IR35 and professional indemnity insurance are separate questions that tend to arrive at an IT contractor's desk in the same week. IR35 is about tax, decided under HMRC rules, and turns on the reality of the working relationship between contractor, intermediary and end client. Professional indemnity insurance is about civil liability, and turns on which entity is legally on the hook when professional work goes wrong. The two subjects sit in different legal filing cabinets but meet at the contract: contract structure drives IR35 status and, in parallel, drives which policy responds when a client complains.
This guide sets out the intersection in plain terms: what off-payroll working means under Chapter 8 and Chapter 10 of ITEPA 2003, how inside-IR35 and outside-IR35 arrangements differ in their contract chain, and where those differences push through into professional indemnity cover for the contractor's personal service company (PSC). It is insurance content, not tax advice — any IR35 determination or SDS challenge needs to go through a tax specialist.
IR35 is the shorthand for the off-payroll working rules, which sit in two chapters of Part 2 of the Income Tax (Earnings and Pensions) Act 2003.
Chapter 8 is the original 1999 legislation. It puts the burden of assessing employment status on the worker's own intermediary — usually a PSC. If the engagement would have looked like employment had the PSC not existed, the PSC accounts for a deemed employment payment with PAYE and NI on top.
Chapter 10 is the reformed regime — public sector from 6 April 2017, private and voluntary sectors from 6 April 2021. The end client (not the PSC) decides whether the engagement is inside or outside the rules and issues a status determination statement (SDS) to the worker and any agency in the chain. If inside IR35, the fee-payer — typically the agency closest to the PSC — deducts PAYE and employee NI from the PSC's fees and pays employer NI on top.
Chapter 10 does not apply to every private-sector engagement. Small clients outside the public sector fall back on Chapter 8, leaving the status question with the PSC. A private-sector client is small if it fails the Companies Act 2006 medium-sized criteria — broadly, it does not exceed at least two of three thresholds for two consecutive financial years. For financial years beginning before 6 April 2025 those thresholds were turnover above £10.2 million, balance sheet total above £5.1 million, and more than 50 employees. For financial years beginning on or after 6 April 2025 the turnover and balance sheet thresholds have risen to more than £15 million and more than £7.5 million respectively; the 50-employee limit is unchanged. HMRC's Employment Status Manual (ESM10006 and ESM10006a) sets out the arithmetic.
IR35 status decides how an engagement is taxed. It does not change the fact that the contractor has agreed to deliver professional work with reasonable care and skill. A professional indemnity policy responds to that duty — it picks up defence costs and civil liability if a client alleges the work was defective, late, or caused financial loss.
The link is indirect but real. Both are driven by the same underlying contract chain. Change the chain and both the tax position and the insurance response change with it. An SDS, a statement of work and a PI schedule of insurance need to be read together.
An inside-IR35 engagement under Chapter 10 sits in a chain that usually runs end client, agency, PSC, contractor. The end client makes the status determination. The agency (or another fee-payer) becomes the deemed employer and deducts PAYE and employee NI at source. Employer NI is a cost carried by the fee-payer, not the PSC.
The contractor still owns the PSC and the PSC is still party to the contract for services. The tax treatment changes; the civil liability position does not. If the end client says a deliverable is defective, the contract will still point at the PSC (or, in some agency models, at the agency) as responsible. Whichever entity carries that obligation needs an insurance policy behind it.
An outside-IR35 engagement is a genuine business-to-business relationship. The PSC bills the client (directly or through an agency) on a gross basis, accounts for corporation tax on profits, and pays the contractor by salary or dividend. There is no deemed employer in the chain because there is no deemed employment.
The PSC carries full civil responsibility for the professional work. If code fails in production, a migration corrupts data, or a delivered design infringes third-party IP, the client's remedy is against the PSC. PI cover held by the PSC — with a limit matching the contract requirement and a retroactive date reaching back to the earliest work capable of producing a claim — funds defence and settlement.
Inside-IR35 status does not remove the need for the PSC to think about professional indemnity. Three points repay attention.
First, read the contract. Some inside-IR35 arrangements state that PI will be held by the end client, some rely on the agency's group policy, and some require the PSC to hold its own limit regardless of status. There is no default rule.
Second, retroactive date discipline still matters. A PSC trading for several years is likely to have exposure to claims from earlier engagements. That exposure sits with the PSC regardless of how the current engagement is taxed. Cancelling the PSC's own PI on the basis that "the agency covers me now" leaves prior work exposed and can create a gap no future policy will backdate.
Third, the tail. Professional claims can arrive months or years after an engagement ends. If the PSC has been relying on the end client's or the agency's policy during the engagement, it needs to know whether that reliance survives the contract or whether the PSC's own policy is expected to pick up the tail.
An outside-IR35 PSC runs an insurance profile familiar to any small IT consultancy. Contract templates for typical banking, insurance, or public sector work specify a PI limit — often £1 million to £5 million any one claim, occasionally higher on framework agreements — and require evidence in the form of a broker's certificate.
Retroactive date needs to be preserved across engagement changes. When an outside-IR35 contractor renews with the same insurer, the retroactive date should carry forward; when they move to a new insurer, the incoming policy should honour the original retroactive date if the run of cover has been unbroken.
Aggregation matters more the more engagements a contractor takes on. A PSC that has worked on five projects for four different clients over a policy year has five potential claim sources and one policy limit. How the policy aggregates decides how much cover is left after the first notification.
Direct engagement (client to PSC). Simplest chain. The PSC's own PI policy responds. Contract usually specifies limit, retroactive date, and evidence obligations.
Through agency (client to agency to PSC). Two contracts — client-to-agency, agency-to-PSC. The PSC needs to know which governs the PI requirement and whether the agency imposes its own PI condition on top. Agency contracts often require the PSC to hold a limit even where the end client would have been comfortable relying on the agency's cover.
Statement of Work. An SoW contracts for a defined deliverable rather than a resource. Genuine SoW arrangements are more likely to sit outside IR35 because they resemble outsourced project delivery. The SoW itself usually specifies the PI cover, and the PSC's policy needs to match.
Umbrella company inside IR35. An umbrella arrangement is not, strictly, a PSC engagement — the contractor becomes an umbrella employee, and HMRC notes the off-payroll rules are unlikely to apply. The umbrella's EL and PI arrangements usually respond to work done under its employment. Contractors who have moved from PSC to umbrella still need to think about run-off cover for the PSC's earlier work.
A status determination statement is a tax document — it records the client's view on whether the off-payroll rules apply, with reasons. It is not written for an insurer. But it is a written record about the nature of the engagement — direction and control, mutuality of obligation, substitution — and a PI insurer investigating a claim years later can read it as evidence about how the parties saw the relationship. Keep SDS documents on file with the engagement paperwork.
The 2022 attempt to repeal the 2017 and 2021 reforms was reversed within weeks. Chapter 10 remains in force in both public and private sectors. Clients and agencies have grown more sophisticated on SDS drafting; blanket determinations are rarer than in 2021. The updated small-company thresholds that took effect for financial years beginning on or after 6 April 2025 pushed some private-sector clients back out of Chapter 10 scope.
For PI insurance the material change is less about IR35 itself and more about the tightening of the professional indemnity market for technology risks. Insurers ask more searching questions about subcontracting, offshore development and use of third-party libraries than they did in 2021.
PI responds to civil claims for financial loss caused by professional error. Typical triggers in an IT engagement include the following.
Failed software project. A deliverable does not do what the specification required. The client incurs rework, delayed launch, or replacement cost. The claim is against the party who contracted to deliver.
Data loss during migration. Records lost, corrupted, or wrongly transformed. PI usually responds; a separate cyber policy may respond in parallel if a security incident is involved.
Cyber breach traced to contractor code. A vulnerability introduced by a delivered artefact is exploited. Third-party losses and regulatory costs may follow, and coordination between PI and cyber policies matters.
IP infringement in delivered artefacts. A library or lifted code triggers a takedown or licence claim. PI wordings differ on IP — some cover it fully, some exclude, some sub-limit.
IR35 status challenge. Not a PI matter on any standard wording. HMRC pursues the deemed employer (or, under Chapter 8, the PSC) for tax owed — that is a tax and legal issue, not professional negligence.
Apex Insurance Brokers is an FCA-authorised general insurance intermediary specialising in professional indemnity for professions and small-business clients, including IT contractors trading through PSCs. Matt Bartlett is the named director and holds SMF3, SMF16 and SMF17 approvals.
The broker places contractor PI across a panel of UK-authorised insurers, reads the underlying contract chain before recommending a limit, and takes particular care over retroactive date discipline and aggregation wording. Where an inside-IR35 engagement pushes cover onto the agency's group policy, Apex will help the contractor understand what that leaves uncovered and what a standalone PSC policy needs to sit alongside it.
Do IT contractors inside IR35 still need PI insurance? Usually yes. Being inside IR35 changes how the engagement is taxed; it does not extinguish the PSC's civil liability for defective work, and it does not remove tail exposure from prior engagements. Whether a standalone PSC policy is needed alongside any agency or client cover depends on the contract.
How is PI cover different for inside-IR35 versus outside-IR35? Cover mechanics are the same — a PI policy responds to civil claims for professional error. What differs is the contract chain. Outside-IR35 engagements typically put the whole PI requirement on the PSC. Inside-IR35 engagements may route part or all of the requirement through agency or client policies, so the PSC needs to check what is left for its own policy to do.
Whose PI responds when I work through an agency? Whichever policy the contract chain points at. Some agency arrangements have the agency's policy respond; others require the PSC to hold its own limit as a contractual condition. There is no default — read the contract and any statement of work.
Does IR35 status determination affect my PI cover? Not directly. An SDS is a tax document, not an insurance document. But it is a written record about the nature of the engagement, and an insurer investigating a claim may read it as evidence about how the parties saw the relationship.
What PI limit does a typical IT contractor need? Contract-driven. Contractual requirements in UK IT engagements typically range from £1 million to £5 million any one claim, with higher limits on framework agreements. The right limit is the higher of the contract requirement and the exposure the contractor believes their work can create.
Do I need run-off PI when I stop contracting? Yes, if there is any risk a claim could arrive after the PSC stops trading. Run-off keeps the policy responsive to notifications after the last engagement ends, typically for six years. Cancelling PI on the day the last invoice goes out leaves prior work exposed.
Sector context sits in The ultimate UK IT professionals PI guide 2026. For the wider consultant position, see PI insurance for consultants. On how policies stack up claims from the same root cause, see aggregation clauses by regulator. The consumer versus commercial distinction is set out in consumer versus commercial PI insurance. If an insurer has left the market mid-cycle, see insurer exits: what to do.
Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Firm reference number 724952.