Technology advisers

Professional indemnity insurance for software consultants

Yes. If clients pay you for a view on software, such as which system to buy, whether an architecture will scale, what a target company’s code is like or whether its licences are in order, you need professional indemnity insurance. Your product is advice, and when it is wrong the loss is financial: a purchase that fails, a price overpaid for a business, a back-licensing bill. Public liability does not respond to that. PI, usually written for technology firms as errors and omissions cover, does.

Part of: Professional indemnity for IT professionals

In short

Software consultants sell judgement, not code, and claims follow when a client acts on that judgement and loses money. Typical allegations are that a selection missed a key requirement, an architecture review overlooked a scaling limit, technical due diligence failed to spot a copyleft licence, or a licence opinion fell apart in a publisher’s audit. PI pays defence costs and compensation for negligent advice, subject to the policy terms, and many wordings also cover breach of confidence. Under the Unfair Contract Terms Act 1977, a business-to-business cap on negligence liability must be reasonable, and the court considers how far you could have insured. Transaction and public procurement work each add exposure.

Start your PI proposal →or call 0117 325 0027 to speak to a broker

Why advice about software is a PI risk

Last reviewed 5 October 2026 by the Apex professional indemnity team.

Most software consultants never touch a client’s live systems. You run selection exercises, review architectures, assess code and licensing for buyers and investors, and write technology roadmaps. The client then commits money on the strength of what you said: a multi-year subscription, an implementation programme, an acquisition price.

That makes the risk professional rather than physical. Public liability (PL) insurance answers claims for accidental injury and damage to property, which a report almost never causes. When advice proves wrong, the complaint is that you did not use the care and skill expected of a competent software adviser, and the loss is the money the client wasted or overpaid. Professional indemnity (PI) is the policy written for that allegation.

Advisory work also travels. A due diligence report can reach a buyer’s lenders and co-investors, and a selection report a board or funder. Anyone your terms allow to rely on the work can become a claimant, so scope and reliance wording matter as much as the advice itself.

How claims arise in software consultancy

The scenarios below are illustrative, written for this page rather than drawn from real claims. Outcomes would depend on the facts and the contract.

A requirement nobody captured. A membership body asks you to run the selection for a new CRM and events platform. Your workshops never establish that renewals are invoiced in several currencies, which the product you rank first cannot handle without bespoke development. The client claims the extra build cost and a year of manual workarounds, alleging your requirements capture fell below a competent standard.
A partner relationship disclosed too late. You evaluate bids for a council’s housing management system. After award it emerges that you receive referral fees from the winning bidder’s implementation partner. The council has to rerun the evaluation and claims the cost of doing so, and of the delay, from you.
An architecture review that trusted the brochure. Before a funding round, an online retailer asks whether its platform will cope with three times its current order volume. Relying on published benchmarks rather than the client’s own workload, your report says it will after minor tuning. Peak season brings repeated outages, and the client claims lost sales and the cost of re-platforming early.
Due diligence that missed a licence. A private equity buyer commissions technical due diligence on a software company. Your report does not flag that a component inside the product the target ships to customers is licensed under version 3 of the GNU General Public License. After completion the buyer pays to re-engineer that part and claims it would have negotiated a lower price. The lender that received your report under a reliance letter joins the claim.
A licence opinion tested by an audit. A manufacturer asks whether its database licences cover a move to virtual servers, and you confirm they do. The publisher’s audit finds a shortfall, the client pays a settlement and then pursues you. The dispute turns on how much of that bill it would have paid anyway had it been correctly advised.

None involves injury or damage. Each alleges that someone entitled to rely on your work lost money through negligent advice.

The law and standards your advice is measured against

Claims against advisers are argued from the engagement letter outwards: what you agreed to do, what you relied on, and what a competent consultant would have done.

Reference point	What it says	Why it matters to you
Your engagement letter or statement of work	Scope, assumptions, who may rely and any liability cap.	The first document a claimant reads. Advice outside the written scope is the hardest to defend.
Unfair Contract Terms Act 1977, ss.2(2) and 11	Liability for negligence causing death or injury cannot be excluded; for other loss, a restricting term must satisfy the requirement of reasonableness. For a cap at a specified sum, the court considers the resources you could expect to have and how far you could have insured. Whoever relies on the term must show it is reasonable.	A cap far below the size of the decision you influenced, or below the cover you could have bought, is easier to attack.
Copyright, Designs and Patents Act 1988, ss.3, 16 and 17	A computer program is a literary work. Copying includes storing a work in any medium by electronic means and making transient copies, and doing or authorising a restricted act without the owner’s licence infringes copyright.	Under-licensing is an infringement problem, not only a commercial one, which is why clients act on your licence opinions.
GNU General Public License, version 3	Covered works can be run privately without conditions, but conveying them in object code form means also conveying the corresponding source.	In due diligence, how the target distributes its product decides whether a copyleft component is harmless or a serious finding.
ISO/IEC 25010:2023	A product quality model of nine characteristics, intended for uses including defining requirements, identifying testing objectives and setting acceptance criteria.	A shared vocabulary for selection scoring and review criteria. Saying you evaluated against it invites comparison.
ISO/IEC/IEEE 42010:2022	Requirements for architecture descriptions, including viewpoints and model kinds. It does not prescribe methods or tools.	A useful structure for an architecture review, and a benchmark if you say you follow it.
Procurement Act 2023, ss.81 and 82	In force since 24 February 2025. Authorities must take all reasonable steps to identify and keep conflicts of interest under review, and anyone who influences a decision for an authority is treated as acting in the procurement. A supplier given an unfair advantage that cannot be avoided must be excluded.	Your vendor relationships become the authority’s conflict, and a rerun procurement can become your claim.

Technical due diligence: who can rely on your report

Technical due diligence (TDD) is where a software consultant’s liability can outgrow the fee fastest. The report is written in days, from a data room and a few management sessions, and helps price a business worth many times what you billed. Five habits shape how a TDD claim plays out.

Name everyone who may rely. Buyers often ask for reliance to extend to lenders, co-investors or a new acquisition vehicle. If you agree, use a reliance letter under which all of them share one overall cap, not a cap each.
Put the limits of the review in the report. Say whether you saw the whole code base or a sample, whether you ran your own scans or relied on the target’s, and who you could not interview.
Separate findings from estimates. Technical debt, rewrite effort and scaling headroom are judgements. Label them as estimates and record the assumptions behind them.
Check the distribution model before rating licence risk. The same open-source component can be minor inside a hosted service and serious inside software shipped to customers.
Expect claims after completion. Problems tend to surface when the buyer integrates the business or prepares to sell it on.

Tell your insurer you do transaction work and how much. A business description reading only “IT consultancy” is a weak foundation when the claimant is a fund and its bank.

What PI covers for software consultants, and what it doesn’t

Usually covered by PI	Often excluded or limited	Needs a different policy
Negligent selection, architecture and roadmap advice	Promises of an outcome, such as a guaranteed saving or go-live date	A ransomware attack on your own systems (cyber)
Errors in due diligence reports, where transaction work is declared	Reliance granted to extra parties without telling the insurer	Injury or damage at a client’s premises (public liability)
Licence compliance opinions that prove wrong	Licence fees the client would have owed anyway	Claims against you as a non-executive director of a portfolio company (D&O)
Breach of confidence and unintentional IP infringement, on many wordings	Fines and penalties, which wordings commonly exclude	Injury to your own staff (employers’ liability)
Defence costs, including independent expert reports	Dishonest acts, such as a conflict you knowingly concealed	Loss or theft of your own laptops and equipment (office or equipment cover)

Cover is subject to the insurer’s acceptance and the wording. If the policy calls you a developer but most of your income is advisory, have the business description corrected before you need it.

Data rooms, source code and findings: where PI and cyber meet

Advisers hold sensitive material: data room logins, source code, scan results and lists of a target’s security weaknesses. If it escapes, two separate losses follow, and they belong to different policies.

Your own response is a cyber matter. Forensic investigation, restoring your systems, notification advice and income lost while you recover are cyber insurance costs.
The client’s claim against you is usually a PI matter. If a target’s weaknesses or a buyer’s plans leak through you, the allegation is breach of confidence or negligence, which many technology PI wordings cover.
Security advice that misses something sits in PI. If your review called a design sound and an attacker later uses the gap you overlooked, the client, or its cyber insurer trying to recover what it paid out, will look to your PI, subject to the wording.

Read the two policies together. A PI exclusion for anything connected with a cyber event, combined with a cyber exclusion for professional services, can leave an advisory firm with neither policy answering the claim.

How much cover, and for how long

The limit is normally set by the client’s contract or procurement rules; no regulator fixes it. Size it by the decision you influence, not your fee: a two-week review behind an acquisition or a multi-year platform commitment can produce a claim far larger than anything you invoiced.

Line up your cap and your limit. Agree a liability cap you can defend as reasonable and hold PI at least equal to it. Section 11(4) of the 1977 Act makes the availability of insurance part of that test.
Watch how reliance multiplies claims. If several parties can rely on one report, an aggregate limit may have to stretch across all their claims.
Keep cover after the engagement. PI is claims-made, so the policy in force when the claim arrives is the one that answers it. Selection and due diligence advice is often tested years later, so keep cover continuous, protect your retroactive date when you move insurer and arrange run-off if you retire or sell.

If an engagement asks for more cover than you carry, see raising your PI limit for a contract.

What insurers will ask you

A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:

How your fees split between software selection, architecture reviews, technical due diligence, licence compliance work and any hands-on delivery.
For transaction work: how many reports you produce a year, typical deal values, who commissions them and whether you issue reliance letters.
Your standard engagement terms, including liability caps, exclusions of indirect loss and how a cap applies when several parties rely on one report.
Any referral fees, commissions, reseller agreements or partner status with software vendors, and how you disclose them to clients.
Whether you advise public bodies on procurements, and how you record and declare conflicts of interest.
Whether associates or specialist subcontractors, such as code reviewers, work for you, and whether they hold their own PI.
How you protect data room credentials, client source code and assessment findings, including multi-factor authentication.
Your claims and circumstances history, including any engagement that ended in a fee dispute.

Speak to a broker

PI for software consultants, placed by a named broker

Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.

Start your PI proposal →or call 0117 325 0027

How Apex places this cover

Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.

A short fact-find. We ask what you actually do, for whom, under what contract terms, and what has gone wrong before.
A written presentation to insurers. Under the Insurance Act 2015 you must make a fair presentation of the risk. We help you meet that duty, and a well-presented risk gets better terms.
Quotes you can compare. Limits, excesses, retroactive dates, exclusions and premium side by side, with a plain-English recommendation.
No gap in cover. If you are moving from another insurer or broker, the new policy starts before the old one ends and protects your past work.

Related guides

Sources

Frequently asked

Do software consultants need professional indemnity insurance?

Yes, if clients act on your advice about software. A selection report, architecture review, due diligence report or licence opinion can lead to a large financial loss if it is wrong, and public liability won’t pay for that. PI covers defence costs and compensation when your advice is alleged to be negligent, subject to the policy terms.

Is PI a legal requirement for software consultants?

No UK law requires software consultants to hold PI, and no licensing body governs the work. In practice clients make it a condition of the engagement: corporate buyers, investors commissioning due diligence and public sector procurements usually set a minimum limit in the contract or tender documents.

Can I cap my liability in my engagement letter?

Usually, yes. In a business contract, a cap on liability for negligence must satisfy the reasonableness test in the Unfair Contract Terms Act 1977, and for a fixed sum the court considers your resources and whether you could have insured. A cap set well below your PI limit, or below the value at stake, is easier to challenge.

Does PI cover a due diligence report that a lender relies on?

It can, if transaction work is declared and the wording does not exclude liability you took on by contract beyond your normal duty. Tell your insurer before you sign a reliance letter, and make every relying party share one cap so a single report cannot produce several full-value claims.

Am I liable if a client fails a licence audit after my advice?

Possibly, if your opinion was negligent and the client relied on it. A client can usually recover only the loss your advice caused, not the licences it needed anyway, so disputes often centre on the difference. Record the deployment facts your opinion relied on.

Do I need cyber insurance if I only give advice?

Usually, yes. Advisers hold data room access, source code and lists of security weaknesses. Cyber insurance usually pays your own response costs if your systems are compromised, such as forensics and restoring data. A client’s claim that its confidential information leaked through you is normally a PI matter, so the two policies work together.

Ready to compare cover?

Apex arranges professional indemnity insurance for software consultants across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.

Start your PI proposal Call 0117 325 0027

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.