FCA authorised · FRN 724952 0117 325 0027Quote & buy →
IT integration
Yes. If you connect several vendors’ systems so that they work as one, you need professional indemnity insurance, because you are often the only party contracted to make the joins work. When an interface drops orders, a mapping corrupts data or an integration fails at cutover, the client’s loss is financial, which public liability does not cover. PI covers claims that your design, build or running of the integration was negligent, including work you subcontracted, subject to the policy terms.
Part of: Professional indemnity for IT professionals
In short
Systems integrators carry the risk in the spaces between other people’s products. Each vendor may be able to show its own system worked as documented, which leaves the integrator answering for the interface. As prime contractor you are usually liable to the client for your subcontractors, and for personal data UK GDPR Article 28(4) keeps an initial processor fully liable to the controller for a sub-processor’s obligations. Back-to-back subcontracts narrow that gap but rarely close it. The Civil Liability (Contribution) Act 1978 lets you seek a share from others liable for the same damage. PI answers negligence claims; cyber covers attacks on the integration layer you run.
Last reviewed 5 October 2026 by the Apex professional indemnity team.
An integrator’s job is to make separately bought systems behave as one: an online shop talking to a warehouse system, a CRM feeding finance, identity flowing to every application. You design the integration architecture, specify each interface, build or configure the middleware, run end-to-end testing and manage cutover. Often you also lead the other suppliers as prime contractor.
The client’s exposure sits in the joins. When data moves wrongly or stops moving, orders are lost, customers are billed twice or operations halt, and the loss is financial. Public liability (PL) insurance responds to injury and property damage, so it does not help. The allegation is that you designed, built or ran the integration without reasonable care and skill, and professional indemnity (PI), which technology insurers write as errors and omissions cover, is the policy for it.
The scenarios that follow are illustrative only; none describes a real claim. Each names the failure, the party that lost money and the allegation.
None of these involves a single faulty product. Each concerns the design, running or supervision of the connections between products, which is the integrator’s professional territory.
Integration disputes are decided mainly by contracts, because several sets of terms meet at every interface.
| Reference point | What it says | Why it matters to you |
|---|---|---|
| Your head contract with the client | Your scope, the interfaces you own, acceptance, the liability cap and which vendor answers for what. | If it does not say who owns each interface, expect the client to argue that you do. |
| Your subcontracts | The obligations you pass down to specialist suppliers: scope, standards, caps, insurance, data protection and claims procedure. | Every mismatch with the head contract is risk you keep. |
| UK GDPR, Article 28(2) and (4) | A processor needs the controller’s prior written authorisation to engage another processor, must impose the same data protection obligations on it by contract, and remains fully liable to the controller for that processor’s performance. | If a subcontractor handles personal data, its failure is yours to answer. |
| Civil Liability (Contribution) Act 1978, ss.1 and 2 | A person liable for damage can recover contribution from anyone else liable for the same damage, whether the liability arises in tort, contract or otherwise. The court sets an amount that is just and equitable having regard to each party’s responsibility. | When a client sues you alone over a multi-vendor failure, this is how you seek a share from the others. |
| Contracts (Rights of Third Parties) Act 1999, s.1 | A non-party can enforce a term if the contract expressly allows it, or if the term purports to benefit them and the parties did not intend otherwise. They must be identified in the contract. | Subcontracts often exclude the Act, so the client usually has no contractual route to your subcontractors and comes to you. |
| ISO/IEC/IEEE 15288:2023 | A common framework of system life cycle processes for acquirers and suppliers, applicable to systems of systems, without prescribing a particular life cycle model. | A recognised reference for what disciplined integration and verification look like. |
Each vendor’s contract describes its own product. The interface between two products is often described in nobody’s contract except yours, so close the gap on paper before it opens in production.
Where a client buys products directly and asks you only to connect them, say so in the contract and list the vendor obligations you are relying on.
As prime contractor you normally answer to the client for the whole delivery, including subcontracted work. Back-to-back terms pass the same obligations down the chain, but they rarely pass down all of the risk. Look for these leaks:
Tell your insurer how much work you subcontract. PI usually covers your liability for work done on your behalf where it is declared, and your insurer may later try to recover its outlay from the subcontractor.
| Usually covered by PI | Often excluded or limited | Needs a different policy |
|---|---|---|
| Negligent integration design, mapping and interface specification | Liquidated damages and service credits | An attack on your own integration platform or network (cyber) |
| Your liability for subcontractors’ work, where declared | Liability accepted by contract beyond what the law would impose, such as uncapped indemnities | Faulty hardware you resold (product liability) |
| Negligent cutover, end-to-end testing and go-live advice | Defects in third-party products themselves | Injury or damage at client sites (public liability) |
| Negligent running of a managed integration service | Regulatory fines and penalties, commonly excluded | Claims by your employees for injury (employers’ liability) |
| Defence costs, including independent experts | Circumstances known before the policy began | Dishonesty by your employees that costs a client money (crime or fidelity cover) |
Cover is subject to the policy terms and the insurer’s acceptance. If you resell hardware or licences, declare it: claims about a product’s own defects usually fall outside PI.
The integration layer attracts attackers because it holds the service accounts and API keys that reach into every connected system. That shapes how PI and cyber fit together.
If one shared platform serves many clients, ask how each policy groups claims with a common cause. One incident can produce many claims against a single limit.
Your PI limit is usually set by the head contract and should sit at or above the liability cap you agree, bearing in mind that on some policies defence costs count towards the limit. When you subcontract, decide what limit each subcontractor must carry and check it before work starts. Read the clause for whether the limit applies to each and every claim or in the aggregate.
Integration defects can stay hidden until a year-end reconciliation or an audit. In England and Wales, a negligence claim for latent damage can be brought within six years of the cause of action accruing or, if later, three years from when the claimant first had the knowledge needed to sue, subject to a 15-year longstop from the negligent act or omission. PI is claims-made, so keep cover continuous, protect your retroactive date and arrange run-off cover if you sell or close the business.
A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:
Speak to a broker
PI for systems integrators, placed by a named broker
Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.
Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.
Yes. Clients rely on you to make separately bought systems work together, and a faulty interface, mapping or cutover can stop orders, corrupt data or halt operations. Those losses are financial, so public liability won’t cover them. PI pays defence costs and compensation when your integration work is alleged to be negligent, subject to the policy terms.
No UK law requires systems integrators to hold PI. In practice clients and public sector buyers make it a contract condition with a minimum limit, and if you work under another prime contractor, its head contract terms are usually passed down to you. Check the insurance clause before you sign.
Usually, as far as the client is concerned. As prime contractor you answer for the delivery, then seek recovery from the subcontractor under your subcontract. For personal data, UK GDPR Article 28(4) keeps you fully liable to the controller for a sub-processor’s obligations. PI generally covers liability for subcontracted work if you declare it.
Back-to-back means passing your head contract obligations down to subcontractors on matching terms. Where they don’t match, such as a lower cap or a shorter claims period, you carry the difference. PI covers your negligence liability, not extra obligations you accepted, so align terms and check subcontractors’ PI.
Possibly. The Civil Liability (Contribution) Act 1978 lets a person liable for damage recover contribution from anyone else liable for the same damage, in a share the court finds just and equitable. Recovery is not guaranteed, so define each party’s responsibilities in the head contract and keep records of vendor failures.
It can, if the downtime resulted from negligence in design, testing or operation and the client sues for the money it lost, subject to the policy terms. Service credits and liquidated damages are usually excluded. If the downtime was caused by an attack on a platform you run, your cyber policy also comes into play.
Apex arranges professional indemnity insurance for systems integrators across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.
Start your PI proposal Call 0117 325 0027Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.
