The short version
- What it covers: claims that your software, service, or implementation failed, was late, or did not do what you promised, and cost the client money.
- Why tech companies need more than general liability: a client's financial loss from a software failure is professional liability, which general liability excludes.
- Cyber is the other half. Breaches, ransomware, and privacy claims are cyber exposures. Many technology contracts require both, and they are often written together; Washington DES's contract templates allow cyber coverage "separately, or as part of a broad E&O policy."
- Contracts set the bar: the state contracts we reviewed set tech E&O at $2 million (Washington, when requested) to $3 million (Idaho Department of Education, for data access).
- AI features add a new question: confirm the policy covers AI-driven functionality and has no AI exclusion.
What tech E&O covers
| Usually covered | Usually not covered without cyber or other coverage |
|---|---|
| Software bugs, outages, or failures that cost a client money | Your own costs to respond to a breach (that is first-party cyber) |
| Failed or late implementations and integrations | Ransomware and extortion against your systems |
| Failure to meet contract specifications or service levels | Contractual penalties and refunds beyond the policy's terms |
| Errors in IT, managed services, or consulting work | Bodily injury and property damage (that is general liability) |
| Often: intellectual property and media claims, depending on the policy | Patent infringement, which is commonly excluded (Washington DES's own sample clause carves it out) |
What technology contracts require
Washington's statewide IT project management contract (14822), when the purchasing agency requests it, requires technology professional liability coverage "sufficiently broad to respond to the duties and obligations" of the contract, including:
- Intellectual property infringement, including copyright, trademark, and trade dress
- Invasion of privacy, information theft, and release of private information
- Damage to, destruction of, or alteration of electronic information
- Extortion and network security
The policy must also cover breach response costs, regulatory fines and penalties, and credit monitoring expenses. Limits must be at least $2,000,000 per occurrence and $4,000,000 aggregate, and claims-made coverage must stay in place for at least three years after the contract ends. If the purchaser requests it, the same contract also requires separate claims-made cyber coverage of $1,000,000 per occurrence and $2,000,000 aggregate. Every contractor must also carry a $1,000,000 umbrella that applies over all liability policies, including professional liability, plus general liability of $2,000,000 per occurrence and $4,000,000 aggregate.
The Idaho Department of Education's solicitation template includes a clause for contractors with access to its network or to data that includes personally identifiable or student information. It sets information security and cyber coverage at $3,000,000 each occurrence, $3,000,000 network security and privacy liability, a breach response sublimit of at least 50% of the policy aggregate, and $3,000,000 of technology products E&O, which it describes as the limits for an average-exposure contract.
Paste your client agreement or MSA into our contract insurance checker to see what it requires.
Tech E&O and cyber together
| Exposure | Tech E&O | Cyber |
|---|---|---|
| Your product fails and the client loses revenue | Yes | Usually no |
| Attackers breach your systems and steal client data | Sometimes, for the client's claim | Yes, for response costs and liability |
| Your platform goes down after a ransomware attack | Client claims, depending on the policy | Your own losses and extortion |
| A client sues over data you mishandled | Depends on the policy | Yes, privacy liability |
Buying both from one insurer, on one form, reduces the chance that a claim involving both a failure and a breach falls between two policies. See the cyber insurance guide.
AI features
If your product uses AI, a wrong output that costs a client money is a tech E&O question, not usually a cyber one. Some insurers have begun adding AI exclusions. Others now offer optional AI cover on tech E&O itself, with separate choices for algorithmic bias, intellectual property, training data, and regulatory defense, usually as a sublimit; the ones we see run from $500,000 to $2 million. Coverage that names AI is also appearing on cyber policies: Coalition, for example, added an endorsement to its cyber policies that covers AI-caused security failures and deepfake funds transfer fraud. Neither replaces tech E&O for a wrong output. See does cyber insurance cover AI and AI exclusions in business insurance.
What to have ready for a quote
- What you sell: your products and services, and how customers rely on them
- Annual gross revenue and your home state
- The limit you need: usually set by your largest client contract
- Prior coverage: current policy, retroactive date, and any gap in coverage
- Three years of losses: any claims or complaints, with dates and amounts paid
- Client contract requirements: paste them into our contract insurance checker
- If you want AI cover: which models you use, whether you train them, how much the system acts without human review, and how you test and monitor it
Common gaps
- A cyber policy with no tech E&O. Product failures without a breach are not cyber events.
- A professional liability policy that does not describe your technology services. Check the definition of covered services.
- Limits below what enterprise and government clients require.
- A retroactive date that does not reach back to your earlier releases or projects.
- Contract promises the policy will not back, such as uncapped liability or service credits.
More for IT businesses: IT consultants and MSPs and technology companies.