FCA authorised · FRN 724952 0117 325 0027Quote & buy →
IT and telecoms
Yes: if you run a client’s IT estate or service desk under a service level agreement, you need professional indemnity insurance. The claims that hurt facilities management firms are about service failures, not accidents: a critical patch never applied, a change that took a client offline, a backup nobody checked. Public liability does not answer those allegations. PI, often written as technology errors and omissions cover, usually does, and cyber insurance usually picks up the incident costs when an attacker is involved.
Part of: Professional indemnity for IT professionals
In short
IT facilities management (FM) firms operate systems they do not own, under contracts that measure them against service levels, change control and patching deadlines. When a missed update, a failed change or a service desk mistake costs a client money, the claim is for negligence or breach of contract, which is what PI is for. Cyber insurance sits beside it, paying for your own incident response and, on many wordings, claims that follow a security failure. PI usually won’t pay service credits. The government’s model framework insurance schedule asks for PI to be kept for at least six years after a contract ends.
Last reviewed 5 October 2026 by the Apex professional indemnity team.
An IT facilities management contract puts you in charge of infrastructure you do not own. You run the client’s servers, network, devices and service desk, often on its premises and sometimes with its former IT staff transferred to you, and you are measured every month on response, resolution, availability and patching.
When that goes wrong, the loss is rarely a broken window or an injured visitor, which is what public liability (PL) insurance is for. It is downtime, lost data, an attacker getting in through a gap you were paid to close, or a regulator asking your client why personal data was exposed. Those are financial losses caused by the way you delivered a professional service, and they belong with professional indemnity (PI).
For IT firms, PI is usually written as technology errors and omissions cover. It pays compensation and defence costs when you are alleged to have been negligent, or to have fallen short of the service standard in your contract, subject to the policy terms.
The scenarios below are illustrative. They show the kinds of allegation FM providers face; they are not real claims or outcomes.
Each one is a complaint about the standard of service, not physical damage. That is the line between a PL claim and a PI claim.
When a client says you fell short, the argument is about what you promised and what a competent provider would have done. These reference points come up most.
| Reference point | What it says | Why it matters to your PI |
|---|---|---|
| Your service schedule and SLA | Response and resolution times, availability targets, patch windows, change approval and service credits. | The first document a claimant reads. What you promised defines a breach. |
| ISO/IEC 20000-1:2018 | The international standard for a service management system, covering the planning, design, transition, delivery and improvement of services. | If you are certified, or say you work to it, your incident and change processes will be compared with it. |
| Cyber Essentials requirements v3.3 (NCSC, April 2026) | Critical or high-risk updates, including fixes for vulnerabilities scoring 7 or above on CVSS v3, must be installed within 14 days of release. Client-owned accounts that a managed service provider uses to run the infrastructure are in scope. | Your patching and admin practices become part of your client’s certification. A slip can cost it the certificate. |
| UK GDPR, Articles 28, 32 and 33 | A processor must follow the controller’s documented instructions, keep data secure and report a personal data breach to the controller without undue delay. The controller must report a notifiable breach to the ICO within 72 hours of becoming aware of it. | Late notice from you eats into your client’s 72 hours and becomes part of its complaint. |
| Cyber Security and Resilience (Network and Information Systems) Bill | Would bring medium and large managed service providers, including outsourcing, helpdesk and infrastructure management, under the Information Commission, with incident notification within 24 hours, a fuller report within 72 hours and notice to affected customers. | Not yet law: it was at House of Lords report stage in September 2026. Unless you are a small or micro business, plan as though it will apply. |
| Usually covered by PI | Often excluded or limited | Needs a different policy |
|---|---|---|
| Negligent operation of client systems: failed changes, missed patches, misconfiguration | Service credits, liquidated damages and contractual penalties | Incident response, data restoration and lost income after an attack on your own systems (cyber) |
| Service desk errors, such as changes made to the wrong account | Indemnities and uncapped liabilities beyond what the law would impose | Injury or property damage at client sites (public liability) |
| Breach of contract claims for missing the agreed service standard, where the wording includes them | Fee disputes and the cost of putting right your own work | Client equipment held at your workshop (goods in trust or a PL extension) |
| Loss of client data or documents in your care, sometimes sub-limited | Fines and penalties, where the law does not allow them to be insured | Injury to your own staff (employers’ liability) |
| Defence costs, including forensic and technical experts | Faults in hardware or licences you resold rather than advised on | Liability for products you supply (product liability) |
| Claims after a security failure in your service, where PI and cyber wordings fit together | Circumstances you knew about before the policy started | Funds stolen through social engineering (crime or a cyber extension) |
Cover is always subject to the insurer’s acceptance and the policy terms. If the definition of your professional business mentions advice and support but not operating, changing and monitoring client systems, the core of your FM work may sit outside it.
Service credits are a reduction in your charges, agreed in advance, when you miss a service level. Because they are a price adjustment you signed up to, rather than compensation the law would make you pay, PI policies usually exclude them.
A serious failure can therefore cost you twice: the credits, and a damages claim for the client’s actual loss. PI is built for the second. Check these points before you sign or renew:
None of this means refusing service credits. Price them as a business cost and keep your PI for the claims it was designed to meet.
Your remote monitoring and management platform, admin accounts and service desk tools reach into every client you support. Your own security is part of each client’s risk, so PI and cyber insurance have to be read side by side.
Gaps appear at the join. If an attacker steals credentials for your management platform and pushes ransomware to ten clients, you need cyber cover for your own response and a liability section, PI or cyber, that answers ten claims. Some PI wordings exclude anything arising from a cyber event; some cyber wordings exclude complaints about your professional services. Ask for both to be tested against that scenario, or consider a combined technology PI and cyber policy from one insurer.
Check how claims with a common cause are grouped, because that decides how far one limit stretches. Expect insurers to ask whether admin and remote access uses multi-factor authentication. Cyber Essentials already requires MFA for authentication to cloud services, so a gap here is hard to explain after an incident.
Your PI limit is normally driven by your largest contract, not your turnover. Outsourcing agreements set a minimum PI limit in the insurance clause, and it should sit sensibly alongside the liability cap you agreed. If the client wants the limit on an each and every claim basis, an aggregate policy at the same figure may not comply.
Public sector work has its own pattern. Joint Schedule 3, the government’s model insurance schedule for framework contracts, asks for PI, where the framework requires it, to be maintained for at least six years after the contract’s end date.
Duration matters because PI is a claims-made policy: the policy in force when a claim is made responds, not the one in force when the work was done. FM problems often surface after handover, when the incoming provider finds undocumented configurations or a backup regime that never worked. Keep cover continuous, protect your retroactive date when you change insurer, and if you sell or close the business, arrange run-off cover for the period your contracts specify. If a new contract asks for more than you hold, see when a contract requires a higher PI limit.
A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:
Speak to a broker
PI for IT facilities management companies, placed by a named broker
Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.
Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.
Yes, if you operate, support or change client systems. The losses that follow a missed patch, a failed change or a service desk error are financial, and public liability usually won’t pay them. PI, often called technology errors and omissions cover, responds to allegations that your service fell below the required standard, subject to the policy terms.
No UK law requires it. In practice outsourcing contracts and public sector frameworks make PI a condition of the work, usually with a minimum limit. The government’s model framework insurance schedule asks for PI to be kept for at least six years after the contract ends.
Usually not. Service credits are a price reduction you agreed to in the contract, and most PI wordings exclude them along with liquidated damages and penalties. PI is designed for a client’s claim for its actual loss, such as lost revenue or recovery costs, when you are alleged to have been negligent.
Often, yes. An insurer that pays its own policyholder can pursue whoever it says caused the loss, and an allegation that your patching or change control was negligent is a PI claim, subject to the terms. Tell your insurer at once and don’t admit liability.
It can. Many policies treat claims with the same cause as one claim, and an aggregate limit is shared by every claim in the policy year. If your tools reach many clients, consider an each and every claim limit or a higher limit, and check how the cyber policy groups claims too.
Usually your PI covers your liability for work done on your behalf, if you declared the arrangement. Insurers will ask where the work is done and whether subcontractors hold their own PI. If part of your service desk runs outside the UK, check the policy’s territorial limits.
Apex arranges professional indemnity insurance for IT facilities management companies across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.
Start your PI proposal Call 0117 325 0027Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.
