Your product shipped, the client's team adopted it, and everything ran clean for three months. Then one Tuesday afternoon, the recommendation engine surfaced the wrong data to the wrong workflow, and a client's AP team authorized a payment it shouldn't have.
Nobody caught it for a week. By then, $240,000 had moved.
The client's general counsel sent a letter. It didn't go to the engineering lead. It went to the CEO and named the company directly.
That's a Tech E&O claim. And if you're building software or AI products without professional liability coverage, that letter lands with no answer behind it.
What Tech E&O actually is
Professional liability for technology companies goes by several names: Tech E&O, technology errors and omissions, tech professional liability. They're all pointing at the same coverage.
At its core, it responds when your work product causes a client financial harm. That harm doesn't have to involve a dramatic system failure. It's often quieter than that. A bug that misfires in a production environment. An integration that drops records during a migration. An AI model that returns confidently wrong outputs a client relied on. An API that goes down during a window your SLA promised uptime.
The claim isn't always a lawsuit. Sometimes it's a contract dispute. Sometimes it's a deduction from an invoice. But when the number gets big enough, it becomes a coverage question, and that's when the policy matters.
A standard general liability policy won't cover this. GL is designed for physical harm and property damage. "Your software told our finance team to process a fraudulent vendor payment" isn't a GL claim. Without Tech E&O, that exposure sits directly on the company and, in many cases, on the founders personally.
The AI layer makes this more complicated
Traditional software E&O was relatively straightforward. A developer wrote code. The code had a bug. The bug caused a problem. There was a clear chain of causation and a clear defendant.
AI products scramble that chain.
When a language model hallucinates a citation, misidentifies a face, or routes an autonomous task to the wrong action, the harm may be real but the causation gets murky. The model isn't deterministic. The same input can produce different outputs. The training data contributed to the error, but the training data came from somewhere else. The customer used the output in a context the developer didn't anticipate.
Carriers are actively working through how this maps to existing policy language. And the short answer is: it doesn't map cleanly. Tech E&O written in 2019 wasn't designed with LLM hallucinations in mind.
What that means practically: if you're building AI products, the policy language matters more than the premium. A generic tech E&O form from five years ago may have exclusions or definitions that don't respond to AI-related claims the way you'd expect. You need a broker reviewing the actual form, not just quoting the price.
A few specific scenarios worth understanding:
- **AI output errors.** Your model returns a result the client acts on and it's wrong. Depending on the policy, this may fall under professional services if the AI is considered part of a professional deliverable, or it may be carved out entirely.
- **Autonomous actions.** If your AI agent takes an action (sends an email, executes a transaction, routes a request) that causes harm, the question is whether that action was authorized and foreseeable. Policies vary on how they treat autonomous versus human-directed acts.
- **Data used to train the model.** If a client's proprietary data ends up in your training pipeline and surfaces in outputs to other clients, that's potentially a confidentiality breach and a Tech E&O claim wrapped together.
- **SLA failures.** Missed uptime commitments are frequently the first trigger for a professional liability demand. Enterprise contracts often specify liquidated damages for SLA breaches. Tech E&O can respond to those demands depending on the policy structure.
Who's asking for it and when
Two distinct pressure points push startups toward Tech E&O: enterprise clients and investors.
Enterprise clients increasingly require it as a condition of signing. A Fortune 500 procurement team reviewing a SaaS contract wants to see certificates of insurance before the contract goes to legal. The typical ask is $1 million to $2 million per occurrence for GL plus E&O, sometimes higher if you're touching sensitive data, financial systems, or healthcare workflows. Without coverage, you can't sign the contract. That's a closed deal.
Investors started requiring it more consistently at the Series A stage and sometimes earlier. If you're taking institutional money, the term sheet or closing conditions may specify coverage requirements. D&O gets more attention in the VC world, but E&O shows up too, especially for companies building in regulated industries.
There's a third trigger that's newer: AI-specific indemnification clauses. Enterprise customers who've been burned by LLM output errors are adding indemnification language to their vendor agreements. They want to know you've got coverage standing behind your product if an AI output causes their business harm. Tech E&O is the answer to that clause.
What it costs for an early-stage startup
Tech E&O premiums vary based on what you're building, your revenue, and your client risk profile.
For a pre-revenue or early-stage company building general software or SaaS tools, a $1 million per occurrence / $2 million aggregate Tech E&O policy typically runs $2,000 to $5,000 per year in Illinois. That's roughly what a developer earns in a week. It's not a significant budget item at any real revenue level.
For AI companies, the range shifts higher. Carriers are still pricing the risk, which means underwriting scrutiny is elevated and premiums reflect that uncertainty. A $1 million / $2 million policy for a company building AI applications or agents typically runs $3,500 to $8,000 per year depending on the use case. Companies in fintech, health tech, or legal tech pay more because the consequences of errors are larger and plaintiffs have more recoverable damages.
A few things that affect pricing:
- **Revenue.** Premiums scale with revenue. A startup at $500K ARR pays less than one at $5M ARR for equivalent limits.
- **Industry.** Healthcare, finance, and legal are rated higher than generic productivity software.
- **AI vs. deterministic software.** More carriers are starting to ask specifically whether a product uses generative AI. Some add an AI endorsement, require additional information, or decline to write it at all.
- **Claims history.** A company with a prior claim pays more. A company with no prior history and documented QA processes pays less.
How it interacts with cyber insurance
Tech E&O and cyber insurance are often sold together, and they're frequently confused.
Cyber insurance responds to your first-party losses from a data breach or network intrusion: forensics, notification costs, regulatory defense, ransom negotiation. It's what protects your company when your systems get hit.
Tech E&O responds to third-party claims that your product caused a client financial harm. It's what protects your company when a client comes after you.
Most policies bundle them. A technology E&O package from carriers writing this space in Illinois includes both in a single policy, often with a shared aggregate limit. That structure works for most startups. Where it can create problems is when a single event triggers both: a breach that also disrupts the client's operations and generates an E&O claim. The shared limit erodes from two directions at once.
If your company is scaling and you're taking on larger enterprise clients, splitting into separate policies with separate limits is worth discussing with your broker. It's more expensive. It's also the structure that doesn't leave you choosing between your own breach response costs and defending an E&O claim against a major client at the same time.
The claims that actually happen
Most Tech E&O claims don't start as lawsuits. They start as a notice of claim, a demand letter, or a contract dispute.
A SaaS client whose platform went down during a critical period sends a letter claiming the outage cost them $80,000 in lost sales and violated the SLA. A data integration company's pipeline duplicates records during a system migration, and the client's operations team spends four days cleaning up the mess. An AI document review tool misclassifies a filing deadline, and the client's legal team misses a window.
None of those clients necessarily file a lawsuit on day one. But they send a letter. And that letter triggers the policy.
Defense costs, which can run $15,000 to $50,000 just to get to a settlement conversation with a business client, are covered from the moment a claim is reported. That's the part most founders miss. The insurance isn't just for judgments. It's for the cost of not having to decide on day one whether to pay $30,000 to a client rather than defend it. With coverage, that call goes to the carrier. Without it, it goes to your operating account.
What to check before you buy
A few things to review when you're evaluating Tech E&O policies for a software or AI company:
- **Does the definition of "professional services" include your AI outputs?** If the policy uses a narrow definition tied to traditional consulting or coding services, AI-generated outputs may not be covered.
- **Is there an AI exclusion?** Some carriers are adding exclusions for losses arising from AI-generated outputs. Others are adding AI endorsements that specifically bring this coverage in. Know what you have before you bind.
- **What's the retroactive date?** Tech E&O is claims-made coverage. The policy in force when the claim is reported responds, but only if the incident happened after the retroactive date. A policy with a short retroactive date leaves gaps.
- **Does the policy include media and IP coverage?** Some Tech E&O forms include coverage for copyright infringement and defamation arising from your product's outputs. For AI companies generating text or images, this matters more than it used to.
- **What are the sublimits on dependent system failures?** If a third-party API or cloud provider outage cascades into a client-facing disruption, some policies cap what they'll pay for dependent systems failures. Check it.
The right policy for a startup building a productivity tool and the right policy for a startup running autonomous AI agents in a client's operations are different products, and the difference isn't always visible from the premium.
If you're a founder in Illinois building software or AI products and want to understand what coverage makes sense for your specific situation, a licensed commercial producer at an independent brokerage in the RateShield trusted network can help. Call (773) 850-3801.