While working in InsurTech, I overheard a founder confidently tell a prospective client, “we’ll take on the E&O.” Downstream E&O exposure remains a much-discussed and unsettled issue as AI deployments spread across insurance, finance and accounting, law, architecture and engineering, and the other classic professional services industries that E&O has traditionally covered.
That broad assumption of risk is common as AI-driven tech companies scale. Growth goals and confidence in the product overshadow the question that matters: does a software company’s typical insurance cover a professional services liability it took on in a customer contract?
At its simplest, E&O (or MPL) covers professional negligence — in insurance parlance, loss because of a wrongful act in the rendering of, or failure to render, professional services. Technology E&O covers claims alleging the failure of a particular technology product or technology service. The two rest on different foundations. Professional services turn on knowledge, experience, acumen, and judgment. Technology turns on whether the product does what it was sold to do, usually availability and functionality.
A software vendor’s cyber/tech E&O almost certainly does not capture classic professional services exposure. Take an AI contract-review vendor and an accounting firm customer. The MSA has the vendor indemnify the firm against claims arising from use of the platform’s outputs. The tool misreads a lease term, and an associate passes the error to a client without scrutiny, as the firm’s own work. The client sues the firm for negligence. The firm tenders the claim to the vendor under the indemnity, and the vendor tenders it to its tech E&O carrier.
That is the typical AI professional judgment error: a hallucination or other incorrect information, then a failure to review it before submitting it as the professional’s own work product. The claim alleges a lapse in the firm’s judgment, not a failure of the product to function, which puts it outside the prototypical tech E&O claim.
The contractual liability exclusion finishes the analysis. Nearly every commercial policy precludes coverage for liability the insured assumes in a contract, often with a carve-back for liability the insured would have had without the agreement. The vendor would have none. A technology seller owes no duty of care to the firm’s client, has no privity with the client, and has no relationship that gives the client standing to bring a professional negligence claim against it. The only path from the client’s loss to the vendor’s balance sheet runs through the indemnity the founder offered, and that is the liability the exclusion removes.
The analysis changes when the product stops being an input to professional judgment and becomes the infrastructure the customer runs on. CDK and CrowdStrike both had product failures that rippled through their customer bases and the insurance markets, one from a cyberattack and the other from an apparent simple error. Those losses showed up as cyber dependent business interruption claims and potentially as tech E&O exposure for the vendors. That is a different risk from the one above, and I’ll take it up next.
As the risk transfer market matures and develops appetite for AI-driven risks, risk management has to sit inside the organizations that sell and use the technology, ahead of the contract instead of after the claim.