Tech E&O insurance in Germany

Claims by customers or other third parties that your software, platform or IT service failed or was wrongly delivered and caused them a financial loss, for example an outage that stops a customer's business or a failed data migration. The insurer examines whether the claim is justified, defends against unjustified claims and pays justified ones, up to the sum insured. What exactly is covered depends on the wording: the named activities, the list of covered cases and the exclusions.

Not under that name. In Germany the cover sits in an IT liability policy (IT-Haftpflicht) or a professional liability policy for pure financial loss (Vermögensschadenhaftpflicht, VSH), usually next to a separate cyber policy. The name on the policy does not matter; the wording does. That is why a US clause has to be compared with the wording, line by line.

There is no general legal duty to hold it. It becomes mandatory in practice when a customer contract requires it, and large customers and US customers often do. In that case the contract names the type of cover, the limit and the proof you must show.

Usually not for pure financial loss from your own software and services. In the GDV model wording for general liability, the extension for pure financial loss excludes losses from your own products, work and services, and the data module excludes IT activities such as software development. General liability still matters for injury and property damage, so it works next to Tech E&O and does not replace it.

Tech E&O responds when your product or service fails a customer and the customer claims. Cyber insurance responds to a security incident: it usually pays your own costs, such as forensics, notification and business interruption, and in its third-party part the claims of the people affected. The two overlap when a software flaw leads to a breach, so read both wordings together. The GDV cyber model counts only claims raised in EEA states under EEA law.

That is the customer's decision. What usually matters is whether the policy meets each line of the clause: type of cover, limit, territory, US courts, trigger and the period after the policy ends. We compare the clause with your wording, ask insurers for written confirmation or an extension, and tell you where a gap remains. We cannot promise acceptance.

It depends on the wording. The GDV model wording for IT service providers is event-based: the event during the policy period counts, and claims for pure financial loss can be reported up to three years after the policy ends. Many US Tech E&O policies are claims-made with a retroactive date, which means the claim must be made, and usually reported, while the policy runs or within a stated period afterwards. Some German professional liability wordings are breach-based. The trigger decides which policy responds after a change of insurer, so ask for it in writing.

Not in the GDV model wording for IT service providers, which excludes them. Whether punitive damages can be insured at all depends on the US state. If a US customer could sue you in a US court, ask your insurer in writing how the policy treats them.

There is no standard figure. Published examples from public US universities ask for USD 1M to 2M of professional liability and USD 2M to 5M of cyber cover, one university tiers cyber limits from USD 0.5M to 10M, and a 2025 law firm review calls 2M to 5M not uncommon for small and mid-size vendors. The limit that matters is the one in your contract. We compare it with your sum insured and show what is missing.

It adds a second route to liability for software placed on the market after 9 December 2026: natural persons can claim for injury, property damage and the loss of private data, and the liability cannot be excluded by contract. Business customers cannot claim under the directive, so their claims still run under contract and tort law, which is where Tech E&O applies. The new rules make it important to know which policy would respond to injury or property damage caused by software. Germany promulgated its implementing law on 27 October 2026. Which of your products are affected depends on its transitional provisions, so ask your lawyer.

That depends on revenue, activities, contract terms, limits, territory and claims history, so a fair figure needs a short look at your company and your largest contracts. Request the check and we will tell you what to expect.

Report known claims and circumstances to the old insurer at once. Which policy covers them depends on both triggers and on what you disclosed when you applied (section 19 VVG). Ask in writing before you cancel anything.

Many US customers ask for one. A certificate such as the ACORD 25 is issued for information only and does not change the cover. Additional-insured status and a waiver of subrogation need policy wording or an endorsement. Our page on US insurance clauses and certificates goes into the details.