FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
An excess layer is additional tech PI or cyber cover that sits above a primary policy and pays once the limits below it are exhausted. For IT companies with enterprise contracts, the tower design decides what is really available after a bad year.
Part of: IT and technology business insurance
In short
IT companies with £10m to £50m turnover often need more limit than one primary policy provides, usually because enterprise contracts set high caps or data protection super caps. Excess layers sit above the primary, commonly on a following form basis, and pay once lower limits are used up. The key design choice is whether tech PI and cyber share one tower or have separate towers. Check that every layer follows form, that drop down and retroactive dates align, and that the total limit matches your highest caps with room for more than one claim.
An IT company buys excess layers when the limit it needs is more than a single insurer will comfortably write on a primary policy, or when spreading the limit across several insurers gives better terms. The primary policy pays first. Each excess layer sits above it and usually pays only once the layers below have paid or admitted their full limit.
For a business turning over £10m to £50m, the trigger is usually a contract rather than a theory. An enterprise or public sector client asks for a higher limit of indemnity, a super cap for data protection breaches, or evidence of cover that matches an uncapped indemnity. Working out the right total is covered in how much tech PI and cyber cover a mid-sized IT company needs; this page is about how the tower above the primary is built.
A tower is a stack of policies, each with its own limit and its own insurer or panel of insurers. The point at which a layer starts to pay is its attachment point. Excess policies are commonly written on a following form basis, meaning they adopt the terms of the primary policy unless they say otherwise.
| Term | What it means | What to check |
|---|---|---|
| Primary layer | The base policy that responds first, subject to the excess or deductible | Wording, sub-limits, defence costs basis, aggregate or each and every claim |
| Excess layer | Pays above the attachment point, up to its own limit | Whether it follows form fully or adds its own exclusions |
| Attachment point | The amount of loss below the layer, usually the limits beneath it | Whether the layer attaches excess of the primary limit or excess of a sub-limit |
| Drop down | Whether an excess layer moves down if an underlying aggregate is eroded | Excess wordings commonly drop down on erosion of an underlying aggregate, but usually not on the insolvency of an underlying insurer |
| Exhaustion | How underlying limits must be used up before the layer pays | Whether payment by the insured or a settlement below limit counts |
The mechanics are the same as in other professions; the general background is in primary vs excess layer professional indemnity and following form PI excess layers. What is different for IT companies is that technology errors and cyber events often arise from the same incident, so the tower has to be designed with both in mind.
Large clients negotiate liability caps by reference to contract value, a multiple of annual charges, or a fixed sum. Many also add a separate, higher cap for data protection or confidentiality breaches, often called a super cap. Some ask for an indemnity that sits outside the cap altogether. Each of these can push the limit you need above what a primary policy alone provides. The detail is in liability caps versus PI limits and data protection super caps in IT contracts.
There is also a legal reason insurance matters to caps. Under the Unfair Contract Terms Act 1977, section 11(4), where a party seeks to restrict liability to a specified sum, the court considering reasonableness must have regard to the resources it could expect to have to meet the liability and how far it was open to it to cover itself by insurance. Your insurance position can therefore become part of the argument about whether a cap is reasonable, which is one reason buyers ask to see it.
A sensible starting point: the tower should at least match the highest cap you have agreed, after allowing for the possibility that more than one claim arrives in the same policy year. Requirements from large customers are mapped in enterprise client insurance requirements for IT suppliers.
Many IT companies buy combined technology insurance, where tech PI and cyber sit in one policy. That can work well at primary level. Above it, there are two broad designs.
The excess layers sit above the combined primary and respond to either a tech PI or a cyber loss. It is simpler and avoids gaps between policies, but one large ransomware event can erode the limit that was meant to protect you against a contractual claim from a major client later in the year.
Tech PI and cyber each have their own excess layers. This protects each limit from the other, but needs careful wording so that an incident with both a cyber and a professional negligence element is not argued between towers. Whether limits are aggregate or each and every claim also matters; see aggregate versus each and every claim and defence costs inside or outside the limit.
Illustrative only. A managed services business has a combined primary with two shared excess layers above it. A ransomware attack on its own network causes outage for several clients and costs a large part of the primary aggregate in response costs and client claims. Later that year a separate client alleges a failed migration. Because the shared limit has been eroded, the excess layers may drop down to sit above what is left, subject to their wording, but the total available for the second claim is smaller than the board assumed. A separate tech PI tower would have kept that limit intact.
Excess insurers rely heavily on the primary underwriting, but they ask their own questions because their exposure is to the largest losses. Commonly they want:
Under the Insurance Act 2015, section 3 the duty of fair presentation is owed to each insurer, including excess insurers. If the primary presentation was thin, excess insurers can raise the same issues. The concentration point is covered in one to many aggregation risk for IT service providers.
For the wider picture, see insurance for mid-sized IT companies and our IT and technology business insurance hub.
Apex arranges tech PI, cyber and excess programmes for IT companies; a broker reads every enquiry.
An excess layer is a separate policy that sits above the primary policy and pays once the limits below it have been used up. It usually follows the terms of the primary policy, subject to its own wording. IT companies buy excess layers when contracts require a total limit higher than a single insurer will provide on one policy.
Yes, many IT companies use one shared tower above a combined primary. It is simpler, but a large cyber loss can erode the limit that would otherwise protect you against a later contract claim. Separate towers protect each limit but need careful wording for incidents involving both. The right design depends on your contracts and incident profile.
Not always. Excess policies are commonly written on a following form basis, but some add their own exclusions, conditions or definitions. Any difference can create a gap at the top of the tower. Ask your broker for a written comparison of each layer against the primary wording before you bind.
Start with your highest contractual caps and super caps, add a margin for more than one serious claim in a policy year, and consider defence costs and whether limits are aggregate. Then test the result against your largest clients and any US exposure. Your broker can model scenarios with you.
They rely on the primary underwriting but often ask more about the largest exposures: big contracts, uncapped indemnities, US revenue, concentration of clients on one platform, and incidents that did not become claims. The duty of fair presentation under the Insurance Act 2015 applies to each insurer in the tower.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
