Rail Design PI Insurance UK | Engineers & Assurance Cover
Why is rail design professional indemnity different from ordinary construction PI?
Because the consequence of a rail design error is disruption to a national network, and the discovery period runs for decades. A design defect on a commercial building is found during construction or in the first few years of occupation. A rail asset is inspected, monitored and re-assessed for as long as it exists, so a defect can surface long after the contract closed and the team dispersed. Add design responsibility that migrates to contractors without a fee, appointments importing fitness for purpose obligations that a negligence-based policy cannot cover, and formal assurance roles carrying their own professional exposure, and you have a class where the wording matters far more than the price.
Key facts at a glance
- Professional indemnity is claims-made. It responds to the policy in force when the claim is made, not when the work was done. In a sector with a decades-long discovery tail, that makes continuity of cover the single most important structural feature — and a lapse or a reset retroactive date can orphan years of past work.
- PI insures negligence, not outcomes. Where an appointment imports a fitness for purpose or absolute performance obligation, you have promised a standard higher than reasonable skill and care. The gap between what you promised and what the policy insures is uninsured by definition.
- Design responsibility migrates without anyone deciding to accept it. A sub-contract asking you to "develop", "complete" or "finalise" a design, or to produce temporary works calculations, has transferred professional risk — whether or not a design fee was charged.
- The CSM-RA duty falls on the "proposer" of a change. Under the retained Common Safety Method for Risk Evaluation and Assessment, the proposer is whoever is in charge of the project — which the ORR's guidance confirms can include project entities and manufacturers, not only infrastructure managers and operators.
- Assurance appointments are moving down the supply chain in CP7. Historically Network Rail usually appointed the Assessment Body and the Approved or Designated Body. Under the client models being adopted for Control Period 7, principal contractors may increasingly need to make those appointments themselves — which shifts a professional duty, and its insurance consequences, onto contractors.
- Assessment and assurance bodies must be UKAS accredited. Where a significant change requires independent assessment, the Assessment Body produces a Safety Assessment Report, and interoperability work additionally requires an Approved or Designated Body assessing compliance with the national technical rules. Those are professional services with their own indemnity exposure.
- Limits sized to fee income are the commonest structural error. A modest design fee on a package whose failure closes a route does not justify a modest limit. Rail PI limits should be set against the consequence of failure, tempered by what the appointment requires and what the market will realistically offer.
Rail design sits at an awkward intersection. It is engineering, so it looks like a conventional consultancy PI risk. It is safety-critical infrastructure, so a failure has consequences that no fee could ever justify. And it is increasingly performed not by consultancies at all, but by contractors who acquired design responsibility somewhere in a sub-contract they did not negotiate.
That last group is where most of the uninsured exposure sits. A consultancy knows it is a design practice and buys PI accordingly. A civils contractor that agreed to "develop the temporary works design" believes it is a construction business, and its insurance reflects that belief rather than its contracts.
This guide is the professional liability companion to the rail cluster. It sits alongside our rail contractor insurance guide, which covers the liability side, our on-track plant guide, which covers the asset side, and our RISQS insurance requirements guide, which covers the compliance record. All four sit behind our rail contractor insurance page, and the general mechanics of PI are covered on our professional indemnity page.
How does design responsibility migrate to a contractor without a fee?
Through wording in a sub-contract that reads like a description of construction work but is actually a transfer of professional risk. Phrases such as "develop and complete the design", "finalise details", "produce temporary works calculations" or "satisfy yourself as to the adequacy of the design" all transfer design responsibility. The contractor prices the work as construction, charges no design fee, and acquires a claims-made liability that will outlive the contract by decades.
It happens for entirely understandable commercial reasons. Passing design responsibility down is efficient for the party doing the passing, and contractors bidding competitively rarely have the appetite to argue about a clause that looks technical rather than financial. But the consequences are asymmetric: the party transferring the risk saves a fee, and the party accepting it takes on an exposure that can exceed its annual turnover.
The four phrases to look for
- "Develop and complete." The design is not finished; you are finishing it. That is design responsibility however the fee is described.
- "Satisfy yourself as to." A verification duty. You are being asked to check somebody else's work and take responsibility for the result — often with no access to the assumptions behind it.
- "Temporary works design." Propping, support, access, lifting arrangements and sequencing. This is design, it is safety-critical, and it is very frequently uninsured because it is treated as part of the method statement.
- "In accordance with the Employer's Requirements." Where the requirements state a performance outcome rather than a specification, you may have accepted an obligation to achieve a result rather than to exercise skill and care.
The fee is irrelevant to the liability. There is no principle limiting a designer's liability to what they were paid. A contractor who charged nothing for temporary works design carries the same exposure as a consultancy that charged properly for it — and is far less likely to hold the PI cover that responds. If your sub-contracts contain any of the phrases above and you have no PI policy, that is the single most urgent gap in your programme.
How do the three placement routes for rail PI compare?
An annual practice policy, a rail-aware annual policy, or a project-specific placement. Most businesses need the middle option. Project-specific cover becomes relevant where an appointment demands a limit that would be uneconomic to carry all year, or where the post-completion maintenance obligation runs longer than the business intends to trade.
| Feature | General construction PI | Rail-aware annual PI | Project-specific PI |
|---|---|---|---|
| Typical fit | Occasional design, no rail-specific roles | Regular rail design or assurance work | A single high-value appointment with an outsized limit requirement |
| Rail activities | Often undeclared; may not be within the risk presented | Declared and rated, including assurance roles | Scoped precisely to the appointment |
| Typical limit | £1m–£2m, sized against fee income | £2m–£10m, sized against consequence | Set by the appointment, frequently £10m+ |
| Retroactive date | Frequently reset on insurer change without anyone noticing | Protected as a placement priority | Project inception, with cover for the project period plus tail |
| Assurance roles (AsBo, ApBo, DeBo) | Not contemplated | Available where the market has appetite | Scoped to the assessment engagement |
| Post-completion obligation | Depends on the business continuing to renew | Managed at each renewal, with run-off planned | Built in for the required period |
| Fitness for purpose | Excluded; usually not discussed | Excluded, but identified and negotiated out of appointments | Excluded; appointment amended before placement |
| Indicative annual premium | Illustrative: £1,500–£8,000 | Illustrative: £6,000–£45,000 | Illustrative: project-rated, frequently 1–3% of the limit |
Premium ranges above are illustrative only. They indicate the shape of the market rather than being quotations. Actual pricing depends on fee income, discipline mix, limit, claims record, retroactive date position and the terms of the appointments you sign.
Why does a fitness for purpose obligation fall outside your PI policy?
Because professional indemnity insures negligence, and fitness for purpose is a promise about the result. The ordinary professional standard is reasonable skill and care — you are liable if you fell below what a competent practitioner would have done. A fitness for purpose obligation makes you liable if the outcome is not achieved, even where your work was faultless. PI wordings exclude that gap almost universally, so accepting the clause creates an uninsured liability at the moment of signature.
The clause rarely announces itself. It appears as a requirement that the works "shall be fit for the purpose specified", that the design "shall achieve" a stated performance, or that the contractor warrants a result. In rail appointments it also appears indirectly, through Employer's Requirements expressed as outcomes and through obligations to comply with standards in a way that guarantees an end state.
What to do when you find one
- Try to amend it to reasonable skill and care. This is a standard negotiation and it succeeds more often than contractors expect, particularly where the party asking has been told by its own advisers that the obligation is uninsurable.
- If it cannot be removed, price it. An uninsured obligation is a real cost. It belongs in the tender, not in the risk register you write after winning.
- Check the net contribution position at the same time. Without a net contribution clause you can be liable for the whole loss where another party is also at fault but cannot pay. That materially changes the size of exposure a modest limit is being asked to carry.
- Check collateral warranties and third party rights. These extend your liability to funders, purchasers and end users who were never party to your appointment, and they can carry different obligations from the appointment itself.
How does the Insurability Framework apply to rail design risk?
Rail design PI is a judgement placement in a market with limited appetite, where the wording decides everything. Long tail, safety-critical consequence, contractual obligations that exceed the insurable standard, and formal assurance roles that most underwriters have never rated. The Insurability Framework™ is our structured method for presenting that to the markets that will write it.
The Insurability Framework applied to rail design and assurance
Four pillars, applied to consultancies, design-and-build contractors and assurance providers across the rail supply chain.
PI underwriters price on discipline mix, appointment quality and design assurance process. What moves the number is evidence of how designs are checked, who signs them off, and whether you negotiate the contracts you sign. We present that before it is asked for.
Safety-critical rail design, signalling and formal assurance roles fall outside general professional lines appetite. Placement runs through markets that will rate an assurance appointment properly rather than declining it as unfamiliar.
The exposures that matter are contractual: migrated design responsibility, fitness for purpose obligations, absent net contribution clauses, collateral warranties and post-completion maintenance duties. We read the appointments, not just the proposal form.
PI claims are notified on circumstances, often years before quantum is known, and the notification itself is a skilled act. Getting it right protects the policy that has to respond and avoids prejudicing cover at the point you most need it.
More on the method on our Insurability Framework page, and on comparable placements in our adverse risk insights hub.
What does it mean to be the "proposer" under CSM-RA?
It means the risk management duty for a change to the railway sits with you. The Common Safety Method for Risk Evaluation and Assessment, retained in UK law and applying to those with duties under ROGS, places its obligations primarily on the proposer — the party in charge of a project that changes a technical, operational or organisational aspect of the railway. The ORR's guidance is explicit that this is not limited to operators and infrastructure managers: project entities and manufacturers leading projects can be the proposer too.
Where the change is assessed as significant, the proposer must appoint an independent Assessment Body to assess the application of the CSM-RA risk management process, and that body produces a Safety Assessment Report. Where the work also falls within the interoperability regime, an Approved Body or Designated Body must independently assess compliance with the applicable national technical rules, and their certificates and technical file go to the ORR alongside the Safety Assessment Report.
For most of the sector's history these appointments have been made by Network Rail. The point worth attention is that this is changing.
The CP7 shift. Industry briefings have flagged that, historically, Network Rail usually appointed the Assessment Body and the Approved or Designated Body — but that under the client models being adopted by the regions for Control Period 7, principal contractors may increasingly need to make those appointments themselves. That is not a procurement detail. It moves a formal safety duty, and the professional judgement that goes with it, down the supply chain to organisations whose insurance was never arranged with it in mind.
If your business is being asked to act as proposer, or to appoint assessment bodies, three things follow immediately:
- You are exercising professional judgement about significance. Deciding whether a change is significant, and documenting that decision, is an assessable professional act with consequences if it is wrong.
- Your appointment terms need to reflect the new duty. A sub-contract written for construction delivery will not address a role that produces regulatory submissions.
- Your PI policy needs to know. This is a change in the nature of the services you provide, and under the Insurance Act 2015 it is a material circumstance you owe a duty to disclose.
What professional exposure do assurance and assessment roles create?
A distinct one, because the deliverable is an opinion that others rely on. An Assessment Body producing a Safety Assessment Report, or an Approved or Designated Body certifying compliance, is providing a professional service whose entire value is the reliance placed on it. If the opinion is wrong, the loss is not confined to the fee — it can extend to everything built or authorised on the strength of it. These organisations must be UKAS accredited, and their PI needs to be arranged with the reliance exposure explicitly in view.
The same logic applies further down the chain to internal engineering assurance roles. A responsible engineer signing off a design, a competent person verifying a calculation, or an engineering manager accepting a submission is performing a professional act on which others rely. Where that role sits inside a contractor rather than a consultancy, the insurance frequently has not caught up.
Three features distinguish assurance PI from ordinary design PI:
- The reliance is broad and often undefined. A design serves one project; an assurance report can be relied upon by the client, the infrastructure manager, the regulator and subsequent parties.
- Independence is part of the product. Conflicts of interest are a live professional risk, and an allegation that independence was compromised is both a claims issue and a reputational one.
- The work is documentary. The report is the deliverable and the evidence. Assurance providers who keep exemplary records defend claims well; those who do not have nothing to defend with.
From recent placement conversations
"The most common uninsured liability I find in rail has no fee attached to it. Somebody signed a sub-contract agreeing to develop the temporary works design, priced it as construction because that is what the business does, and has been carrying claims-made professional risk ever since without a professional indemnity policy. They are not being reckless. Nobody told them that clause was a different kind of promise."
"The second most common is a business that has held PI continuously for a decade but changed insurer four times on price, and cannot tell me what its retroactive date is. In a sector where a defect can surface twenty years later, that is the number that decides whether you have a policy or a piece of paper."
What PI cover does your rail role need?
Rail professional risk varies enormously by role. Select the closest match to your business.
Rail PI cover checker
Rail design consultancy
- CRITICAL Limit sized against project consequence rather than fee income.
- CRITICAL Retroactive date protected across every renewal and insurer change.
- ESSENTIAL Appointment review before signature, targeting fitness for purpose and net contribution.
- ESSENTIAL Cover for collateral warranties and third party rights granted to funders and end users.
- RECOMMENDED Run-off planning where the practice may not trade indefinitely — see professional indemnity run-off cover.
- CONSIDER Cyber cover for design models, asset data and BIM environments.
Signalling, control and systems design
- CRITICAL Recognition that a wrong-side failure is the most severe outcome category in the sector, and limits set accordingly.
- CRITICAL Verification and validation process evidenced, since the defence to a design claim is the process record.
- ESSENTIAL Declared involvement in safety-critical systems, not a generic engineering description.
- ESSENTIAL Cover for software and configuration work where systems are configured rather than physically designed.
- RECOMMENDED Cyber and technology overlap reviewed, given operational technology exposure — see construction cyber insurance.
- CONSIDER Product liability where you supply components as well as designing systems.
Contractor carrying design duties
- CRITICAL Confirm whether you hold any PI at all — many contractors with design duties do not.
- CRITICAL Temporary works design specifically declared, since it is the most commonly overlooked design activity.
- ESSENTIAL Sub-contract review for the migration phrases before signature rather than after.
- ESSENTIAL Coordination with your liability programme so the two policies do not both disclaim — see our rail contractor insurance guide.
- RECOMMENDED Design sub-consultant verification, with minimum PI limits imposed downward.
- CONSIDER Whether your RISQS RICCL codes describe design services your policy does not mention.
Assurance, assessment and certification bodies
- CRITICAL Reliance exposure declared — the loss is what was built on your opinion, not your fee.
- CRITICAL Independence and conflict of interest controls documented, since an allegation of compromised independence is both a claim and a reputational event.
- ESSENTIAL UKAS accreditation maintained and evidenced.
- ESSENTIAL Record retention policy matched to the discovery period, not to a standard document retention schedule.
- RECOMMENDED Limits reviewed against the scale of the schemes assessed rather than the assessment fees.
- CONSIDER Directors' and officers' cover alongside — see directors and officers insurance.
Surveying, monitoring and inspection
- CRITICAL Recognition that survey and inspection findings are advice, so the exposure is PI rather than public liability.
- ESSENTIAL Clear scope and limitations recorded in every report, which is the primary defence to a missed-defect claim.
- ESSENTIAL Retroactive date continuity, since defects are discovered long after inspection.
- RECOMMENDED Cover for monitoring services where readings inform operational decisions.
- CONSIDER Ground and geotechnical interpretation exposure — see our geotechnical and ground engineering guide.
Project management and CDM roles
- CRITICAL Principal designer and CDM duties declared as distinct services with their own exposure.
- ESSENTIAL Scope clarity on whether you coordinate design or carry design responsibility, which are very different liabilities.
- ESSENTIAL Cover for programme, cost and contract administration advice, not only technical work.
- RECOMMENDED Appointment review targeting obligations to achieve programme or cost outcomes.
- CONSIDER The wider complex project picture in our complex construction risk guide.
Which appointment clauses should stop you signing?
Tick anything you recognise from an appointment or sub-contract you have signed or been sent. Each is a clause that changes what your PI policy can do for you.
Rail appointment red flag checklist
- A fitness for purpose or absolute performance obligation on the design.
- A requirement to "develop and complete" a design prepared by someone else.
- An obligation to "satisfy yourself as to" the adequacy of another party's work.
- Temporary works design included in scope with no separate design fee.
- No net contribution clause, leaving you exposed for the full loss where others are also at fault.
- A PI limit requirement higher than the limit you currently hold.
- An obligation to maintain PI for a stated number of years after completion.
- Collateral warranties or third party rights extending liability to funders or end users.
- A requirement to act as proposer, or to appoint an assessment or assurance body.
- An uncapped liability, or a cap set above your PI limit.
- A requirement that insurers meet a stated financial strength rating your market may not hold.
- An obligation to comply with standards in a way that guarantees an outcome rather than a process.
Two or more ticks means the appointment as drafted asks for more than your policy delivers. Send us the appointment before you sign — reviewing a clause costs nothing, and most of these are negotiable if raised before the contract is executed.
How hard will your rail PI be to place?
Rail PI placement assessor
Why does the retroactive date matter more in rail than anywhere else?
Because rail assets are monitored for decades, so defects surface long after the contract closed. Professional indemnity is claims-made: it responds to the policy in force when the claim is made, and only for work carried out after the retroactive date. Changing insurer can reset that date. In a sector where a design defect might emerge fifteen or twenty years later, a reset retroactive date does not reduce your cover slightly — it removes it entirely for everything you did before the new date.
The mechanism is easy to miss because nothing appears to go wrong at the time. The business moves insurer for a better premium, the certificate arrives, the limit is the same, and everything looks equivalent. The retroactive date is one line on the schedule that nobody reads, and its consequences do not appear for years.
How to protect it
- Know the date. If you cannot state your retroactive date without looking, find it today. It is the single most important number on a PI schedule.
- Make continuity a placement instruction, not a preference. Tell your broker in writing that the retroactive date must be maintained. A cheaper policy with a later date is not cheaper; it is a different, smaller product.
- Watch for it at every renewal, not just insurer changes. Retroactive dates can move on renewal with the same insurer where the risk is re-underwritten.
- Keep the schedules. A continuous chain of PI schedules going back to inception is the proof that cover was unbroken. Businesses that keep them settle coverage questions quickly.
- Check it after any corporate change. Restructures, name changes and acquisitions are where retroactive dates get lost, and where the insured entity stops matching the entity that did the work.
The cheap-renewal trap. A rail design business that saved £2,000 a year for five years by moving insurer each renewal, resetting the retroactive date each time, has saved £10,000 and orphaned five years of design work. Our guides to professional indemnity after a claim and PI renewal for design professionals cover the renewal mechanics in more detail.
What happens to your liabilities if the company stops trading?
They continue, and without run-off cover nothing responds to them. Because PI is claims-made, a policy that lapses when the business closes leaves every past design uninsured from that moment. Appointments frequently require cover to be maintained for a stated number of years after completion, which becomes a run-off obligation the moment you stop trading. For rail work, where discovery runs long, run-off is not a formality — it is the whole of your remaining protection.
Run-off matters to three groups in particular. Owners approaching retirement, who may find that closing the business costs more than they expected. Businesses being acquired, where the buyer's due diligence will ask about it and the answer affects the price. And any business whose appointments contain a post-completion maintenance obligation, because that obligation survives the decision to stop trading.
Practical points worth knowing before you need them:
- Run-off is normally arranged with your existing insurer, and is usually easier to place while the business is still trading than afterwards.
- The period should match the longest obligation you have accepted, not a default. If an appointment requires twelve years, six years of run-off leaves a gap.
- It is a cost of closure and should be budgeted. Directors who discover it at the point of winding up have very few options.
- Individual directors can retain exposure, which is why directors' and officers' cover is often arranged alongside — see directors and officers insurance.
Our dedicated guide to professional indemnity run-off cover covers the mechanics in full.
How should a rail PI limit actually be sized?
Against the consequence of the work failing, not against the fee for doing it. There is no legal principle capping a designer's liability at their fee. A £40,000 design package whose failure closes a route for a weekend generates a loss that bears no relation to the fee, and a £1m limit chosen because it felt proportionate to turnover will not respond adequately. The right approach is to start from the worst realistic outcome, then temper it with what the appointment requires and what the market will offer at a sensible price.
| Consideration | The wrong question | The right question |
|---|---|---|
| Starting point | What is proportionate to our fee income? | What is the worst realistic outcome of this work failing? |
| Contractual requirement | What is the minimum limit we can get away with? | What do our appointments actually require, and for how long? |
| Aggregation | Is the limit big enough for one claim? | Is it any one claim or in the aggregate, and how many claims could one error generate? |
| Defence costs | Ignored | Are costs inclusive of or in addition to the limit? |
| Net contribution | Others were at fault too, so our share is small | Without a net contribution clause, could we carry the whole loss? |
| Excess | What is the cheapest option? | What could we actually fund from the balance sheet if two claims arrived? |
| Project peaks | One limit for everything, all year | Would a project-specific policy be better for the one outsized appointment? |
| Reinstatement | Not considered | Does the policy reinstate the limit, and on what terms? |
Is temporary works design covered by your PI policy?
Only if you hold PI and have declared it — and a large number of rail contractors do neither. Temporary works design is design: propping, support, access, lifting arrangements and sequencing all involve engineering judgement that others rely on. It is safety-critical, it is frequently performed under time pressure, and because it is treated as part of the method statement rather than as a design service, it is the most commonly uninsured professional activity in rail construction.
The exposure is sharpened by two features specific to rail. Temporary works often support live infrastructure, so a failure has consequences beyond the site. And possession working compresses the timescale, so temporary works decisions are frequently made and revised in the middle of the night against a handback deadline.
If your business carries out temporary works design, three actions are worth taking this month:
- Confirm whether you hold PI at all. If not, that is the gap, and it is more urgent than any other item in this guide.
- Declare temporary works design specifically. A policy describing "civil engineering contractor" does not obviously encompass a design service.
- Record who checks the design and to what standard. The defence to a temporary works claim is the check record, and possession pressure is exactly when checking gets skipped.
The construction-side exposures around temporary works are covered further in our groundworks contractor guide and our scaffolding insurance guide.
What drives the cost of rail design PI in 2026?
Discipline mix, appointment quality, limit, claims record and retroactive date position. Fee income sets the scale but not the rating. A practice doing signalling design on bespoke appointments with fitness for purpose obligations will be priced very differently from one doing station architecture on standard terms with the same income. Appointment quality is the factor most within your control and the one most consistently ignored.
| Rating factor | Why it matters to the underwriter | What reduces the loading |
|---|---|---|
| Discipline mix | Safety-critical systems carry a different consequence profile from architecture | An accurate split of fee income by discipline, not a single description |
| Appointment terms | Fitness for purpose and uncapped liability are uninsurable exposures | Evidence you review and negotiate appointments before signing |
| Net contribution clauses | Their absence can leave you carrying the whole loss | Standard use of net contribution wording in your terms |
| Retroactive date position | An unbroken date means the insurer inherits a known history | A continuous chain of schedules back to inception |
| Design assurance process | The check record is the defence to a design claim | Documented checking, independent review and sign-off authority |
| Assurance and assessment roles | Reliance exposure extends well beyond the fee | UKAS accreditation, independence controls, record retention policy |
| Claims and notification history | Frequency of notifications signals process quality | A clear narrative on each, and what changed afterwards |
| Limit and aggregation basis | Any one claim versus aggregate changes the exposure materially | A limit chosen from consequence analysis rather than habit |
| Sub-consultant control | Your liability follows your sub-consultants' errors | Verified sub-consultant PI with minimum limits imposed downward |
| Post-completion obligations | Long maintenance duties extend the insurer's tail | Knowing what you have agreed and for how long |
| Corporate history | Restructures can break the chain between insured and work performed | Clear entity history, with predecessor cover identified |
| Presentation quality | Professional lines underwriting is judgement-led | A submission that includes sample appointments, not just a proposal form |
The lever with the best return. Of everything in this table, appointment review is the one that costs nothing and changes the most. Removing a fitness for purpose obligation converts an uninsurable liability into an insurable one, and underwriters respond to evidence that you do this as a matter of course rather than when someone happens to notice.
What do real rail design claims look like?
The three examples below are illustrative composites written for this guide. They are not real clients and not actual claims; the figures are indicative of the shape and scale of loss in this area, not settlements we have handled.
Case study 1 — The temporary works design nobody was paid for
The situation. A structures contractor was engaged to install a footbridge span. The sub-contract asked it to "develop and complete" the temporary works design for the lift, including the propping arrangement. No separate design fee was charged; the work was treated as part of the method statement.
The consequence. Differential settlement of a temporary support caused misalignment during installation. The span was recovered and reset, the possession overran by four hours, and remedial works and re-survey followed. The principal contractor claimed £268,000, of which £91,000 was physical remedial work and £177,000 was delay and standing time.
The cover position. The contractor held a £1m PI policy taken out three years earlier with a retroactive date matching inception. The design work fell inside the retroactive period, so PI responded after a coverage investigation, subject to a £10,000 excess. The delay element was argued at length; part was recovered as flowing from the negligent design and part was not. Net recovery was approximately £198,000 of the £268,000 claimed.
The lesson. Design responsibility had been accepted for no fee and with no conscious decision, and was insured only because a PI policy happened to exist with an intact retroactive date. Renewal impact: limit increased to £5m, design activities formally declared, premium roughly doubled — and the programme finally matched the work.
Case study 2 — The retroactive date that moved four times
The situation. A small rail engineering consultancy had held PI continuously for eleven years, moving insurer on price at four separate renewals. Each move reset the retroactive date to the new inception. Nobody at the practice was aware this had happened.
The consequence. A drainage design produced nine years earlier was implicated in a subsequent embankment failure. The claim, including investigation and remedial costs, was pleaded at £640,000.
The cover position. The policy in force at the date of the claim carried a retroactive date three years earlier. The design pre-dated it by six years and was therefore outside cover. The insurer declined. The practice, with annual fee income under £600,000, had no realistic means of meeting the claim and entered an insolvency process.
The lesson. Every certificate was valid. Cover was continuous in the sense of never having lapsed. And none of it responded, because a single line on the schedule had moved four times without anyone reading it. Renewal impact: none — the business did not survive to renew.
Case study 3 — The assurance opinion relied on by everyone
The situation. An engineering consultancy acting in an assurance capacity issued a report accepting a modification as compliant with the applicable technical rules. The scheme proceeded to installation and entry into service on the strength of it.
The consequence. A subsequent review identified that one interface requirement had not been adequately addressed in the assessment. The modification required rework, an authorisation submission had to be revisited, and the scheme was delayed by five months. Rework and delay costs were claimed at £1.4m.
The cover position. The consultancy held £2m PI, sufficient in limit, but the assurance activity had not been separately declared — the policy described general rail engineering consultancy. Cover was ultimately confirmed after a lengthy investigation of what had been disclosed at placement, and the practice spent seven months not knowing whether it was insured for its largest ever claim.
The lesson. The limit was adequate; the declaration was not. Assurance work is a distinct service with a distinct reliance exposure, and it needs to be named at placement. Renewal impact: assurance activities separately declared and rated, limit raised to £5m, and an independence and record-retention policy formalised.
How should you handle a rail PI notification?
Notify circumstances early and precisely, and stop investigating on your own. PI policies require notification of circumstances that may give rise to a claim, not just of claims themselves — and because cover is claims-made, notifying within the current policy year is what secures the right policy to respond. The instinct to establish whether you were actually at fault before telling anyone is understandable and it is the single most damaging thing you can do.
- Notify circumstances as soon as you become aware of them. A complaint, an unexplained defect, a request for your design records, or a meeting invitation about a problem on a scheme you worked on all qualify. Notification is not an admission.
- Do not investigate independently first. Internal investigation before notification can generate documents that are disclosable and unhelpful, and can delay notification past a policy year boundary.
- Preserve the design record immediately. Calculations, models, check sheets, sign-offs, correspondence, the appointment and its amendments, and the version history. Design software and project systems overwrite; secure copies now.
- Locate the correct policy and confirm the retroactive date. Identify which year's policy responds by reference to when the work was done and when the claim is made, and confirm the work post-dates the retroactive date.
- Do not admit liability or apologise in writing about the technical position. Policies contain conduct conditions, and an admission can prejudice cover. Professional courtesy is fine; accepting fault is not yours to give.
- Route all correspondence through your broker. Claimants and their advisers will approach you directly. Everything should go through the insurer's appointed representatives once cover is engaged.
- Identify other parties early. Sub-consultants, checkers and other designers may share liability, and their insurers need to be brought in. Where no net contribution clause exists, this matters even more.
- Record what you changed afterwards. A notification with a documented process improvement behind it is priced very differently at renewal from one with nothing attached.
John Miller — Director & Principal Broker
John has spent over thirteen years placing specialist commercial risks, with a particular focus on professional liability where the contract matters more than the proposal form. Rail design is the clearest example: businesses acquire design responsibility through sub-contract wording they never negotiated, accept obligations their policies cannot insure, and lose years of protection to a retroactive date that moved on a cheaper renewal. He works with rail consultancies, design-and-build contractors and assurance providers to align appointments, limits and cover — reading the contracts before signature rather than after a notification.
Former #1 Account Executive at Brown & Brown and former #1 Salesperson at AXA, with direct access to the Lloyd's Market and specialist MGA schemes.
Glossary of rail design and assurance terms
- Claims-made
- The basis on which professional indemnity operates. The policy responding is the one in force when the claim is made or the circumstance notified, not the one in force when the work was done.
- Retroactive date
- The date in a claims-made policy before which work is not covered. Changing insurer can reset it, leaving earlier work uninsured. The most important number on a PI schedule.
- Run-off cover
- Professional indemnity maintained after a business stops trading, responding to claims made in respect of past work. Without it, every past design is uninsured from the date of closure.
- Reasonable skill and care
- The ordinary professional standard: liability arises where the work fell below that of a competent practitioner. This is what professional indemnity insures.
- Fitness for purpose
- A contractual obligation to achieve a specified result regardless of fault. A higher standard than skill and care, and almost universally excluded by PI policies.
- Net contribution clause
- Wording limiting your liability to your fair share where others are also responsible. Without it you can be liable for the whole loss if the other parties cannot pay.
- Collateral warranty
- A direct contractual duty owed to a party who was not a party to your appointment, such as a funder, purchaser or tenant, extending the range of who can sue you.
- CSM-RA
- The Common Safety Method for Risk Evaluation and Assessment, establishing a mandatory risk management process for significant changes to the railway system.
- Proposer
- The party in charge of a project making a change to the railway, on whom CSM-RA duties primarily fall. Can include project entities and manufacturers, not only operators and infrastructure managers.
- Significant change
- A change assessed as significant under CSM-RA criteria, triggering the requirement for independent assessment by an Assessment Body.
- Assessment Body (AsBo)
- The independent body appointed by the proposer to assess application of the CSM-RA risk management process, producing a Safety Assessment Report. Must be UKAS accredited.
- Safety Assessment Report (SAR)
- The Assessment Body's report on its findings, submitted to the regulator as part of an authorisation application.
- Approved Body / Designated Body
- Bodies independently assessing compliance with applicable technical rules under the interoperability regime, producing certificates and a technical file. Must be UKAS accredited.
- Temporary works design
- Design of propping, support, access, lifting arrangements and sequencing. Design responsibility in law, frequently uninsured in practice because it is treated as part of the method statement.
- Wrong-side failure
- A failure of a safety system resulting in a less safe rather than a more restrictive state. In signalling, the most serious failure category and primarily a design and assurance question.
- Aggregate limit
- A limit applying to all claims in the policy period combined, as opposed to any one claim. The distinction materially changes how much protection a stated limit provides.
- Defence costs inclusive
- An arrangement where legal costs erode the limit rather than being paid in addition to it. On a large claim the difference can be substantial.
Frequently asked questions
Do rail contractors need professional indemnity insurance?
If your sub-contract asks you to develop, complete, finalise or satisfy yourself as to any design — including temporary works — then yes, because you have taken on advice-based liability that public liability does not cover. Whether a design fee was charged is irrelevant to the liability. A large number of rail contractors carry design responsibility through sub-contract wording and hold no PI at all, which is the most urgent uninsured exposure in the sector.
What is a retroactive date and why does it matter?
It is the date in a claims-made policy before which work is not covered. Because PI responds to the policy in force when a claim is made, and rail defects can surface decades later, a retroactive date that resets on an insurer change removes cover for everything done before it. If you cannot state your retroactive date without looking it up, find it today — it is the most important number on your schedule.
Does PI cover a fitness for purpose obligation?
Almost never. Professional indemnity insures negligence — failing to exercise reasonable skill and care. Fitness for purpose is a promise about the result, so you can breach it while having done everything correctly. PI wordings exclude that gap, which means accepting the clause creates an uninsured liability at the moment of signature. Try to amend it to reasonable skill and care; if you cannot, price it into the tender.
Is temporary works design covered by my policy?
Only if you hold PI and have declared it. Temporary works design is design, it is safety-critical, and in rail it is frequently produced under possession time pressure. Because it sits inside the method statement rather than being invoiced as a design service, it is the most commonly uninsured professional activity in rail construction. Declare it specifically rather than relying on a general business description.
What does it mean to be the proposer under CSM-RA?
It means the risk management duty for a change to the railway falls on you. The ORR's guidance confirms the proposer is the party in charge of the project, and that this can include project entities and manufacturers rather than only operators and infrastructure managers. Where a change is significant, the proposer must appoint an independent Assessment Body, which produces a Safety Assessment Report.
Are assurance body appointments moving to contractors in CP7?
They may be. Industry briefings have flagged that Network Rail has historically appointed the Assessment Body and the Approved or Designated Body, but that under the client models being adopted by the regions for Control Period 7, principal contractors may increasingly need to make those appointments. That moves a formal safety duty down the supply chain, and it is a material change in the nature of the services provided that your PI insurer needs to know about.
What limit of professional indemnity do I need for rail work?
Size it against the consequence of the work failing rather than against your fee income, then temper it with what your appointments require and what the market will offer at a sensible price. There is no legal principle capping a designer's liability at their fee. Also check whether the limit is any one claim or in the aggregate, and whether defence costs erode it or sit in addition.
What happens to my liabilities if I close the business?
They continue, and without run-off cover nothing responds to them. Because PI is claims-made, a policy that lapses on closure leaves all past work uninsured from that date. Appointments frequently require cover to be maintained for years after completion, which becomes a run-off obligation. Run-off is normally easier and cheaper to arrange while still trading, and it should be budgeted as a cost of closure.
When should I notify a professional indemnity circumstance?
As soon as you become aware of it, and before you investigate internally. A complaint, an unexplained defect, or a request for your design records can all be circumstances that may give rise to a claim. Notification is not an admission, and because cover is claims-made, notifying within the current policy year is what secures the right policy to respond. Investigating first is the single most damaging instinct in this area.
Do assurance and assessment bodies need specialist PI?
Yes. The deliverable is an opinion others rely on, so the loss is not confined to the fee — it can extend to everything built or authorised on the strength of it. Reliance exposure, independence and conflict of interest controls, and record retention matched to the discovery period all need to be addressed at placement, and the activity must be declared rather than folded into a general engineering description.
Can I get rail PI cover after a claim or notification?
Usually yes, but the presentation has to do more work. Underwriters expect notifications in this class; what they are pricing is whether the practice learned from them. A notification with a documented process improvement attached is priced on the facts, while a bare loss run is priced defensively. Our guides to professional indemnity after a claim and insurance for businesses refused cover explain how we build those submissions.
How do I find a specialist rail PI broker?
Ask whether they will read your appointments before quoting. A specialist will want sample contracts, not just a proposal form, and will raise fitness for purpose, net contribution and post-completion obligations without being prompted. They should also be able to state your retroactive date position and what protecting it will cost. Miller & Partner approaches every rail placement through the Insurability Framework — underwriter intelligence, difficult risk expertise, risk assessment and claims advocacy. Start at our professional indemnity page or call 01792 001350.
About this guide
This guide is general information about professional indemnity insurance for UK rail designers, engineering consultancies, contractors with design duties and assurance providers. It is not advice, and it is not a recommendation to buy or hold any particular policy. Any cover described is subject to insurer acceptance, underwriting and the terms of the policy actually issued.
Contractual and regulatory concepts are described in outline to illustrate insurance considerations. Nothing here is legal advice, and appointment terms should be reviewed by a suitably qualified legal adviser before signature. Miller & Partner is not affiliated with the Office of Rail and Road, Network Rail, RSSB or UKAS, and descriptions of the CSM-RA and interoperability regimes are summaries of published guidance as at the publication date.
Premium ranges are illustrative and are included to indicate the shape of the market. They are not quotations. The case studies are illustrative composites written for this guide — not real clients and not actual claims; the figures are indicative and are not settlements handled by Miller & Partner. The interactive cover checker, appointment checklist and placement assessor are general information tools only — not personalised advice, not a recommendation and not a quotation.
Legislation and regulatory guidance are described as at the publication date shown at the top of this guide and may change. For our regulatory status, please see the footer of this website. To discuss a rail professional indemnity placement, email enquiries@millerandpartner.co.uk or call 01792 001350.
Instagram
LinkedIn