SaaS Insurance UK: Tech E&O, Cyber & PI for Software Firms
Why is SaaS insurance different from other tech insurance?
SaaS is the fastest-evolving area of UK commercial insurance in 2026, and most "tech insurance" products sold to UK software companies don't actually fit a SaaS business model. The gap matters: a SaaS company is selling continuous service availability to multiple customers simultaneously, where a single software defect can propagate across thousands of users within minutes, where a data breach exposes all customers simultaneously, where the customer's business operations halt the moment your platform does. The risk profile is fundamentally different from a custom development shop, a consultancy, or a hardware-led tech business.
Three things define why SaaS insurance is a distinct discipline. First, the contractual exposure — enterprise SaaS contracts (Master Services Agreements, Data Processing Agreements, SLAs) routinely include uncapped indemnities, broad liability for "indirect" or "consequential" losses, and specific cover requirements that off-the-shelf SME policies do not meet. Second, the regulatory layer — the UK Cyber Security and Resilience Bill (introduced November 2025), the Information Commissioner's Office GDPR fining power of up to £17.5m or 4% of global turnover, EU NIS2 and DORA obligations that flow through to UK SaaS providers serving European clients, and the emerging EU AI Act for any SaaS using AI features. Third, the technical claim profile — SaaS claims involve outages, data corruption, cloud provider failures, third-party API dependencies, and software defects, none of which conventional professional indemnity wordings were originally designed for.
This guide is the most comprehensive UK SaaS business insurance resource we publish. It addresses what cover you actually need, how Tech E&O differs from Professional Indemnity, which MSA clauses can void your cover, how the 2025-2026 regulatory wave affects SaaS specifically, and how to structure a programme that wins enterprise contracts rather than blocks them.
Key facts at a glance
- Professional indemnity (or Tech E&O) is the foundation cover for any UK SaaS company — typical limits £1m for early-stage, £5m–£10m+ for enterprise-facing platforms.
- Cyber insurance is functionally mandatory for SaaS in 2026 — most enterprise client contracts require evidence of cyber cover as a vendor condition.
- ICO can fine up to £17.5m or 4% of global turnover for serious GDPR breaches under the UK GDPR and Data Protection Act 2018.
- The UK Cyber Security and Resilience Bill, introduced November 2025 with Royal Assent expected late 2026, will impose two-tier penalties up to £17m or 4% of global turnover and bring more SaaS firms directly into scope.
- NIS2 and DORA flow-through obligations affect any UK SaaS company serving EU customers or supplying EU-regulated financial services firms — even where the UK Bill doesn't directly apply.
- "Uncapped indemnity" clauses in client contracts are the single biggest source of uninsured SaaS loss — most PI policies exclude liability beyond reasonable contractual caps.
- Typical UK SaaS insurance cost in 2026: £600–£1,800 per year for early-stage; £3,500–£12,000 for £1m–£5m revenue; £15,000–£40,000+ for scaling enterprise platforms.
1. Tech E&O vs Professional Indemnity — what's the actual difference?
The single most confused topic in UK SaaS insurance is the distinction between Professional Indemnity (PI) and Technology Errors and Omissions (Tech E&O) cover. Brokers, lawyers, and procurement teams use the terms interchangeably — but the underlying wordings can be materially different, and the wrong choice creates real cover gaps.
What Professional Indemnity covers
Traditional PI was designed for professional services — accountants, architects, lawyers, consultants. It responds to claims arising from "professional services" — advice, designs, recommendations — that prove to be negligent or in error and cause client financial loss. Standard PI policies typically respond to:
- Errors or omissions in professional advice
- Breach of professional duty
- Unintentional breach of contract or warranty
- Unintentional intellectual property infringement (subject to wording)
- Defamation, breach of confidence (where extended)
For SaaS businesses, the limitation is the "professional services" framing. SaaS isn't primarily about advice; it's about continuously available software, data hosting, processing capability, and service performance. Traditional PI may not respond cleanly to claims framed as software failure, system outage, or service breach.
What Technology Errors and Omissions adds
Tech E&O policies were developed to address technology businesses specifically, with wording designed for the way software actually fails. A well-drafted Tech E&O policy typically responds to:
- Software defects, bugs, and coding errors
- Service outages and breach of SLA
- Failed integrations and API issues
- Data corruption arising from your service
- Performance failures (latency, capacity, scalability)
- Project delays and missed milestones
- Breaches of contract relating to the technology service itself
The strongest Tech E&O wordings also include "media liability" extensions covering content, IP, and reputational claims — and most modern UK Tech E&O placements bundle cyber liability into the same policy to close the gap that arises when separate insurers dispute which cover responds.
2. SaaS cover comparison: which policies do what?
The table below summarises which UK insurance policies respond to which SaaS-specific exposures. It's the comparison that most generic tech insurance content avoids because the boundary lines are uncomfortable for brokers selling single-policy products.
| Exposure / Claim Type | Professional Indemnity | Technology E&O | Cyber Liability |
|---|---|---|---|
| Software bug causing client financial loss | Partial — depends on wording | Yes | Generally no |
| Service outage breaching SLA | Partial — depends on wording | Yes | Sometimes (cyber-caused outage) |
| Data breach affecting customer personal data | Generally no | Sometimes | Yes — primary |
| GDPR fine defence costs | Generally no | Sometimes | Yes (fines themselves uninsurable) |
| Ransomware attack and recovery | No | Sometimes | Yes — primary |
| Negligent advice / consultancy errors | Yes — primary | Yes | No |
| Unintentional IP infringement in your software | Sometimes | Yes — usually | No |
| Cyber business interruption / lost revenue | No | Sometimes | Yes — primary |
| Third-party cloud provider failure affecting your service | No | Sometimes (dependency cover) | Sometimes |
| Social engineering / business email compromise | No | No | Yes — primary |
3. Which insurance does a UK SaaS company need?
Technology Errors and Omissions / Professional Indemnity (Combined)
The foundation cover. Modern UK SaaS placements increasingly use a combined Tech E&O + PI wording that explicitly covers both software-defect claims and professional services claims. Limits depend on the largest client contract — typical scaling:
- Early-stage / pre-revenue / under £500k ARR: £1m limit
- £500k–£2m ARR: £2m–£5m limit
- £2m–£10m ARR with enterprise clients: £5m–£10m limit
- Scaling SaaS with regulated-industry clients: £10m–£25m+ limit
Confirm specifically that the wording includes: software defects and bugs; service outages and SLA breaches; cyber-related professional liability; unintentional IP infringement; loss of documents and electronic data; mitigation costs; defence costs (and whether inside or outside the limit); a full retroactive date matching business inception.
Cyber Liability Insurance
Functionally mandatory for any SaaS company by 2026. Cyber insurance covers first-party costs (your costs of responding to an incident) and third-party liabilities (claims from customers). A well-drafted SaaS cyber policy includes:
- Incident response — forensics, IT specialists, legal, PR
- Data breach notification costs (GDPR Article 33 / 34 requirements)
- Regulatory investigation defence costs (ICO and FCA where relevant)
- Cyber business interruption — lost revenue during outage
- Cyber extortion and ransomware response
- Network security and privacy liability (third-party claims)
- System restoration costs
- Social engineering / business email compromise / funds transfer fraud
- PCI-DSS fines and assessments where applicable
Directors' and Officers' (D&O) Liability
Increasingly important for SaaS businesses given investor scrutiny and regulatory exposure. D&O cover responds to claims against directors personally — for breaches of duty, misleading statements to investors, mismanagement, employment-related claims, and regulatory matters. Investors typically require D&O cover at term sheet stage; the UK Cyber Security and Resilience Bill creates additional personal exposure for directors in scope of the new regime.
Employers' Liability Insurance
Statutory under the Employers' Liability (Compulsory Insurance) Act 1969 if you have any employees. Minimum £5m. Penalties for trading without it reach £2,500 per day. Many SaaS companies use contractors via personal service companies — confirm IR35 position and the employment status of every person working in the business to determine EL responsibility.
Public Liability
Standard PL for non-cyber, non-software third-party injury or property damage — visitors to your office, accidents during client visits, equipment damage. £2m–£5m typical. Often combined with other covers in an SME tech package.
Office Contents and Business Equipment
For physical premises and equipment — your laptops, monitors, servers (if you operate any), office furniture, and stock. Modern SaaS is often heavily cloud-hosted, but homeworking equipment, conference equipment, and any on-premises hardware still needs cover.
Business Interruption (Non-Cyber)
Covers loss of revenue from physical events — fire at your premises, flood, supplier failure. For SaaS, BI is often less relevant than cyber BI (which sits inside cyber cover), but for businesses with meaningful physical operations, non-cyber BI remains valuable.
Crime / Fidelity
Employee theft, electronic crime, and (in some wordings) social engineering — though social engineering is typically better placed under cyber. Important for SaaS businesses handling client funds, processing payments, or with elevated trust exposures.
Intellectual Property Infringement
Specialist cover for IP claims that goes beyond the limited cover under standard PI. For SaaS businesses operating in patent-dense fields (AI, fintech, healthtech), IP infringement cover is increasingly valuable. Available standalone or as extension to Tech E&O.
4. Business model cover checker
UK SaaS businesses span an enormous range of operating models. Select your model below for a tailored cover checklist.
SaaS Business Cover Checker
Select your SaaS model to see the recommended insurance programme
Pre-Revenue / Early-Stage Startup
- LEGAL Employers' Liability £5m if you have any employees (including founders on PAYE)
- ESSENTIAL Combined Tech E&O / PI at £1m — minimal but compliant baseline for first client contracts
- ESSENTIAL Cyber liability at £250k–£1m — needed for due diligence on first enterprise pilots
- RECOMMENDED D&O if you've raised pre-seed or seed capital — investors typically require it
- RECOMMENDED Public Liability £2m for office and client meeting exposure
- CONSIDER Sole proprietorship or founder package if pre-incorporation
- CONSIDER Building a renewal review process — your cover will need to scale every 6-12 months at early stage
B2B SaaS — SME Customer Base
- LEGAL Employers' Liability £5m
- ESSENTIAL Combined Tech E&O / PI at £2m–£5m
- ESSENTIAL Cyber liability £1m+ with full incident response, BI, and ransomware cover
- ESSENTIAL Public Liability £2m–£5m
- ESSENTIAL Office contents and equipment
- RECOMMENDED D&O if limited company structure
- RECOMMENDED Crime / fidelity / social engineering cover
- CONSIDER Contract review service — many SME contracts include onerous indemnification clauses
Enterprise SaaS — Large Corporate Clients
- CRITICAL Cover limits must match the largest single client contract value, not just turnover — enterprise SaaS PI/E&O claims can substantially exceed annual revenue
- ESSENTIAL Combined Tech E&O / PI at £5m–£25m+
- ESSENTIAL Cyber liability £5m–£25m with comprehensive incident response and regulatory cover
- ESSENTIAL D&O liability at substantial limits — enterprise vendor due diligence increasingly demands it
- ESSENTIAL EPL (Employment Practices Liability) for harassment, discrimination, wrongful dismissal claims at scale
- ESSENTIAL Crime / fidelity / social engineering at meaningful limits
- ESSENTIAL IP infringement cover — patent-dense competition
- ESSENTIAL Contract review built into procurement process — MSA, DPA, SCC review at every major engagement
- RECOMMENDED Specialist market placement via Lloyd's — contact Miller & Partner directly
Fintech / Regtech / Financial Services SaaS
- CRITICAL FCA authorisation may be required depending on service — confirm regulatory status before scoping insurance
- CRITICAL DORA flow-through obligations from EU financial services clients — your contracts must accommodate DORA clauses since January 2025
- ESSENTIAL Tech E&O / PI at £5m–£25m with specific financial services scope
- ESSENTIAL Cyber liability with PCI-DSS, financial regulator notification, and DORA-relevant incident reporting
- ESSENTIAL D&O liability with regulatory investigation cover
- ESSENTIAL Crime cover with substantial limits for funds transfer fraud exposure
- ESSENTIAL Professional indemnity wording explicitly covering financial services advice (where applicable)
- RECOMMENDED Treasury / banker's blanket bond if handling client funds
- CONSIDER Adjacent expertise via specialist cyber programme
Healthtech / Medtech SaaS
- CRITICAL MHRA medical device regulation may apply — confirm device classification (Class I-IV) before scoping insurance
- CRITICAL Personal health data is special category under UK GDPR — elevated cyber exposure
- ESSENTIAL Tech E&O / PI at £5m–£25m with explicit medical software cover
- ESSENTIAL Product liability extension where software is medical device
- ESSENTIAL Cyber liability with healthcare data breach response cover; ICO and MHRA notification
- ESSENTIAL US/Canada territorial extension if serving any North American customers (standard UK cover excludes)
- ESSENTIAL D&O liability with regulatory investigation cover
- RECOMMENDED Specialist healthcare technology PI placement — mainstream tech PI rarely meets healthtech-specific exposures
AI-Native / GenAI SaaS
- CRITICAL EU AI Act phased compliance from 2024-2027 — affects any AI system serving EU users
- CRITICAL Standard PI/Tech E&O wordings often exclude AI-related claims — specific endorsement required
- ESSENTIAL Tech E&O / PI with explicit AI scope including model errors, hallucinations, training data issues
- ESSENTIAL IP infringement cover — training data and generated output IP exposure
- ESSENTIAL Cyber liability with prompt injection, model poisoning, and AI-specific attack vector cover
- ESSENTIAL D&O liability — investor scrutiny on AI governance and disclosure
- ESSENTIAL Documented AI governance, model cards, training data provenance — increasingly an insurer policy condition
- RECOMMENDED Specialist AI/tech market placement — emerging Lloyd's products specifically address GenAI
- CONSIDER Linked content liability cover for any AI generating user-facing content
5. MSA red-flag checker — contract clauses that void cover
The single most common source of uninsured SaaS loss isn't a cyber incident or a software bug — it's a client contract that imposes liabilities your insurance was never designed to cover. Tick any that appear in your enterprise client Master Services Agreements (MSAs) or Data Processing Agreements (DPAs):
MSA Red Flag Checker
Click each clause that appears in your current client contracts. More red flags = greater chance your insurance won't fully respond at claim stage.
-
Uncapped liability — the contract has no overall cap on damages or has a cap set at multiples of fees
-
Indemnity beyond negligence — clause requires you to indemnify the client for all losses, not just those caused by your negligence
-
Consequential / indirect loss accepted — you've removed the standard exclusion of consequential losses
-
Fitness for purpose obligation — service guaranteed to achieve a specific outcome (strict liability beyond negligence)
-
Liquidated damages for SLA breach — pre-agreed financial penalties for missed uptime/performance targets
-
Specific insurance requirements — your cover doesn't meet limits, scope, or wording specified by the client
-
DORA flow-through clauses — if serving EU financial services clients, contract imposes DORA-specific resilience and reporting requirements on you
-
Step-in rights — the client can take over your systems or business in defined scenarios
-
Personal director liability — directors agree to personal guarantees or warranties
-
Cross-default provisions — breach of any obligation triggers wide-ranging consequences across multiple agreements
6. SaaS exposure risk assessor
Two factors drive SaaS insurance risk more than any others: who your customers are, and what kind of data you handle. Use the tool below for your specific risk profile.
SaaS Exposure Risk Assessor
Select your customer profile and data type to see your specific risk position
7. How do UK Cyber Security Bill, NIS2 and DORA affect SaaS?
UK SaaS businesses face a regulatory landscape that has changed substantially between 2024 and 2026, with more change coming through 2027. Three regimes affect almost every UK SaaS company in some way, and the insurance implications run through all of them.
The UK Cyber Security and Resilience Bill
Introduced to Parliament on 12 November 2025, with second reading completed and Committee stage progressing through January-February 2026, the UK Cyber Security and Resilience Bill (CSRB) is the UK's most significant cyber regulatory development since the NIS Regulations 2018. Royal Assent is expected in late 2026; phased implementation runs through to 2028. Key features for SaaS:
- Expanded scope: introduces "Relevant Managed Service Provider" (RMSP) as a new regulated category — directly catching many UK SaaS providers offering managed IT services
- Clearer cloud computing definition: "scalable and elastic" pool of shareable computing resources — most SaaS providers will need to consider whether they fall in scope
- Two-tier penalty structure: up to £10m or 2% of global turnover for standard breaches; up to £17m or 4% of global turnover for serious breaches; up to £100,000 per day for ongoing contraventions
- Incident reporting timelines: 24-hour early warning to sector regulator and NCSC; 72-hour full report; cascade reporting where another organisation's incident contributed to yours
- Extraterritorial reach: non-UK providers can be in scope; UK representative appointment within 3 months of designation; physical inspections limited to UK premises but data inspection extends overseas
- Designated Critical Suppliers can be brought into scope even where they wouldn't otherwise qualify
EU NIS2 — Flow-Through to UK SaaS
The EU Network and Information Security Directive 2 (NIS2), in force since October 2024, applies to UK SaaS companies serving EU customers in essential or important sectors. NIS2 obligations include risk management measures, incident reporting, supply chain security, and personal liability of senior management for compliance failures. Fines reach €10m or 2% of global turnover for essential entities; €7m or 1.4% for important entities. The practical effect for UK SaaS: your EU customers will impose NIS2-derived obligations on you contractually, even where the UK CSRB doesn't directly apply.
EU DORA — Financial Services Flow-Through
The EU Digital Operational Resilience Act (DORA), fully in force since 17 January 2025, applies to EU financial services firms and their ICT third-party providers. UK SaaS companies supplying any service to EU financial services clients have been required to incorporate DORA-specific clauses in their contracts since January 2025. DORA imposes:
- Operational resilience requirements (ICT risk management, business continuity)
- Incident reporting obligations
- Third-party risk management — including assessment of "critical" or "important" service designation
- Threat-led penetration testing (TLPT) for designated providers
- Contractual obligations that flow through to ICT third-party providers
For UK SaaS serving EU finance customers, DORA-imposed obligations affect contract terms, operational practices, and the corresponding insurance position. Insurers offering cover for fintech/regtech SaaS now routinely ask about DORA compliance.
UK GDPR and the ICO
The UK GDPR (the retained EU GDPR following Brexit, integrated with the Data Protection Act 2018) remains the foundational data protection law. The Information Commissioner's Office can fine up to £17.5 million or 4% of global turnover for serious breaches. Notification obligations:
- 72-hour notification to ICO of personal data breaches likely to result in risk to data subjects
- Direct notification to data subjects where high risk
- Mandatory record-keeping of all breaches
For SaaS businesses processing personal data, GDPR breach response is a primary cyber insurance trigger. Confirm in writing that your cyber policy includes: 72-hour ICO notification cost cover, data subject notification costs (potentially substantial for breaches affecting thousands or millions of users), regulatory investigation defence costs, and ICO fine defence costs (though fines themselves are uninsurable as a matter of UK public policy).
The Other Layers Affecting SaaS
- EU AI Act — phased compliance 2024-2027, with prohibited AI practices already in force from February 2025; affects any AI-using SaaS serving EU users
- UK Online Safety Act 2023 — relevant for SaaS hosting user-generated content
- Product Security and Telecommunications Infrastructure (PSTI) Act 2022 — connected devices including some IoT SaaS hardware
- DMCC Act 2024 — consumer subscription rules affecting consumer-facing SaaS from Spring 2026 (clear renewals, easy cancellation)
- EU Cyber Resilience Act — fully applicable from 11 December 2027 with phased implementation; affects products with digital elements
8. Why do enterprise client contracts demand specific cover?
If you've sold into any enterprise UK SaaS customer, you've encountered the procurement vendor due diligence questionnaire. It asks about your insurance, often in granular detail. Three reasons enterprise clients demand specific insurance from SaaS suppliers, and what each means for your cover structure.
Reason 1 — Contractual Risk Allocation
Enterprise MSAs allocate risk between buyer and supplier. Insurance is one of the mechanisms enterprises use to ensure suppliers can actually meet the indemnification obligations they've accepted. A supplier with £500k of cover backing a £25m indemnity is a poor risk allocation — the indemnity is functionally worthless beyond the cover. Enterprise procurement teams calibrate insurance requirements to the contract value, the indemnification scope, and the potential downstream loss.
Reason 2 — Regulatory Cascade Effect
Where the enterprise client is regulated (financial services, healthcare, critical infrastructure, public sector), the client has regulatory obligations to manage their supplier ecosystem. Both NIS2 and DORA explicitly require regulated entities to assess and contractually control their ICT third-party providers — including insurance arrangements. The 2025-2026 regulatory wave has materially increased the insurance specificity enterprise buyers demand from SaaS vendors.
Reason 3 — Vendor Resilience Assessment
Beyond contract risk allocation and regulatory cascade, enterprises evaluate vendor resilience generally. Adequate insurance is part of demonstrating that the supplier has thought about operational risk, can survive a major incident, and won't fail the customer at the worst possible moment. Vendor due diligence frameworks (SIG, CAIQ, vendor questionnaires from Big Four firms) all include detailed insurance sections.
Common Enterprise Cover Requirements
| Cover Type | Typical Enterprise Requirement | What to Confirm |
|---|---|---|
| Professional Indemnity / Tech E&O | £5m–£25m per claim and aggregate | Cover scope matches your services; full retroactive date; defence costs structure |
| Cyber Liability | £1m–£10m typical; up to £25m for large enterprise / regulated sector | Incident response, BI, regulatory cover, third-party liability all included |
| Public Liability | £5m–£10m | Standard scope; client visits, conference attendance |
| Employers' Liability | £10m (legal minimum is £5m, but enterprise often requires more) | All staff including contractors-via-PSC where appropriate |
| Crime / Fidelity | £1m–£5m for financial sector clients | Social engineering, funds transfer fraud, employee dishonesty |
9. What about AI features and GenAI SaaS?
AI-enabled SaaS represents the fastest-growing — and most undercovered — area of UK technology insurance in 2026. The challenge is that standard PI and Tech E&O wordings were drafted before generative AI became commercially material, and many policies handle AI-related claims awkwardly or exclude them entirely.
The Specific AI Risk Categories
- Model output errors and hallucinations — AI-generated content that proves false, defamatory, or misleading, causing user or third-party harm
- Training data IP infringement — claims that your model was trained on copyrighted material without authorisation
- Output IP infringement — generated outputs that reproduce protected material
- Bias and discrimination claims — model outputs that produce discriminatory effects in regulated decisions
- Prompt injection and model manipulation — security vulnerabilities specific to AI systems
- Data poisoning and supply chain attacks on training data or models
- EU AI Act compliance failures — particularly for prohibited practices or high-risk AI systems
What to Confirm With Your Insurer
For any AI-using SaaS business, confirm in writing:
- AI-related claims are within the PI/Tech E&O scope (or specifically endorsed)
- Training data IP cover position
- Model output IP cover position
- Cover for claims arising from foundation model providers' actions (OpenAI, Anthropic, Google) that affect your service
- Cyber cover specifically addresses AI-specific attack vectors
- D&O cover for board obligations around AI governance and disclosure
Documentation as Insurance Position
For AI-using SaaS, the underlying documentation of your AI governance is increasingly a policy condition or rating factor:
- Model cards documenting model purpose, capabilities, limitations
- Training data provenance and licensing
- Output review and human-in-the-loop controls
- Bias and accuracy testing protocols
- Incident logging for AI-related issues
- EU AI Act compliance documentation where applicable
Adjacent to AI SaaS, see our electronics design insurance guide for AI in connected hardware and our print on demand insurance guide for AI-generated content IP exposure.
10. What drives the cost of SaaS insurance?
| Rating Factor | Impact on Premium | What You Can Do |
|---|---|---|
| Annual recurring revenue (ARR) | Primary rating basis for PI/Tech E&O; cyber also scales but less directly | Declare accurately; ARR growth above 50% YoY may trigger mid-term adjustment |
| Customer profile | SME customers lower; mid-market moderate; enterprise/regulated significantly higher | Match limits to largest single client engagement value, not just ARR |
| Data sensitivity | Basic business data lowest; financial and health data substantially higher | Document data minimisation; encryption at rest and in transit reduces rating |
| Regulatory scope | Unregulated SaaS lowest; FCA-adjacent, MHRA, NIS2 flow-through all add premium | Maintain compliance documentation; certifications (ISO 27001, SOC 2) reduce premium materially |
| Limits and aggregates | Higher limits cost proportionally more; aggregate vs per-claim structure matters | Match aggregate to plausible multi-claim scenarios — single-event-only structures dangerous |
| Cyber maturity | MFA, endpoint detection, backup hygiene, incident response plan all reduce premium | Document security controls; renewable evidence; consider penetration testing as condition |
| Territorial scope | UK-only lowest; EU adds modest loading; US/Canada significantly higher | Match scope to actual customer geography; US/Canada extension required for any North American sales |
| Claims history | Material multi-year impact; cyber and PI both | Address root causes after any incident; quality systems documentation supports renewal |
| Combined vs separate placement | Combined Tech E&O + Cyber with one insurer often outperforms split placement | Bundle to eliminate boundary disputes and reduce administrative cost |
| Contract review discipline | Documented MSA review process reduces uninsured contractual exposure (and rating) | Build broker contract review into procurement; some insurers reduce premium for it |
11. Real claims and how to manage them
Claim — Software Defect Causing Customer Financial Loss, B2B SaaS
A UK B2B SaaS company providing logistics route-planning software to mid-market customers deployed a code update that introduced a calculation error in fuel-cost optimisation. The bug ran undetected in production for 11 days before a customer reported anomalies. Investigation showed approximately 340 customers had received suboptimal route plans during the affected window, with average fuel cost overruns of £180-£600 per customer per week.
Two customers — large logistics operators using the software at fleet scale — claimed against the SaaS vendor for documented additional fuel costs of £42,000 and £58,000 respectively, plus consequential losses for missed customer delivery commitments. The vendor's combined Tech E&O / PI policy at £5m limit responded.
The insurer engaged a technical expert to assess causation and quantum. The two primary claims were settled at £38,000 and £49,000 respectively. A further nine customers filed smaller claims that were settled administratively for a combined £41,000. Defence costs and expert fees totalled £28,000. Total claim against the £5m limit: £156,000. The vendor's premium increased by approximately 30% at next renewal.
The lesson: software defects can affect hundreds of customers simultaneously and the claims aggregate quickly. The Tech E&O wording specifically responded to "errors in the technology service" — a standard PI written for professional services might have produced a coverage dispute about whether automated software calculations constituted "professional services". The combined Tech E&O / PI wording closed that boundary.
Claim — GDPR Breach Response, Healthtech SaaS
A UK healthtech SaaS company providing patient management software to private healthcare providers suffered a credential compromise via phishing of a customer-support employee. The attacker accessed approximately 8,400 patient records across 14 clinics over a 6-hour window before the access was identified and revoked. The accessed data included name, address, date of birth, and limited clinical notes.
The vendor's cyber liability policy responded. Within the first 24 hours: forensic investigation engaged (£18,000), legal counsel retained (£12,000), and ICO 72-hour notification prepared. Within the first 14 days: data subject notification to all 8,400 individuals (£14,000 in mailing and call centre support), customer notification to all 14 clinic customers, and credit monitoring offered to data subjects (£24,000). PR consultancy supported customer retention (£18,000).
ICO investigated and ultimately did not impose a fine, accepting the rapid response and the absence of evidence of misuse. Customer-driven claims: three of the 14 clinics terminated contracts citing breach of their data processing terms (consequential revenue loss claimed at £140,000); one filed a formal claim for damages (settled at £36,000 plus £8,000 of defence costs).
Total claim against the policy: £268,000 first-party response costs + £44,000 third-party claims = £312,000 against a £5m cyber limit. The vendor's renewal premium increased by approximately 60% reflecting both the claim and the elevated risk profile recognised post-incident.
The lesson: cyber claims drive substantial first-party costs (incident response, notification, regulatory liaison) before any third-party claim is settled. The 72-hour ICO notification window is non-negotiable and the documentation required is substantial. The healthtech sector amplifies this — patient data triggers heightened ICO and (potentially) MHRA attention. Comprehensive cyber cover with strong incident response capability is essential.
Claim — SLA Breach and Liquidated Damages, Enterprise SaaS
A UK enterprise SaaS company providing workflow automation to a FTSE-listed customer experienced a 47-hour partial outage triggered by a misconfigured cloud infrastructure migration. The customer's MSA included an SLA of 99.9% monthly uptime and liquidated damages of £25,000 per hour beyond 0.1% downtime. The 47-hour outage triggered £475,000 of liquidated damages under the contract.
The vendor's combined Tech E&O / PI policy at £10m limit was notified. The insurer's coverage analysis identified the standard "liquidated damages" exclusion in the wording — under English law and most UK PI/Tech E&O wordings, liquidated damages are treated as a contractual liability beyond ordinary negligence and are excluded. The insurer declined the liquidated damages element of the claim.
The customer also claimed consequential losses (revenue impact, customer-facing service disruption) at £180,000. The Tech E&O policy responded to these as a separate negligence-based claim — the cloud migration had been negligently planned and executed. Settled at £142,000 plus £24,000 defence costs.
Net outcome: £475,000 of liquidated damages fell entirely on the vendor (uninsured); £166,000 of consequential loss was covered by Tech E&O. The vendor subsequently negotiated removal or capping of liquidated damages in all future enterprise MSAs and confirmed the position with their insurer in writing.
The lesson: liquidated damages clauses in enterprise SaaS contracts are typically uninsurable. Where you accept LDs in an MSA, you should: (1) cap them at a meaningful but bearable level; (2) confirm in writing with your insurer whether your policy responds; (3) treat them as direct business risk rather than insurable exposure. Many vendors discover the uninsured position only at claim stage — by which point the LD is already crystallised.
Claims Management Steps
How to respond to a SaaS insurance claim or potential claim — the steps below are critical for preserving cover and managing outcome:
- Notify your insurer immediately on becoming aware of a claim or circumstance that may give rise to a claim. PI, Tech E&O, and cyber are all claims-made — late notification can void cover entirely. The threshold for notification is "circumstance that may give rise" — much lower than "formal claim received". Err toward over-notification.
- Engage the cyber response retainer if available. Most modern cyber policies include incident response retainers — your insurer's panel forensic, legal, and PR specialists deployable within hours. Use them; don't try to manage the response yourself.
- Preserve all evidence. System logs, configuration history, communications, customer correspondence, internal incident response notes. Cyber incidents in particular generate evidence that disappears quickly without active preservation.
- Do not admit liability. Even where the technical position seems clear, admissions can prejudice your insurer's defence position. Provide factual information; leave assessment to the insurer's appointed solicitor.
- Manage the regulatory clock. GDPR breaches require 72-hour ICO notification; the UK CSRB (once in force) will require 24-hour early warning. These windows run from awareness of the incident, not from confirming all the facts. Notify within the window with what you know.
- Coordinate communication. Customer notification, regulatory notification, public statements, and internal communication all need coordination via your insurer's PR specialists where the cover provides for it.
- Document the incident response. Every decision, every notification, every communication should be logged with timestamps. The documentation supports both the claim settlement and any subsequent regulatory or litigation defence.
- Conduct root cause analysis. Beyond responding to this incident, identify the underlying cause and address it. Insurers reviewing renewal terms will ask what's changed since the claim — your answer determines whether the renewal is sustainable.
Glossary of SaaS insurance terms
- Tech E&O (Technology Errors and Omissions)
- Insurance covering financial loss caused by failures, errors or omissions in technology services — including software defects, service outages, integration failures, and SLA breaches. The technology-specific equivalent of professional indemnity, often combined into a single wording for SaaS businesses.
- Professional Indemnity (PI)
- Insurance covering financial loss caused by negligent professional services, advice, design or recommendations. Originally designed for professional services firms (accountants, architects, lawyers); for SaaS businesses, increasingly combined with or replaced by Tech E&O wordings.
- Cyber Liability Insurance
- Insurance covering both first-party costs (your costs of responding to a cyber incident) and third-party liabilities (claims from customers affected by your breach). For SaaS businesses, the primary cover for data breach response, ransomware, cyber business interruption, and GDPR regulatory matters.
- Master Services Agreement (MSA)
- The overarching contract between a SaaS vendor and a customer governing the commercial and legal relationship. Typically includes liability caps, indemnification, SLA terms, data processing, and insurance requirements.
- Data Processing Agreement (DPA)
- Contract required under UK GDPR Article 28 between data controller (customer) and data processor (SaaS vendor) governing the processing of personal data. Typically attached to or referenced in the MSA.
- SLA (Service Level Agreement)
- Contractual commitment to specific service standards — typically uptime percentage (e.g. 99.9% monthly), response times, and resolution times. Breach of SLA often triggers service credits, liquidated damages, or termination rights.
- UK Cyber Security and Resilience Bill (CSRB)
- UK legislation introduced to Parliament on 12 November 2025 with Royal Assent expected late 2026. Expands the existing NIS Regulations 2018, introduces new categories of regulated entity (including Relevant Managed Service Providers), strengthens incident reporting, and introduces a two-tier penalty regime up to £17m or 4% of global turnover for serious breaches.
- NIS2 Directive
- EU Network and Information Security Directive 2 (Directive (EU) 2022/2555), in force from October 2024. Imposes cybersecurity and resilience obligations on essential and important entities across multiple sectors, with fines up to €10m or 2% of global turnover. Applies to UK SaaS companies serving EU customers in scope sectors.
- DORA (Digital Operational Resilience Act)
- EU Regulation 2022/2554, fully in force from 17 January 2025, governing operational resilience for EU financial services firms and their ICT third-party providers. UK SaaS companies serving EU financial services clients have been required to include DORA-specific clauses in contracts since January 2025.
- ICO (Information Commissioner's Office)
- The UK's independent data protection authority. Enforces UK GDPR and the Data Protection Act 2018. Can impose fines up to £17.5 million or 4% of global turnover for serious breaches.
- Aggregate vs Per-Claim Limit
- Aggregate limit is the maximum total amount the policy will pay across all claims in a policy period. Per-claim limit is the maximum for any single claim. For SaaS businesses where multiple customers may claim simultaneously from one event, the aggregate matters as much as the per-claim limit.
- Retroactive Date
- The date from which the claims-made policy will respond to claims for acts, errors or omissions. A "full retroactive date" matches business inception — all prior work is covered. Restricting retroactive date saves premium but leaves prior years uninsured.
- RMSP (Relevant Managed Service Provider)
- New category of regulated entity introduced by the UK Cyber Security and Resilience Bill. Captures persons providing managed IT services involving ongoing management of customer information technology systems. Many UK SaaS providers offering managed services fall in scope.
Frequently asked questions
The core programme includes: professional indemnity or combined Tech E&O / PI (foundation cover for software defects, service issues, and consultancy errors); cyber liability (incident response, data breach, ransomware, regulatory matters); employers' liability (legally required if you employ anyone); public liability; D&O liability (particularly if VC-backed); and crime/social engineering cover. Limits depend on customer profile and ARR — typical scaling from £1m PI for early-stage to £10m+ for enterprise-facing SaaS.
Professional indemnity was designed for advisory professional services — accountants, lawyers, consultants. Tech E&O was developed specifically for technology businesses and addresses software defects, service outages, SLA breaches, integration failures, and other technology-specific exposures. For SaaS, the modern approach is a combined Tech E&O / PI wording that covers both consultancy-style claims and software performance claims. Standard PI without Tech E&O elements may produce coverage disputes when software fails — the underlying claim doesn't fit cleanly within "professional services" as defined.
The UK Cyber Security and Resilience Bill (CSRB), introduced November 2025 with Royal Assent expected late 2026, expands the existing NIS Regulations 2018. Key SaaS implications: it introduces "Relevant Managed Service Provider" (RMSP) as a new regulated category capturing many UK SaaS providers; clarifies the definition of "cloud computing service" in ways that bring more SaaS in scope; imposes 24-hour early warning and 72-hour full report incident notification; and introduces two-tier penalties up to £17m or 4% of global turnover for serious breaches. UK SaaS companies should assess whether their services fall in scope during 2026 and update their cyber insurance and incident response capability accordingly.
Indirectly, yes. NIS2 and DORA are EU regulations that don't apply directly to UK-only operations, but they apply to UK SaaS companies serving EU customers in scope. Practically, the effect is through contractual flow-through: EU customers regulated under NIS2 or DORA must contractually impose corresponding obligations on their UK SaaS suppliers. UK fintech and regtech SaaS serving EU financial services clients have been required to include DORA-specific clauses in contracts since January 2025. The UK CSRB also draws heavily from NIS2 principles, meaning operational capability built for NIS2 compliance largely supports CSRB compliance too.
No — regulatory fines (including ICO fines under UK GDPR) are uninsurable as a matter of UK public policy. Your insurance cannot pay a £17.5 million ICO fine or any other regulatory penalty. However, the related and consequential costs are often insurable: defence costs in the ICO investigation, data breach notification costs to affected individuals, legal fees, forensic investigation, public relations management, and any related civil claims from data subjects or contractual partners. A well-drafted cyber policy covers these significant cost categories — the fine itself is the only specifically uninsurable element.
"Uncapped liability" means the contract imposes no overall ceiling on the supplier's financial liability to the client. If your contract has no cap and a claim arises, your exposure is limited only by what a court would award — potentially many times the contract value. Most PI and Tech E&O policies include "contractual liability" exclusions that limit cover to liabilities that would arise even without the specific contract terms. Uncapped liability is the clearest example of liability that exceeds what insurance was designed to cover. Best practice: negotiate a reasonable cap (often calibrated to fees paid in the preceding 12 months), confirm your insurer responds to the specific contract terms, and treat any residual uncapped exposure as direct business risk.
It should, but standard PI and Tech E&O wordings drafted before commercial generative AI sometimes exclude or restrict AI-related claims. Confirm in writing that your policy covers: model output errors and hallucinations; training data IP infringement; output IP infringement; bias and discrimination claims; prompt injection and AI-specific attacks; and EU AI Act compliance matters. The strongest current placements include specific AI endorsements; specialist Lloyd's market products are emerging that specifically address GenAI risk. Documentation of your AI governance (model cards, training data provenance, output review, bias testing) is increasingly a policy condition or rating factor.
Generally yes. The most common cause of disputed SaaS claims is where one insurer (PI) argues the claim should be paid by another insurer (cyber), and vice versa — particularly for software failures involving data exposure, or cyber incidents with software-error elements. Placing both covers with one insurer (or using a combined Tech E&O + Cyber wording) eliminates this boundary. The premium difference between combined and split placement is often modest; the claim handling advantage is significant. Where you must use separate insurers, confirm in writing how the boundary is handled and request that the wordings explicitly reference each other.
If you want to win and keep the contract, yes. Enterprise procurement teams calibrate insurance requirements to the contract value, indemnification scope, and downstream loss potential. Failing to meet them blocks the contract. Practical approach: review insurance clauses early in negotiation, before commercial terms are agreed. Your broker can typically arrange or extend cover to meet specific requirements at a premium cost that you can factor into pricing. The worst outcome is signing an MSA committing to insurance you don't have, only to discover at renewal that the market won't write the required cover at acceptable cost. Build the broker review into the procurement process.
Indicative 2026 pricing for compliant SaaS cover:
- Pre-revenue / early-stage: £600–£1,800 per year (Tech E&O/PI £1m + cyber £250k–£1m + standard EL/PL)
- £500k–£2m ARR with SME customers: £1,800–£4,500 per year
- £2m–£10m ARR with mid-market customers: £4,500–£12,000 per year
- Scaling enterprise SaaS: £15,000–£40,000+ per year
- Regulated sector SaaS (fintech, healthtech, critical infrastructure): £20,000–£75,000+ specialist placement
- AI-native SaaS at scale: emerging specialist market — typical placements £25,000+
Largest cost drivers: customer profile (SME vs enterprise vs regulated), data sensitivity, regulatory scope, ARR, limits selected, and claims history.
Yes — and many UK SaaS companies discover this only at claim stage. Standard UK PI, Tech E&O, and cyber policies exclude the US and Canada territorial scope because of the very different litigation environment, jury awards, and class action mechanism. Even a small percentage of US/Canadian customers can create catastrophic uninsured exposure if a claim arises in those jurisdictions. The US/Canada territorial extension is typically available at additional premium (often 50-100% loading on the underlying premium) but is much less than the cost of an uninsured US claim. Arrange at inception, not retrospectively.
"Standard tech insurance" is a marketing category covering everything from IT consultancies to hardware manufacturers to software development houses. SaaS sits within this but has specific characteristics: continuous service availability obligations, simultaneous multi-customer exposure to defects, recurring revenue dynamics, cloud infrastructure dependencies, and enterprise procurement requirements that other tech businesses face less acutely. The best UK SaaS placements use wordings specifically scoped to SaaS rather than generic "tech" wordings — including dependency cover for cloud providers, SLA breach response, and modern data processing exposures.
Related guides from Miller & Partner
Related specialist cover
Other technology businesses we insure
Software firms rarely fit a standard tech policy. These are the neighbouring sectors we place most.
- AI consultancy insurancePI and tech E&O for firms advising on or building AI systems.
- Game development business insurancePI, IP and cyber cover for game studios.
- Robotics startup insuranceProduct liability, PI and testing cover for robotics firms.
- Esports and gaming insuranceCover for esports teams, events and gaming professionals.
Instagram
LinkedIn