FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
An enterprise insurance requirement is a contract or onboarding condition setting the type, limit and wording of cover an IT supplier must hold. Misreading one can cost a contract, or leave you in breach once signed.
Part of: IT and technology business insurance
In short
When a bank, NHS body, government department or large corporate asks for £5m or £10m of PI or cyber, read the clause before buying anything. Check the type of cover, whether the limit is any one claim or aggregate, how long it must be maintained and what evidence is wanted. Many requirements can be met with an excess layer or a project-specific arrangement, and many can be negotiated. In UK public procurement, authorities usually cannot insist you hold contract insurance before award, but can require a commitment to have it in place when the contract starts.
A high limit in a tender or vendor due diligence questionnaire is a starting position, not always a fixed rule. You have three broad options: meet it (often by adding an excess layer above your existing policy), meet it for this contract only (project-specific or contract-specific cover where available), or negotiate it down to a figure that reflects the actual liability under the contract. Many IT suppliers in the £10m to £50m band use a mix of all three across their client base. The general picture is in insurance requirements in IT and technology contracts.
Requirements are often drafted from a template and can be loose. Before you change your insurance, pin down what is actually being asked.
| Wording you see | What it usually means | What to ask or check |
|---|---|---|
| £10m professional indemnity "each and every claim" | The full limit must be available for every claim, not shared across the year | Your policy may be aggregate. Ask whether aggregate is acceptable or buy reinstatement |
| "Cyber insurance of not less than £5m" | Often undefined: could mean first-party, third-party or both | Confirm which sections they care about, usually network security and privacy liability |
| Maintain cover for six years after expiry | PI is claims made, so cover must continue after the contract ends | Plan for renewal or run-off at the required limit |
| Client named as additional insured or indemnity to principals | Common for liability covers, rarely standard for PI | Check what the policy allows before agreeing |
| Copy of the policy wording | Client wants to review terms, not just limits | A PI certificate or broker letter is often accepted instead |
If your current policy does not match, see when a contract PI requirement doesn't match your policy.
Public sector requirements follow government guidance, which gives suppliers some useful ground.
Frameworks add their own requirements; see PI requirements for G-Cloud and public sector frameworks.
Ask procurement or the client's risk team why the figure was chosen. Offer a limit that matches the liability cap you are agreeing, or an aggregate limit in place of each and every claim. Large buyers often have a deviation process for suppliers that cannot meet a template requirement.
An excess layer above your primary tech PI or cyber can lift the limit for all clients. Excess layers usually follow the primary wording, so any gaps carry up. See primary vs excess layer PI and excess layers for tech PI and cyber.
Vendor due diligence questionnaires from banks, insurers and large corporates now commonly include insurance questions next to security controls: limits, insurer, renewal date, claims in the last five years and whether ransomware is covered. Answer from the schedule, not from memory, and keep a copy. What you tell a client should match what you told your insurer at renewal.
For one large contract, single-project PI or a contract-specific excess may be possible, though availability for IT work varies by market.
These are illustrative scenarios only; outcomes depend on the client and the policy terms.
A £20m software supplier is asked by a bank's vendor risk team for £10m cyber and £10m PI each and every claim. Its programme is £5m combined aggregate. It negotiates acceptance of an aggregate limit and adds a £5m excess layer, giving £10m in total.
An IT services firm bidding for a trust contract sees a £5m PI requirement. It submits an insurer's letter confirming cover would be offered, with a commitment to take it out on award, in line with the government guidance.
A FTSE-listed retailer sends its standard master services agreement to a £35m managed services provider. It asks for £10m PI, £10m cyber, £10m public liability and the retailer named as an additional insured on every policy. The supplier's broker confirms the public liability can carry an indemnity to principals, explains that PI and cyber are not normally written that way, and the retailer accepts confirmation of the limits and an indemnity to principals clause on liability only.
Apex helps IT suppliers meet enterprise and public sector insurance requirements; a broker reads every enquiry.
Generally not for insurance relating to the contract. Government guidance on the Procurement Act 2023 says authorities are prohibited from requiring contract insurance before award, but can require a commitment that you will have it on contract commencement, evidenced by certificates or an insurer's letter. Legally required cover such as employers' liability can still be required.
Often, yes. Many requirements come from templates. Clients frequently accept a limit that matches the agreed liability cap, an aggregate limit instead of each and every claim, or a broker letter instead of a full wording. Raise it before signing, with a clear explanation of what you hold and why it fits the contract.
Usually an excess layer above your existing primary policy, which can often be arranged mid-term subject to underwriting. Underwriters will want your primary wording, claims history and details of the contract driving the requirement. Timescales vary, so it helps to raise it as soon as the requirement appears.
Many will. A certificate or broker letter confirming insurer, limit, period and key terms is commonly accepted. Some banks and regulated firms ask for wording extracts on points such as cyber exclusions, jurisdiction and aggregation. Policy wordings are often confidential, so ask before sharing the full document.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
