Four Policies Before You Post: The Insurance Call UK Founders Keep Deferring

There is a particular email that lands about ten days before launch. It comes from a procurement portal, or a pilot partner's legal team, or a water company in the North West that wants to run your software in a depot. It asks for a certificate of professional indemnity at two million, a cyber policy at two million, confirmation of employers' liability, and a named contact for your broker. It gives you a deadline of Friday.

You have a Google Doc, a quote from August that has since expired, and the distinct feeling that the cheapest thing you could have done six weeks ago is now the most expensive thing you have to do in a hurry.

Insurance is not paperwork that happens after launch. It is the rehearsal that tells you what your launch actually looks like to everyone else — the pilot partner, the enterprise buyer, the regulator, and eventually the person on the other end of a claim. The cheapest policy is always the one arranged before anything went wrong, because the moment something has gone wrong, you are no longer buying cover. You are buying the right to have a conversation about prior knowledge.

The four policies you will actually be asked for

Professional indemnity

You sell advice, software, or a service that someone relies on. If your work causes a client a financial loss, this is the policy that responds. Almost every enterprise supplier questionnaire will ask for it, usually at one or two million, sometimes five.

The thing to understand is that most PI policies are claims-made. Cover is triggered by when the claim is made, not when the mistake happened. That means the retroactive date on your policy matters more than the headline limit. If your retroactive date is the day you bought the policy, anything you shipped before that day is naked. When you renew, check that the retroactive date has not quietly crept forward — insurers call this a fresh retro date, founders call it a nasty surprise in year three.

Cyber

Data breaches, ransomware, business interruption, the cost of notifying customers, the cost of a solicitor sitting next to you while you talk to the Information Commissioner's Office. Under UK GDPR you have 72 hours to report a breach that poses a risk to people's rights, and 72 hours is not a lot of time to find a broker's out-of-hours number.

Ask to see the incident response arrangements before you buy. Who answers at two in the morning? Is the legal panel included or is it a sub-limit? Does the policy cover social engineering, or system failure, or a subcontractor's mistake? The headline limit of two million often shrinks to something much smaller once the sub-limits are listed.

Product liability

If you ship anything physical — a device, a sensor, a battery, a kit — this is the one that covers a faulty batch. It is usually occurrence-based, which is the opposite of claims-made: the policy that was in force when the incident happened responds, even if the claim arrives two years later. That is good news, as long as you keep buying it.

Check the territorial limits and the exclusions. US and Canada are frequently carved out or sub-limited. If a contract manufacturer or a fulfilment partner is involved, confirm they are inside the definition of insured, or that their own cover is adequate.

Employers' liability

If you employ anyone — and yes, this includes a part-time operations lead, an apprentice, and potentially a director with a contract of employment — you are legally required to hold employers' liability cover of at least five million. The certificate needs to be available to staff and to inspectors. It is the least glamorous policy on the list and the only one where the legal requirement is not a negotiation.

The questions the broker will ask that you wish you had prepared for

Here is where the rehearsal pays for itself. When you apply, the broker will ask whether you are aware of any circumstance that might give rise to a claim. This is not a formality. Under the duty of fair presentation in the Insurance Act 2015, you have to tell the insurer everything a reasonable underwriter would want to know. If your beta has a known data leak and you buy cyber cover on Friday, you have a problem that no policy will fix.

Prior knowledge, near misses, a customer who has gone quiet after a complaint, a contractor who left with admin access — all of it goes on the form. Honesty here is not a virtue, it is a condition of the contract.

Then there is the notification clause. Most policies require you to tell the insurer as soon as you become aware of a circumstance that could lead to a claim, not when the claim actually arrives. Some require you to avoid admitting liability and to avoid settling without consent. Put a one-page incident card in your launch runbook: who calls the broker, who calls the client, who calls the ICO, in what order.

And read the conditions attached to the cover. Many cyber policies now require multi-factor authentication, patching, and tested backups. If you skip them, the insurer can reduce a claim — and a reduced claim at the worst possible moment is worse than no cover, because you have already paid for the false comfort.

A week-one rehearsal script

1. Ask a broker for a launch pack: PI, cyber, product liability and employers' liability, quoted at two limit levels so you can see the cost of the jump.
2. Ask for the policy wording, not the summary. Specifically the retroactive date, the notification clause, the exclusions, and the definition of a claim.
3. Match the limits to the contracts you are chasing. If a pilot partner wants two million, buy two million. Do not buy one and hope the contract gets lost in a shared drive.
4. Check the conditions you have to meet all year: MFA, patching, backups, training.
5. Diary the renewal date and the retroactive date together. They are the two dates that decide whether the policy is worth anything.

None of this is exciting. It is a couple of calls, a long form, and a slightly tedious conversation about exclusions. But it is the difference between launching and discovering, at the moment of maximum stress, that the cover you have is not the cover the contract asked for.

The cheapest policy is the one you bought before the fire. The most expensive is the one you never read.