My last piece covered technology vendors assuming their customers’ professional liability exposure via contract, and why the vendor’s tech E&O is unlikely to respond. Here, I will discuss the tech E&O exposure that embedded solutions create, and why neither vendors nor their customers have a clear view of it. Contracts, premiums, and limits all scale with revenue, while the actual loss scales with how much of the customer’s business runs on the product.
Many technology solutions frame their value proposition in terms of operational efficiency, embedding into the buyer’s operations to handle tasks and functions that employees or middle and back offices previously performed. The use case is clear and the ROI is immediate: before, you paid $X; with us, you pay $Y.
Technology now operates on an interconnected sequence of assets, compiled downstream into a digital supply chain, and a modern technology company typically sits in the middle of it. Upstream, a growth-stage software company typically runs on a single cloud region (e.g., AWS or Azure), calls a foundation model through an API, authenticates through one third-party identity provider, takes payments through another, and builds the product relying in part on open source libraries and AI-generated code. Each is a single point of failure for the company’s own product. Downstream, its customers embed that product into core operational functions, often replacing or significantly reducing the headcount previously associated with them. The vendor sits in a precarious position as both a dependent and a dependency.
An event or outage higher in the supply chain creates multiple risks at once. A cloud provider failure creates the vendor’s own first-party business interruption loss, assuming proper wording in its cyber program. Further downstream, the same failure becomes a claim by every customer that could not operate, a typical tech E&O scenario. Oftentimes these coverages come as a package with a shared limit, but they respond to two very different exposures deriving from the same event. First-party business interruption pays the vendor’s lost revenue and the cost to restore systems and operations. Tech E&O pays a third party’s economic loss because of the product’s failure. In a single upstream outage, the vendor’s own loss and its customers’ claims draw down the same limit at the same time.
Embedding into a client’s operations also creates a divergence between the vendor’s growth and its risk management posture. Typically, premium and limit scale with revenue. The exposure, on the other hand, scales with how much of its customers’ operations the vendor carries, and an efficiency-driven value proposition captures that metric by design. Growth compounds the divergence. A vendor expanding within existing accounts takes on more of each customer’s operations with every added module. Contract value and the liability cap rise in step with fees, but the customer’s potential loss rises with reliance, and it jumps once the last manual fallback disappears. The largest accounts end up carrying the most reliance, and a single one can carry a potential loss that exceeds the vendor’s entire limit. Net new business spreads the exposure the other way, adding claimants to the same aggregate limit for the next upstream event. Revenue growth reads the same on an application either way. The risk does not.
CDK Global supplied software to more than 15,000 auto dealerships. Its systems went down on June 19, 2024, and most were not restored until July 3–4, with dealer-customers reverting to manual processes during the outage. Estimates of dealer losses ran to approximately $1b.
The CrowdStrike incident shows the same pattern at greater scale, and without an attacker: a defective content update from a cybersecurity vendor rendered approximately 8.5m Windows devices inoperable. Parametrix estimated direct losses to the Fortune 500, excluding Microsoft, at $5.4b, and expected cyber insurance to cover only 10 to 20 percent of it. In other words, the largest downstream users alone retained somewhere between $4.3b and $4.9b, through inadequate or absent coverage, deductibles, sublimits, and business interruption waiting periods. Modelers put the insured loss across all policyholders worldwide between $400m and $1.5b.
For a downstream buyer, the distinction that matters is between revenue stream (the customer’s payment to the vendor) and operational reliance (the customer’s potential business interruption loss and restoration costs). The vendor’s contract will usually cap liability at a revenue-related number, often the fees paid over the prior twelve months. Customers often take comfort in an insurance requirement: the MSA obligates the vendor to carry tech E&O and cyber at $5m, and a certificate confirms it. The requirement does not change what the vendor owes. The policy responds to damages the vendor is legally obligated to pay, and the same agreement caps that obligation and excludes consequential damages, which is precisely how a customer’s lost revenue during an outage would be characterized. The limit the customer verified is also shared with every other customer, and in a package form with the vendor’s own business interruption loss from the same event. Accordingly, the customer’s own program needs to carry the event under first-party cyber coverages, which vary considerably in this area.
The vendor’s program faces its own problem. Tech E&O largely functions in the aggregate. Related-claims provisions collapse multiple claimants into one claim against one limit, and defense costs often erode that limit as they are spent, even where the underlying claims remain unconsolidated. A contractual cap limits what each customer can recover. It does not limit what the vendor retains when thousands of capped claims arrive against one aggregate.
These issues call for careful consideration rather than a simple fix. The broader insurance market avoids correlation. Carriers price policies as independent risks, so exposures where one event affects thousands of insureds are traditionally difficult to insure. In the digital supply chain, the market has responded by limiting aggregation through waiting periods, narrower dependent business interruption definitions and sublimits, and widespread event definitions that cap aggregate exposure from systemic incidents. Those terms constrain the vendor’s recovery for its own upstream losses and its customers’ recovery for theirs. The vendor sold efficiency by removing its customers’ fallbacks, and in doing so made itself the point through which a single event reaches all of them. Expansion within accounts builds the severity, net new business builds the correlation, and the market’s response limits what pays for either.
AI concentrates every part of this. A small number of foundation models sit under thousands of products, so the concentration sits at the model layer and every product built on top inherits it. A vendor that embeds a model in a customer’s claims workflow depends on the model provider and is the dependency for its own customer, the same two positions with fewer providers to choose from. Carriers are working through this now. A few affirmative AI coverage grants have emerged, typically added onto existing cyber or E&O coverage. However, Beazley’s head of cyber said recently that liability from AI sold as a product may eventually need separate cover.
For technology sellers, the tech E&O question is what the company has promised operationally, to how many customers, against a single aggregate limit, and how the policy wording treats one event that reaches many claimants. For the firms buying the technology, the question is what the operation does when the vendor fails, what the vendor’s contract lets them recover, and what their own program pays in the meantime. Both can be answered before the event, and neither shows up on the vendor’s revenue line.
The AI conversation in professional services still centers on bad output: the hallucinated citation, the misread lease, the memo nobody reviewed. That is the claim E&O was built for, and it is also the claim carriers are now carving back out at renewal. The larger loss comes the day the platform stops working, and very little of the firm’s program was built for that either.