SaaS Consultant Insurance: The 2026 Requirements Guide

A SaaS consultant rarely picks insurance off a menu. Client engagement letters, master services agreements, and vendor-onboarding portals each hand you requirements, and those requirements — not your own risk assessment — decide most of what you bind. This guide is the mechanics side: for each party who can force you to carry coverage, what they actually ask for, which form satisfies it, and where the paperwork trips consultants. The liability side, who can sue you and what is at stake, is on the sister library, pleasedontsue.us. This is the requirements map.

Where these hit your timeline. Each attaches to a contract or a hire, and each comes with a document you have to produce.

Milestone	Requirement that appears	What you will be asked to produce
Solo LLC, no clients yet	None binding	Nothing yet — most coverage is elective
First engagement letter signed	Professional liability (E&O) at named limits	A certificate of insurance showing the limits the contract names
Client grants system, code, or data access	Cyber (data-handling clause)	Proof of cyber, often blended with tech E&O
Vendor-onboarding portal entry	General liability + certificate	A certificate, sometimes with the client named additional insured
First hire	Workers’ comp (state law)	A workers’ comp policy or a valid owner-exemption filing

What your engagement letters require

The client’s engagement letter or master services agreement carries an insurance exhibit, and that exhibit names the lines and the limits. For a SaaS consultant the core demand is professional liability — E&O — at a specific per-claim and aggregate limit, evidenced by a certificate of insurance. The number in that clause is a requirement, not a suggestion: it is the floor for the limits you bind, and large clients standardize it across vendors, so negotiating it down is harder than consultants expect. The limit in the engagement letter is the floor.

Where data is involved, the exhibit adds cyber. Consultants who receive credentials, API access, or client data hit a data-handling clause that conditions the engagement on proof of cyber coverage — and because consultant-caused breaches read as both a cyber event and a professional failure, the two lines are often packaged. The exhibit will also specify how long coverage must be maintained after the engagement ends, which is what makes canceling a policy between contracts more expensive than it looks.

The form-definition question: does the policy cover your SaaS work?

This is the mechanic that decides whether the E&O requirement you just satisfied is worth the paper. A generic professional-liability form written for a management consultant or accountant may not define software development, SaaS delivery, system integration, or code as a covered service. A claim that your deliverable caused a loss lands outside the definition, and the client’s certificate requirement is met on paper while the exposure sits uninsured underneath it.

The form you need is technology E&O — professional liability whose definition of professional services includes technology and software work. Read the policy’s definition against what you actually do before you certificate it to a client. For consultants whose deliverable is a SaaS product or a codebase, the gap between a consultant E&O form and a tech E&O form is the gap between covered and uncovered, and underwriters are drawing that line in real time for AI-assisted and AI-delivered services.

What vendor-onboarding portals and landlords require

Before a SaaS consultant touches a client system, the client’s procurement portal runs a vendor-onboarding checklist, and general liability is almost always on it. The portal wants a certificate showing a per-occurrence limit — commonly $1 million — and an aggregate, and it wants the client named on the policy. The same mechanic appears in a commercial lease: the landlord requires general liability and names the landlord additional insured.

For most independent consultants the efficient shape for the premises side is a business owner’s policy, a package that bundles general liability and commercial property and costs less than buying each separately. A consultant working from a home office may still need the GL to clear the portal even when no lease is involved. A BOP never includes professional liability or workers’ comp — those stay separate.

Additional-insured vs certificate-holder

This is the paperwork distinction that controls most client and landlord requirements, and clients conflate it constantly. A certificate proves coverage exists; it does not make the client an insured. To extend your defense and settlement protection to the client you need an additional-insured endorsement on the policy itself. New York’s insurance department states the rule plainly: a certificate holder is not an additional insured, and a certificate cannot alter the policy.

The practical consequence: a client whose portal shows “certificate on file” but who never obtained the endorsement is not protected by your policy when a claim arrives — and the consultant who delivered the certificate without the endorsement has met the portal’s checkbox without meeting the contract’s intent. Match the endorsement to the requirement before you deliver the certificate.

What the state requires

Workers’ compensation is the one requirement backed by law rather than by a counterparty. The trigger is your state’s employee threshold, and it varies sharply enough that generalizing from one state is a mistake. California requires it with even a single employee under Labor Code 3700; Florida sets the line at four or more employees for non-construction businesses. Most states let an owner or officer elect exemption, but the election is a filing, not an assumption. Workers’ comp is a separate statutory policy that no BOP includes, and a contractor-reclassification audit can convert a 1099 engagement into a threshold-crossing hire retroactively.

The decisions that are actually yours

Strip away the sources above and one line is left genuinely elective for most consultants: EPLI, employment practices liability. No client, portal, landlord, or statute requires it — yet the exposure starts at your first hire, because every termination and pay decision is a claim that none of your other policies will answer. The case for carrying it is on the sister library; the decision is yours. The remaining decisions are about the requirements you already face, not whether to face them: match the form definition to your actual service, size limits against your worst single engagement rather than a generic tier, and read the claims-made trigger before you switch carriers so a changed retroactive date does not reopen old work.

A short checklist

1. Engagement letter received → read the insurance exhibit; the E&O limit it names is your floor.
2. Form definition → confirm the policy defines your SaaS or software work as a covered service before you bind.
3. Vendor portal or lease → match the GL limits and deliver the certificate with the additional-insured endorsement, not the certificate alone.
4. Client data or system access → confirm cyber coverage and whether it blends with tech E&O or stands alone.
5. First hire → confirm your state’s workers’ comp threshold and bind or file the owner exemption.
6. Renewing or switching carriers → carry the retroactive date forward, or old work walks back out of coverage.

---

Sources are linked below. This guide covers the requirements and the mechanics of meeting them — forms, certificates, endorsements, and state thresholds. The liability exposures behind each requirement are on pleasedontsue.us.