CL380 — Institute Cyber Attack Exclusion Clause

Category: Policy exclusions · Reviewed by the Apex broking team · Last reviewed 2026-08-22 · ~4 min read

What CL380 is

CL380 is a standard-form clause published as one of the Institute clauses, the family of London market wordings whose copyright is now held by the International Underwriting Association of London. It was issued on 10 November 2003 — hence the “10/11/03” that always accompanies it — and it is one of the earliest market-wide responses to cyber risk in conventional, non-cyber classes. It is short: two numbered paragraphs and a disclaimer.

What the two limbs say

1.1 provides that, subject only to clause 1.2, “in no case shall this insurance cover loss damage liability or expense directly or indirectly caused by or contributed to by or arising from the use or operation, as a means for inflicting harm, of any computer, computer system, computer software programme, malicious code, computer virus or process or any other electronic system.”

1.2 provides that where the clause is endorsed on policies covering risks of war, civil war, revolution, rebellion, insurrection or civil strife arising therefrom, or any hostile act by or against a belligerent power, or terrorism or any person acting from a political motive, clause 1.1 “shall not operate to exclude losses (which would otherwise be covered) arising from the use of any computer, computer system or computer software programme or any other electronic system in the launch and/or guidance system and/or firing mechanism of any weapon or missile.”

The four words that do the work

Everything turns on “as a means for inflicting harm”. CL380 is not a general electronics or IT-failure exclusion. It is aimed at the malicious, hostile use of computing — a cyber attack — not at loss caused because a system went wrong. A cargo lost because a navigation system failed through ordinary malfunction is not obviously within the clause; a cargo lost because a vessel’s systems were deliberately compromised is. The distinction is fine, and it is the reason the clause has attracted so much commentary: it was drafted before ransomware and supply-chain attacks were the dominant loss forms, and it does not use the vocabulary the market now uses.

Where it is used

CL380 appears most often in marine hull, cargo and related energy and specie placements, endorsed onto the underlying cover. It is also seen far outside marine, applied to property and other classes as an off-the-shelf answer to non-affirmative cyber exposure — sometimes without much thought about whether a clause written for marine risks fits. Where it is used, it sits alongside rather than inside the underlying wording, so it can override write-backs elsewhere in the policy. See marine insurance and marine cargo all risks for how the underlying covers are built.

Its practical limits

Three limitations recur. Its breadth is uncertain in exactly the scenarios that now dominate cyber loss, because “as a means for inflicting harm” requires a finding about intent that may be impossible to make on the available facts. Its interaction with the newer state-backed cyber and cyber-operation exclusions is not always coherent, since a policy can carry both. And it excludes without any write-back for the ordinary, affirmative cyber cover a buyer may believe they have elsewhere in the programme — which is why the London market has since produced more granular clauses that exclude and then write back specified perils rather than excluding wholesale.

What a buyer should do about it

Identify whether CL380 is endorsed on any policy in the programme, and on which classes. If it is, establish what the cyber tower covers and whether there is a genuine gap between the two — a marine or property loss caused by a cyber attack may be excluded in one place and not picked up in the other. Where CL380 has been applied to a non-marine class, ask whether a more modern clause with defined write-backs is available. And read it against the war exclusion, since limb 1.2 exists precisely to stop the two clauses cancelling each other out on war and terrorism business.

Frequently asked questions

Does CL380 exclude all computer-related losses?

No. Limb 1.1 excludes loss caused by the use or operation of a computer or electronic system “as a means for inflicting harm”. Losses caused by ordinary malfunction or error, without hostile intent, are not the target of the clause, although the boundary can be difficult to establish on the facts.

Why does CL380 have a carve-back for weapons systems?

Because it is endorsed onto war and terrorism policies as well as ordinary ones. Without limb 1.2, the exclusion would strip out the guided-weapon losses those policies are bought to cover, since modern weapons rely on computerised launch, guidance and firing systems.

Is CL380 only for marine policies?

It originates in the Institute clauses used in marine and cargo, but it is frequently endorsed onto property and other classes as a general cyber exclusion. Whether that is appropriate depends on the class and on what the buyer’s cyber policy covers.

Related entries

• War exclusion
• Marine insurance
• Marine cargo all risks
• Cyber exclusion in PI
• Marine Insurance Act 1906

This entry is part of the Apex Insurance Wiki. Last reviewed 2026-08-22. Next review: 2027-02-22. It is general insurance information, not legal advice, and it describes UK market practice and law as at August 2026.

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority (FRN 724952). This page is general information, not advice on a specific policy.