Professional liability for software vendors and SaaS: what it covers (and the exclusions to negotiate)

Professional liability insurance for a software vendor or SaaS company covers the losses your clients suffer because of a coding error, a faulty update, downtime or a data loss attributable to your service: damages owed to the client and defence costs, up to the limit purchased. Unless negotiated, it does not cover the SLA penalties you accepted by contract, refunds of your subscriptions, redoing your own work for free, or fines from the data protection authority. The whole game therefore lies in the list of exclusions and in what you manage to buy back.

What exactly does a software vendor's professional liability policy cover?

Professional liability (RC Pro in France, close to tech E&O elsewhere) is the policy that pays the financial consequences of a fault, error, omission or delay committed in the course of your business and causing loss to a third party, usually your client. For a vendor: a billing bug that costs a client revenue, a migration that corrupts a database, an unavailable API that halts a manufacturer.

"IT professions" liability policies generally cover breach of contract and professional negligence, disclosure of confidential information, infringement of intellectual property rights (patents excluded by some insurers), liability for delivered products and defence costs. They often add general liability and worldwide cover, with the United States and Canada excluded by default.

Pure financial loss is the key notion: a financial loss suffered by your client with no prior physical damage, for instance the production hours lost during an outage of your platform. It is the typical SaaS claim, and the cover whose limit deserves the most attention.

What is the difference between professional liability and cyber insurance for a SaaS company?

Professional liability pays what you owe others because of your error. Cyber insurance first pays your own costs when you are attacked: forensics, restoration, notification to the regulator, business interruption. Professional liability alone leaves a vendor uncovered for its own costs after a ransomware attack; cyber alone leaves it uncovered against the client suing over a bug. This boundary is detailed in our article on liability for coding errors.

Which exclusions should you spot before signing?

Every professional liability policy excludes intentional fault, fines and financial penalties, and losses you agreed to cover beyond what general law requires. That last point, worded as "disproportionate commitments" or "aggravated contractual liability", hurts vendors most: every client contract signed with unlimited liability, a guaranteed outcome or automatic penalties creates an exposure the insurer never agreed to carry.

An SLA (Service Level Agreement) is the contractual commitment on availability or response time you make to a client, backed by penalties or credits if you miss it. Because these sums are owed even without proven fault, most insurers exclude them as "contractual debt". Some agree to buy them back, with a sub-limit and provided your SLAs are reasonable. Our article on making SLAs compatible with insurance details how to draft the clause.

Your professional liability policy will never cover more than what your client contracts reasonably promised: every unlimited commitment signed to win a deal is a coverage gap you dig yourself.

How does cover work over time (claims-made basis)?

Almost all vendor liability policies are written on a claims-made basis: it is the client's claim received during the policy period that triggers cover, not the date of the bug. Article L124-5 of the French Insurance Code governs this mechanism and imposes an extended reporting period of at least five years after termination. Two consequences. Retroactive cover: when switching insurers, check that the new policy covers acts committed before its inception, otherwise your past deliveries are insured by nobody. Notification of circumstances: a known incident not yet claimed must be declared to the current insurer, failing which the next one will exclude it as a "known fact".

What limit and what premium for a SaaS vendor in 2026?

The limit should be reasoned from your contracts, not your turnover: the right level is the one your largest clients require, often €1 million to €5 million to sell to mid-sized and large corporates. Check whether it applies per claim or per policy year: an annual limit exhausted by an incident in March covers nothing in November.

These ranges correspond to a rate of roughly 0.1 to 0.3% of turnover for a vendor with no claims history; they rise with sensitive data processed, North American exposure, generative AI and past claims.

What do the product liability directive and the AI Act change for your policy?

European directive 2024/2853 on liability for defective products will apply to products placed on the market from 9 December 2026 and explicitly classifies software, including AI systems and updates, as products. A vendor may be held strictly liable for damage caused by a defect in its software, with presumptions that make the victim's case easier. According to the French Ministry of Justice's answer of 12 May 2026, no transposition bill had yet been tabled. Check that your policy includes "product liability" cover without excluding damage caused by software.

On the AI Act, the digital omnibus adopted by the European Parliament on 16 June 2026 and by the Council on 29 June postpones the obligations for Annex III high-risk systems to 2 December 2027, but keeps the Article 50 transparency obligations at 2 August 2026. For insurance, the question is simpler: does your policy say anything about AI? Silence is ambiguous, an exclusion is a gap, an explicit extension is what to aim for.

Frequently asked questions

Is professional liability insurance mandatory for a software vendor?

No, no law requires it of software vendors or SaaS companies, unlike regulated professions. In practice, it is demanded by almost all large-account contracts and tenders, with a minimum limit.

Does my policy cover a bug that costs my client money?

Yes, that is the core of the "pure financial loss" cover, provided liability is established and the loss does not fall under an exclusion (automatic penalties, guaranteed outcome). Its limit is sometimes lower than the overall limit.

What happens if I switch liability insurers?

The new policy must provide retroactive cover for acts prior to its inception, and the old one remains bound by the statutory extended reporting period of at least five years. Declare any known incident to the outgoing insurer before termination.

Do I need a specific policy to use generative AI in my product?

Not necessarily, but your policy must address it. Ask the insurer to confirm in writing that damage caused by an erroneous output of your model is covered like a coding error, and document your safeguards.

At Lesto, we read your client contracts and SLAs before approaching the market, so that your professional liability policy matches what you actually promised: buy-back of contractual penalties, AI extension, per-claim limit, retroactive cover. We consult nine insurers on average and deliver our analysis within 72 hours. Are you a software vendor or SaaS company? Discover our dedicated support for SaaS and tech companies and request your analysis.