts
  • FCA authorised and regulated

Quick answerTechnology company insurance packages professional indemnity, cyber, property and business interruption around what a software business actually sells. The section that decides everything is the professional indemnity one, because a technology wording names breach of contract as an insured peril and a general wording answers negligence.

At a glance

Technology Company Insurance at a Glance

Short answers to what UK technology companies ask before they compare anything.

Technology company insurance quick answers
QuestionQuick answer
What is actually in it?Technology professional indemnity and cyber at the centre, with property, liability and business interruption around them.
Is any of it compulsory?Only employers liability, at £5m, once you employ anyone who is not the majority shareholder or a close relative.
So why does everyone hold it?Because customers put it in the contract. The insurance clause in an enterprise agreement is what sets your limits.
What should I check first?Whether the professional indemnity section names breach of contract and service levels, or only negligence.
Is general professional indemnity enough?Rarely. It is built around negligence, and software claims are framed as breach of contract.
What if my cloud provider goes down?It falls between three policies and only lands in dependent business interruption, where the sub-limit and the carve-outs decide what you actually get.
Does it cover a data protection fine?Conditionally at best. Compensation to the people whose data was exposed is the part that is straightforwardly insured.
What moves the price?Turnover, what you build, who buys it, the limits your contracts demand and how you handle customer data.

The basics

What Is Technology Company Insurance?

Technology company insurance is a package built around the way software businesses get sued: not for carelessness, but for failing to deliver what a contract promised. It puts a technology professional indemnity section at the centre and arranges cyber, property, liability and business interruption around it.

Nothing is sold under that exact name. What a broker places is a commercial combined policy assembled for the sector, and the mix shifts hard depending on what you sell. A consultancy billing days, a SaaS platform holding customer data and a managed service provider with root access to other people networks are three different risks wearing the same job title. The general version of the central section is professional indemnity insurance.

What a technology policy has to do

  • A professional indemnity section written for how software is actually sold
  • Cyber alongside it, drafted to meet it rather than to overlap it
  • Limits taken from your customer contracts rather than picked off a list
  • Property and liability for the office, the hardware and the people

Assembled per business

A technology schedule, typically

  • Technology professional indemnityWhat you owe your customerCore
  • CyberWhat an attack costs youCore
  • PropertyOffice, fit-out, kit in a rackMost
  • Public and products liabilityVisitors, and hardware you shipMost
  • Employers liabilityCompulsory past your first hireOnce staffed
The point of buying it combined is that the sections are drafted to meet each other

How it works

How Does Technology Company Insurance Work?

You describe what the business sells and to whom, set limits from your customer contracts rather than from a price list, and the cover runs for twelve months. Professional indemnity is claims-made, so it is the policy live when the claim arrives that answers rather than the one live when you did the work.

  1. Describe what you actually sell

    Licensed software, a hosted platform, consultancy days, managed infrastructure or hardware. Two companies with the same turnover and different delivery models get priced nothing like each other.

  2. Take the limits out of your contracts

    Your biggest customer agreement already specifies a limit and how long you must maintain it after the contract ends. Read that before choosing a number, because buying under it is a deal you cannot sign.

  3. Tell them when the model changes

    Shipping your first hardware, taking your first public sector framework, moving from advising on systems to running them, or putting a model into production all change what you are. Each is a call worth making.

The two sections are triggered differently and it matters. Professional indemnity answers claims made during the policy year, whatever year the work was done, so letting it lapse after a project ends leaves a later claim with nothing to attach to. Cyber is a hybrid: its liability half works the same way, but incident response, rebuilding data and business interruption are triggered by an incident you discover while the policy is live. Keeping cover running protects the first half, not the second. More at our professional indemnity page.

What it covers

What Does Technology Company Insurance Cover?

Technology professional indemnity answers what you owe your customer. Cyber answers what an attack costs you. Property, liability and business interruption cover the physical business around them, and employers liability is compulsory once you hire.

Technology professional indemnity

The centre of the policy. Breach of contract, service levels and liquidated damages, plus claims that your code opened a hole in your customer systems or interrupted their business. Compare it against general professional indemnity insurance.

Cyber

Your own losses rather than your customer: incident response, extortion, rebuilding data, regulatory costs and lost income after an attack on you. The standalone product is cyber insurance.

Property and equipment

Offices, fit-out, laptops and anything you own sitting in a rack. It still matters to a fully remote company, because the hardware exists somewhere: commercial property insurance.

Public and products liability

A visitor hurt at your office, or damage you cause on a customer site. If you ship hardware the products half matters far more than most software firms expect: public liability insurance.

Business interruption

Income lost after insured damage to your own property. The trigger is narrower than most founders assume.

Worth asking about

Intellectual property infringement

Covered by technology wordings, and usually without the unintentional qualifier a general policy applies. Patents and trade secrets are the exception.

Dependent business interruption

An outage at a provider you rely on. It lives only in the cyber section, it is now common rather than rare, and the sub-limit, waiting period and systemic carve-out vary enormously.

Regulated firms

Some categories of FCA-authorised firm have indemnity requirements set by their regulator rather than by negotiation. It is not a blanket rule of authorisation.

The seams

What Isn’t Covered by Technology Company Insurance?

It will not pay to re-engineer your own product, it will not reach patents or trade secrets, and a third-party outage lands only in the cyber section. The sub-limits inside that section matter more than the headline limit.

Putting the product right

Neither section pays to re-engineer the software. The cost of the fix, and the revenue lost while your team does it instead of shipping, stay with you.

Patents and trade secrets

Every technology wording we read excluded them, which matters because contracts routinely make the intellectual property indemnity unlimited.

Somebody else infrastructure failing

Excluded by the professional indemnity section and outside the property trigger, so the cyber section is the only place it can land. Check the sub-limit and the waiting period, not just that the cover exists.

Fines, depending which section you read

One technology wording excludes regulatory fines outright while the cyber section of the same package pays them if the law allows. Assume the package is consistent and you will be wrong about one of them.

Sub-limits inside the cyber section

Extortion, network interruption and regulatory costs commonly sit well below the headline figure, which is not the number that answers.

Open source licence breach

The intellectual property cover may answer a claim, but what a copyleft licence holder usually wants is that you rip the code out. Remediation is not what these policies pay for.

Three questions separate two quotes far more than the price does. Does the professional indemnity section name breach of contract, service level agreements and liquidated damages as insured perils? Is there dependent business interruption cover, and does it survive a regional or global event? And what are the sub-limits on extortion, network interruption and regulatory costs? Our cyber insurance page covers the standalone version of that section.

Business types

What Kind of Technology Business Can Be Covered?

AI companies, software businesses, SaaS platforms, app and software developers, IT consultancies, cloud and managed service providers, data and analytics firms, fintech and cybersecurity companies.

AI companies

Building, fine-tuning or deploying models. UK insurers are writing affirmative AI wording rather than exclusions, which is the opposite of what most people expect.

Software companies

Licensed or bespoke software, where the claim almost always names a clause rather than an act of carelessness.

SaaS platforms

Subscription delivery, where uptime is contractual and the biggest interruption risk belongs to somebody else.

App and software developers

Building to someone else specification, carrying whatever the statement of work says you carry.

IT consultancies

Advising, specifying and implementing. The closest of the group to a general professional wording, and still not well served by one.

See professional indemnity

Cloud and managed service providers

Running other people infrastructure with the access that implies, which concentrates the exposure sharply.

Data and analytics businesses

Holding customer data at volume, where a breach reaches the people in the dataset as well as the regulator.

Fintech and cybersecurity

Regulated or security-critical, where the requirements come from a regulator or a customer with a very long checklist.

See cyber insurance

The delivery model matters more than the label. A company that advises on systems and one that runs them are rated differently even where the letterhead is identical, because one of them holds the keys.

Who it’s for

Who Needs Technology Company Insurance?

UK technology companies with customers, contracts and usually employees: software and SaaS businesses, IT consultancies, cloud and managed service providers, data, fintech, cybersecurity and AI companies. It is written for companies rather than one-person freelancers.

Anyone selling under a customer contract

The moment you sign a master services agreement, the insurance clause in it decides what you have to hold.

Businesses holding customer data

Personal data turns an outage into a regulatory event and a claim from the people in the dataset.

Companies with employees

Employers liability becomes compulsory at the first hire who is not a majority shareholder or close family.

Platforms with uptime commitments

Where service levels are contractual, the claim arrives as breach of contract and needs a wording that names it.

Firms selling to regulated or public sector buyers

Those contracts carry the longest insurance clauses and the most carve-outs from the cap.

Teams putting models into production

Where output your customer relies on is generated rather than written, and the contract still holds you to it.

One exemption catches a lot of technology businesses and one trap catches more. A company whose only employee also owns half or more of the shares does not need employers liability, which describes plenty of one-founder companies right up until the first outside hire. The trap is the family-business exemption, which sounds like it helps and does not apply once the business is a limited company. Almost every technology business is. The rules are at employers liability insurance.

The difference that decides whether you are covered

Why a Software Claim Arrives as Breach of Contract

A technology professional indemnity wording names breach of contract, service level agreements and liquidated damages as insured perils. Software claims are overwhelmingly framed as a missed clause rather than as carelessness, so a policy whose trigger is negligence can be the one that does not respond.

How a technology wording and a general wording differ
Technology wordingGeneral wording
What it is built aroundBreach of contract, by nameNegligence, or sometimes a broader civil liability trigger
Service level agreementsNamed as an insured perilNot addressed
Liquidated damagesInsured, subject to how the figure was setNot addressed
Your code opening a holeA separate insuring clause for itUnlikely to reach it
Data protection claimsCovered where you were processingOne major wording excludes them outright
IP infringementCovered, usually without the unintentional testCovered, usually only if unintentional

One trap is set years before any claim. A technology wording we read only treats a sum as insured liquidated damages if, at the time it was agreed, it was a fair and reasonable estimate of the customer loss. A figure put in as commercial leverage rather than as a genuine forecast falls outside that. The facts are fixed when the contract is signed, but nobody tests them until a claim arrives, and a clause can be perfectly enforceable and still sit outside the policy definition. For how the general product is priced, see professional indemnity costs.

Pricing

How Much Does Technology Company Insurance Cost?

Nobody can price a technology company from the sector name. The rating follows turnover and revenue model, what you build and who buys it, how much customer data and system access you hold, the limits your contracts demand and your claims and incident history.

What the business is

  • TurnoverAnd how much of it is recurring.
  • What you sellLicence, subscription, days or hardware.
  • HeadcountEmployed, contract and offshore.
  • TerritoriesWhere your customers are, not where you are.

What you hold and touch

  • Customer dataVolume, and how personal it is.
  • System accessWhether you hold keys to customer estates.
  • Uptime commitmentsService levels you have signed up to.
  • Security postureControls, testing and certification.

The cover itself

  • Indemnity limitsAs specified, contract by contract.
  • Retroactive positionHow far back the cover reaches.
  • Cyber sub-limitsThe numbers under the headline figure.
  • Claims and incidentsFive years, including near misses.

No figure appears on this page. Nothing independent is published for UK technology premiums, so the numbers circulating are individual brokers summarising the customers they happen to write, and those skew heavily towards very small accounts. A company with enterprise contracts and a data estate bears no relation to that sample. Where this sits inside a packaged commercial combined policy, the schedule is where the real limits are written.

Before you start

What Do I Need for a Tech Insurance Quote?

Turnover and revenue model, headcount, where your customers are, what data and system access you hold, your security controls, the insurance clause from your biggest contract, and five years of claims and incidents.

About the business

  • Three years of turnover and the revenue model
  • Headcount, including contractors and offshore teams
  • Where your customers are based
  • Five years of claims, incidents and near misses

About what you handle

  • Whether you hold personal data, and roughly how much
  • Whether you have privileged access to customer systems
  • Uptime or service level commitments you have signed
  • Your security controls, testing and any certification

Limits and contracts

  • The insurance clause from your largest customer contract
  • How long you must maintain cover after it ends
  • Any liability carve-outs above the cap
  • Your current retroactive date, if you already hold cover

Compare with MyMoneyComparison.com

How to Compare Tech Insurance Quotes

Read the insuring clause before the limit, find the sub-limits inside the cyber section, and check the retroactive date. Two quotes at the same price can be worth very different amounts once those three are answered.

  1. Read the insuring clause, not the headline limit

    A professional indemnity section that names breach of contract is worth more than one with a bigger number and a negligence trigger.

  2. Find the sub-limits under the cyber section

    Extortion, network interruption and regulatory costs are where the real figures live, and they are often a fraction of the headline.

  3. Check how far back the cover reaches

    A policy starting today does nothing for work you delivered last year, and your contracts almost certainly require you to keep cover running for years after delivery.

Describe the business once and specialist UK brokers can come back to you. MyMoneyComparison.com is an introducer rather than a broker, so we do not sell the policy or recommend one. Our editorial policy sets out how we work.

Cutting costs

How Can I Reduce the Cost of Tech Insurance?

Evidence your security controls, describe the business precisely, push back on uncapped indemnities at contract stage and buy the limit your contracts actually require. Reviewing the excess helps too.

Evidence your security controls

Multi-factor authentication, backups you have actually restored from, and a tested incident plan. Cyber underwriters price this directly.

Negotiate the contracts you can

An uncapped indemnity you agreed to is an exposure no policy removes. Pushing back at contract stage is cheaper than insuring the consequence.

Describe the business precisely

A vague description gets rated for the worst thing it could mean. Splitting consultancy from managed services usually prices better.

Buy the limit the contracts need

Not the biggest one available, and not one below what your largest customer specified, because that is a deal you cannot close.

Keep the incident record straight

Underwriters would rather see a near miss you handled than discover it later. Undisclosed history is what hardens a renewal.

Review the excess

Absorbing the small first-party costs yourself, rather than claiming them, can take a visible amount off the premium.

If the company also has an office with staff and visitors, that side sits with office insurance.

Jargon buster

Tech Insurance Jargon, Explained

The words that appear on a technology schedule, in plain English. There is a longer general list in our insurance jargon buster.

Technology professional indemnity
A wording that insures breach of contract and service levels, not only negligence.
Claims-made
Cover answering claims made during the policy year, whatever year the work was done. Cyber first-party cover works differently.
Retroactive date
The point before which past work is not covered, however long you have held a policy.
Run-off
Cover kept running after a contract or the business ends, so late claims still land somewhere.
Liquidated damages
A sum fixed in the contract for a failure, insurable only if it was a genuine estimate of loss.
Dependent business interruption
Cover for an outage at a provider you rely on rather than at your own systems.
Sub-limit
A smaller cap sitting inside the headline limit, applying to one named cover.
Uncapped indemnity
A contractual promise carved out of the liability cap, so it has no ceiling.

Why MyMoneyComparison.com

Comparing Specialist Technology Cover

MyMoneyComparison.com is an FCA-authorised UK comparison service that introduces companies to specialist brokers. We do not sell insurance and we do not give advice: the broker you choose arranges the policy. Comparing is free and there is no obligation.

1

Form for the whole company

Describe the business, what it sells and the limits its contracts demand once, instead of repeating yourself to every broker in turn.

0

Advice given

We are an introducer, not a broker. We do not sell policies and we do not recommend one. Read our editorial policy.

FCA

Authorised and regulated

MyMoneyComparison.com Ltd appears on the FCA register under FRN 916241.

2013

Comparing since

A UK company since 2013, working with specialist brokers across the country.

Read our customer reviewsSee what people say about us on Trustpilot

FAQs

Technology Company Insurance FAQs

The questions UK technology companies ask most.

What is technology company insurance?

It is a commercial combined policy assembled for a technology business, putting technology professional indemnity and cyber at the centre and adding property, public and products liability, business interruption and employers liability around them. The reason to buy it as a package rather than in pieces is that the sections are drafted to meet each other, so the gaps between them are deliberate rather than accidental.

What does technology company insurance cover?

Technology professional indemnity covers what you owe your customer, including breach of contract and service level failures. Cyber covers what an attack costs you: response, extortion, rebuilding data, regulatory costs and lost income. Property, public and products liability and business interruption cover the physical business, and employers liability is compulsory once you hire.

Is general professional indemnity enough for a software company?

Often not, and this is the commonest way a technology business ends up holding cover that looks right. General wordings split two ways: some are built around a failure to exercise reasonable skill and care, others on a broader civil liability trigger. A technology wording names breach of contract, service levels and liquidated damages outright. The claim you actually receive says you missed clause 8.2, so the trigger is the thing to read.

Are liquidated damages insurable?

Sometimes, and the facts that decide it are fixed long before any claim. One technology wording only treats a sum as insured liquidated damages if, at the time it was agreed, it represented a fair and reasonable estimate of the customer loss. A figure put in as commercial leverage rather than as a genuine forecast falls outside that definition. Nobody tests it until a claim arrives, and a clause can be enforceable against you and still sit outside the policy.

What is an uncapped indemnity and why does it matter?

Technology contracts cap overall liability and then lift the cap for specific indemnities, most often intellectual property and data protection. Public sector framework contracts do this openly and the terms are published. The problem is that technology professional indemnity covers intellectual property infringement but excludes patents and trade secrets, so the promise you made without limit points straight at the exclusion.

Does the policy cover patents?

No. Both technology wordings we read excluded patents and trade secrets, one naming any actual or alleged infringement of a patent and the other excluding claims arising out of any patent or trade secret. No section of a technology package fills that in, which is why the carve-outs in your customer contracts are worth reading as carefully as the cap.

Does my liability cap affect my insurance?

It can work the other way round. Where you sell on your own standard terms, a court testing whether your cap is reasonable is required to consider how far it was open to you to cover yourself by insurance, and the burden of showing the term is reasonable falls on you. Courts do generally enforce clearly drafted commercial clauses, but your insurance position is one of the things they look at.

What happens if my cloud provider goes down?

It falls between three policies. Property and business interruption need physical damage and an outage is not damage. Technology professional indemnity commonly excludes failure of service by an internet, cloud or telecoms provider. That leaves the dependent business interruption cover in your cyber section, which varies more than any other term in this market.

Is dependent business interruption standard in cyber policies?

It is now common rather than rare, but the spread is wide and that is where the money is. One wording built the cloud provider into the business interruption trigger outright. Another responded only where the insured own equipment was attacked, behind a waiting period and a sub-limit far below the headline. Indemnity periods run from a few months to a full year. Ask about the sub-limit and the waiting period, not just whether the cover exists.

What about a global outage rather than one provider?

Check for a systemic event carve-out. Several policies that do cover a single provider failing then exclude a failure of core internet, telecoms or GPS infrastructure causing a regional, countrywide or global outage, which is the scenario most people have in mind when they ask about cloud cover in the first place.

How large can a UK data protection fine be?

The maximums are set in law and restated in the regulator guidance. The standard maximum is £8.7m or two per cent of total worldwide annual turnover, whichever is higher. The higher maximum is £17.5m or four per cent, whichever is higher. Both limbs are always in play, but only one of them will ever be the number that applies to you.

Is it really four per cent of global turnover?

Almost certainly not, for you. The percentages only outrank the cash figures above roughly £435m of turnover, so for nearly every business reading this the maximum is the cash figure. A page that leads with four per cent of global turnover is leading with the number that does not apply to its reader. One caveat: the percentage is measured across the whole group, so a small UK company owned by a large one does not get that comfort.

Can a data protection fine be insured?

It is unsettled. Nothing in UK law prevents it and no English court has decided the point, so wordings promise conditionally: one cyber wording excludes fines unless insurable by law, another pays provided it is legally permissible to do so. The uncertainty stays with you. Note also that some technology professional indemnity wordings exclude fines outright with no such carve-back.

What about claims from the people whose data was exposed?

Those are ordinary civil liability and are insured under the third-party side of a cyber policy, though general professional indemnity wordings commonly exclude breach of data protection law outright. Keep them separate in your head from the fine, because the insurance position on each is completely different, and in a large breach the compensation can be the larger of the two.

Does cyber insurance pay a ransom?

Extortion cover is close to universal, and most wordings require the insurer written consent before any payment is made, though not all do. There is a reason for the requirement: it is a criminal offence for an insurer to reimburse a payment it has reasonable cause to suspect went to terrorism, and sanctions law sits alongside. Check the sub-limit as well as the cover, because extortion is commonly one of the smallest figures on the schedule.

Has the UK banned ransom payments?

No. The government consulted on reform including a ban on payments by public sector bodies and a payment notification regime, and its response said it would continue developing the proposals with industry. None of it is law. If you have read that ransom payments are banned, or that reporting a payment is mandatory, that is a proposal being described as though it had already happened.

Is cyber incident reporting mandatory?

Not yet for most businesses, but this one is worth watching if you run infrastructure for other people. Separate legislation going through Parliament as at September 2026 would bring managed service providers, cloud providers and data centre operators into a mandatory incident reporting regime with tight deadlines and substantial penalties. It is not law yet. If that describes your business, ask your broker where it has got to rather than relying on this page.

Does paying a ransom reduce a regulatory fine?

No. The UK data protection regulator and the National Cyber Security Centre said jointly in 2022 that paying attackers does not reduce the risk to individuals and will not be counted as mitigation when a penalty is set, and nothing since has changed that. Worth knowing before an incident rather than during one, because the argument that paying limits the regulatory downside gets made in the room and it is wrong.

Is there a UK AI Act?

No. For most UK technology companies the rules that actually bite today are data protection law, sector regulators and customer contract terms. On top of that the EU regime reaches providers and deployers located outside the Union where the output of the AI system is used inside it, so a UK firm whose model output is relied on by EU customers is in scope wherever it is registered. Its compliance dates for high-risk systems have already been deferred once.

Are insurers excluding AI?

Broadly the opposite, in this market. One mainstream UK technology professional indemnity wording now defines artificial intelligence, generative AI and AI agents, and insures liability arising from using them, relying on their output and designing them. Another has extended affirmative AI wording across several products. That is the UK position: insurers elsewhere have moved the other way, so do not assume it travels if your programme includes non-UK paper.

Is any of it a legal requirement?

Only employers liability, at £5m, once you employ anyone. A company whose sole employee owns half or more of the shares is exempt. The family-business exemption does not apply to limited companies, so it will not help most technology firms. Professional indemnity and cyber are contractual requirements for this sector rather than legal ones, though some categories of FCA-authorised firm do have indemnity requirements set by their regulator.

What is the penalty for not having employers liability insurance?

A fine of up to £2,500 for any day on which you are without suitable cover, and up to £1,000 for failing to display the certificate or produce it to an inspector. Note that it is per day, not per employee per day, which is a widely repeated error. Certificates may be displayed electronically.

How much does technology company insurance cost?

We quote no figure, because we could find nothing reliable to quote: nothing independent is published for UK technology premiums, and the averages in circulation are individual brokers describing their own small-account books. Your number turns on turnover and revenue model, what you build, the data and access you hold, the limits your contracts demand and your incident history.

Ready when you are

Compare Tech Quotes

Tell us what the business builds, who buys it and the limits your contracts demand, and specialist UK brokers can come back with quotes. Free to use, with no obligation to buy.

  • AI, software, SaaS, IT, cloud and data
  • Professional indemnity and cyber
  • FCA authorised and regulated

Free to use · No obligation · UK brokers

About this page

This page sets out what technology company insurance is, what it reaches, where its seams are and what drives the price, for UK software, SaaS, IT, cloud, data, fintech and AI businesses with customers and contracts rather than one-person freelancers. It is general information and not advice. Wordings differ sharply in this sector, so read your own schedule and take the questions raised here to your broker. For the general product see professional indemnity insurance, for the standalone version of the cyber section see cyber insurance, and for the office itself see office insurance.

How we researched this page

  • Two mainstream UK technology professional indemnity wordings, and one general professional indemnity wording to compare them against
  • Two cyber wordings, for the extortion, dependent business interruption and regulatory cost positions and their sub-limits
  • A published public sector call-off contract, for how liability caps and uncapped indemnities are actually drafted
  • The UK data protection regulator published fining guidance, and its 2022 joint statement with the National Cyber Security Centre on ransom payments
  • Health and Safety Executive guidance on compulsory employers liability insurance

No example premiums appear here, because we could find no UK body collecting and publishing pricing for this sector. Where wordings differ we say so rather than picking one and calling it the market. Four things in wide circulation are corrected on this page: that a general professional indemnity policy answers a software claim, that the data protection maximum for a normal business is a percentage of global turnover, that the UK has banned ransom payments, and that insurers are excluding artificial intelligence.