AI, SaaS & Tech Business Insurance UK — Specialist Cover for AI Companies, SaaS Vendors & Tech Consultancies

Most software businesses start with three lines. Technology Errors & Omissions is the core — it's designed to respond to claims that your technology or advice caused a client loss, covering things like software defects, integration failures and, where the wording addresses it, AI model errors. Cyber Liability deals with data breach, ransomware and ICO investigation defence. Media Liability covers defamation, copyright and content claims. Beyond that, Directors & Officers matters once you have investors, and Employers' Liability is compulsory once you have employees. The single biggest driver of the limits you need is the liability cap in your largest customer contract.

Historically most wordings said nothing about AI either way — it was covered by silence rather than by grant, which means the argument only happens at claim time. That's changing. Through 2026, some insurers have started attaching AI exclusions at renewal, while a small specialist market has begun offering cover that names AI explicitly. Neither is universal yet, so the honest answer for any individual business is: it depends entirely on your wording. If you build with AI or use it in client-facing work, ask your broker to show you what your policy says about it in writing. If nothing turns up, that's the answer — and it's worth knowing before a claim rather than after.

It can. The Act reaches beyond the EU in much the same way GDPR does — a UK business is potentially in scope if it places an AI system on the EU market or if the outputs of its AI system are used in the EU. No EU entity, servers or staff are needed. The timetable changed in July 2026: the Digital Omnibus on AI deferred obligations for standalone high-risk systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products to 2 August 2028. What did not move: the Article 50 transparency duties applied from 2 August 2026, and the AI literacy duty has applied since February 2025. Penalties run up to €35m or 7% of worldwide turnover for prohibited practices, and up to €15m or 3% for most other breaches. This is a summary, not legal advice — if you think you're in scope, take proper advice on classification.

If you build your product on someone else's model and a customer sues over the result, the claim still lands on you — your customer's contract is with you, not with the model provider. Model providers' own terms typically cap what they'll indemnify, and that cap is often well below the exposure. A properly structured Tech E&O policy is normally what you'd look to in that situation, but whether it responds depends on how the wording treats third-party technology and AI specifically. This is one of the first things we check on an AI risk, alongside what your supplier terms actually promise and whether your customer contract caps line up with your cover.

Hallucination claims arise where a model states something confidently wrong and a client relies on it — incorrect analysis, fabricated references, bad guidance. Bias claims arise where an AI system produces discriminatory outcomes, which is most acute where AI touches decisions about people. In the UK, the Equality Act 2010 applies, and the Data (Use and Access) Act 2025 reformed the UK GDPR rules on automated decision-making. Some specialist Tech E&O wordings address these exposures; many don't, and it has to be looked for rather than assumed. Practically: expect to be asked at proposal stage about your AI use cases, what testing you do, and where a human reviews output. Firms who can answer those questions clearly tend to get better terms.

We don't publish premium figures for this sector, because they'd be misleading. Two businesses with identical turnover can be priced very differently depending on their customer contracts, their data, their claims history and whether AI sits anywhere near decisions about people. What we can tell you is what moves the number: contract liability caps, US exposure, the limits you need, the sensitivity of the data you hold, your claims record, and how much documented governance you can show an underwriter. The section above sets those out. For an actual figure, a quote takes a few minutes and costs nothing.

Sometimes, and it depends on the wording. SaaS contracts routinely commit to uptime and response times, with service credits as the contractual remedy. Service credits and damages for a customer's actual losses are treated differently by insurers, and many wordings restrict cover for liability assumed purely by contract. Where downtime is caused by a cyber event, Cyber Liability is usually the more relevant line, and you may also want business interruption cover for your own lost revenue. The practical step is to check your SLA commitments against your policy before you sign the next big customer contract, not after an outage.

This is an active area of litigation in the UK and US, with cases brought by publishers, authors, image rights holders and music rights holders over both training data and model outputs. Some specialist Tech E&O wordings include intellectual property defence; others exclude it or sub-limit it heavily, so it's worth confirming rather than assuming. On the risk management side, insurers respond well to documented training data provenance, licences for material you rely on, and a clear record of what your supplier terms indemnify you for. For related cover, see our cyber insurance page.

It's worth understanding, though it's a tax question rather than an insurance one. IR35 determines whether someone working through their own limited company is treated as employed for tax purposes. Since April 2021, medium and large private sector clients have been responsible for making that determination and issuing a Status Determination Statement. It doesn't change your insurance cover directly, but it does indicate how you work — and consultancy advisory work and deliverable-based project work aren't always covered by the same wording, so it's worth being clear about which you're doing. For more, see our tech contractors page.

Generally yes for the traditional exposures — a data breach is a data breach whether or not AI was involved, and ransomware affecting your systems is covered on normal terms. Where it gets less certain is AI-specific attacks: model poisoning, adversarial attacks, prompt injection, model theft. Some insurers now address these explicitly; others have started adding AI-related exclusions. Cyber underwriters are also asking more detailed questions about how AI systems are secured and who has access to them. As with everything else on this page, the answer for your business is in your wording — and if you can't find AI mentioned at all, that itself is worth raising at renewal.

Platforms carry exposures that ordinary SaaS wordings often exclude — in particular, liability arising from what your users do to each other. Add user-generated content risk (defamation, IP, harmful content), Online Safety Act obligations, and account compromise, and a general Tech E&O policy can leave real gaps. Media Liability usually becomes essential rather than optional, and platform liability needs to be looked for specifically in the Tech E&O wording. If you handle payments between users, fraud and chargeback exposure is worth a separate conversation.

The things that consistently help: a security certification an underwriter recognises, such as Cyber Essentials Plus, ISO 27001 or SOC 2; written AI governance showing how models are selected, tested and overseen and where humans review output; negotiating sensible liability caps into customer contracts rather than accepting uncapped exposure; a documented and tested incident response plan; and a complete, well-presented proposal form, because underwriters price uncertainty. None of these are quick wins on their own, but together they change the conversation — and the governance documentation is increasingly what separates a quote from a decline on AI risks.