Technology Company Insurance: The 2026 Requirements Guide
A technology company rarely picks its insurance off a menu. Customers, landlords, and state law each hand you requirements, and those requirements decide most of what you bind. This guide is the mechanics side: for each party who can force you to carry coverage, what they ask for, which form satisfies it, and where the paperwork trips technology companies at the worst moment. The liability side — who can sue and what is at stake — is on the sister library, pleasedontsue.us.
A technology company rarely picks its insurance off a menu. Customers, landlords, and state law each hand you requirements, and those requirements — not your own risk assessment — decide most of what you bind. This guide is the mechanics side: for each party who can force you to carry coverage, what they actually ask for, which form satisfies it, and where the paperwork trips technology companies. The liability side, who can sue you and what is at stake, is on the sister library, pleasedontsue.us. This is the requirements map.
Where these hit your timeline. Few appear at founding. Each attaches to a milestone, and each comes with a document you have to produce.
| Milestone | Requirement that appears | What you will be asked to produce |
|---|---|---|
| First hire | Workers’ comp (state law) | A workers’ comp policy, or a valid owner exemption filing |
| First enterprise customer | Tech E&O + cyber (customer MSA) | A certificate of insurance showing the limits the contract names |
| Shipping hardware | Product liability (distributor or retail agreement) | A certificate and possibly an additional-insured endorsement |
| Office lease signed | General liability + property (landlord) | A certificate naming the landlord additional insured |
| Funded, outside director | D&O (investors) | Proof of D&O on the closing checklist |
What your customers require
The customer’s master services agreement carries an insurance exhibit, and that exhibit names the lines and the limits. For a technology company the core demand is technology E&O paired with cyber, evidenced by a certificate of insurance. The number in that clause is a requirement, not a suggestion — it is the floor for the limits you bind.
Two mechanics trip technology companies here, and both are common. First, a certificate proves coverage exists, but it does not make the customer an insured. To extend your defense and settlement protection to them you need an additional-insured endorsement on the policy itself. New York’s insurance department states the rule plainly: a certificate holder is not an additional insured, and a certificate cannot alter the policy. Customers conflate the two constantly; the policy language is what controls. Second, most tech E&O is written on a claims-made trigger — Connecticut’s regulation defines the form — so the retroactive date decides whether years-old work stays inside the coverage window. Switch carriers without carrying prior acts forward and the old exposure reopens.
Read the policy’s definition of “technology services” against what you actually do before you certificate it. For AI-dependent products that definition is where underwriters are drawing the line: an underwriter may ask how the model is trained, what data it touches, and whether its output drives decisions with physical or financial consequences. If your MSA describes a service the policy does not define, the certificate you hand the customer may not back the promise you made.
What your landlord requires
The lease is the bluntest instrument. A commercial landlord typically requires general liability — commonly $1 million per occurrence and a $2 million aggregate — and names the landlord additional insured on that policy. Property coverage for your tenant improvements and contents usually rides alongside it.
For most technology companies the efficient shape is a business owner’s policy, a package that bundles general liability and commercial property and costs less than buying each separately. A software company usually qualifies, because the BOP is built for lower-risk operations; a carrier can decline it for operations that look higher-risk, and a company shipping or storing hardware may fall outside the BOP’s eligibility. The lease clause is a literal specification: match the limits it names, add the landlord by the exact additional-insured wording, and deliver the certificate before you take the keys. A BOP never includes professional liability, cyber, or workers’ comp — those stay separate.
What the state requires
Workers’ compensation is the one requirement backed by law rather than by a counterparty. The trigger is your state’s employee threshold, and it varies sharply enough that generalizing from one state is a mistake. California requires it with even a single employee under Labor Code 3700; Florida sets the line at four or more employees for non-construction businesses. Most states let an owner or officer elect exemption, but the election is a filing, not an assumption.
The mechanics that catch technology companies: part-time and seasonal staff count toward the threshold, workers’ comp is a separate statutory policy that no BOP includes, and an uninsured workplace injury is both a regulatory penalty and an uncovered loss. If you have employees, your state’s workers’ comp authority — not a carrier’s marketing page — is the source for your trigger. See whether you need workers’ comp with no employees for the threshold question and how workers’ comp relates to general liability for why the two are not substitutes.
The decisions that are actually yours
Strip away the three sources above and one line is left genuinely elective: D&O. No customer, landlord, or statute requires it — but if you have taken outside funding, creditor debt, or added outside directors, the case for carrying it is strong. The liability framing is on the sister library; the decision is yours.
The remaining decisions are about the requirements you already face, not whether to face them. Size limits against your worst single failure rather than a generic tier — the floor is what the contract names, the sanity check is the most plausible loss from one event, defense costs included. Read the claims-made trigger before you switch carriers so a changed retroactive date does not reopen old work; Connecticut’s regulation defines what a claims-made form is, and most tech E&O and cyber policies use it. Decide where cyber ends and tech E&O begins for an AI-dependent product — underwriters are drawing that boundary in real time, and a blended policy with one carrier avoids two insurers each pointing at the other on an overlap claim.
A short checklist
- Enterprise customer landed → read the insurance exhibit; the limits it names are your Tech E&O and cyber floor, and the additional-insured endorsement is separate from the certificate.
- Shipping hardware → confirm whether your BOP still qualifies and whether product liability is required by your distributor before you launch.
- Lease signed → match the GL limits, add the landlord by the exact wording, and deliver the certificate before you take the keys.
- First hire → confirm your state’s workers’ comp threshold and bind or file the owner exemption.
- Funded with outside directors → decide on D&O; the liability case is on pleasedontsue.us.
- Renewing or switching carriers → carry the retroactive date forward, or the old work walks back out of coverage.
Sources are linked below. This guide covers the requirements and the mechanics of meeting them — forms, certificates, endorsements, and state thresholds. The liability exposures behind each requirement are on pleasedontsue.us.
Sources
- Primary source: NAIC — Insurance topics for small businesses — Regulator-association overview of the standard small-business coverage stack and how a BOP packages property and liability.
- Context source: IRMI — Businessowners policy (definition) — Professional authority: a package policy providing both property and liability coverage for eligible small businesses, written on standard or proprietary forms.
- Primary source: California DIR, Division of Workers' Compensation — Employer FAQ — Example of a strict state threshold: California requires workers' comp with even one employee (Labor Code 3700); thresholds differ by state.
- Primary source: Florida CFO, Division of Workers' Compensation — Employer FAQ — Contrast threshold: Florida requires workers' comp at four or more employees for non-construction businesses — state lines vary sharply.
- Primary source: New York Department of Financial Services — Certificate of insurance opinion — A certificate holder is not an additional insured, and a certificate cannot alter the policy — the distinction that controls most customer and landlord requirements.
- Primary source: Connecticut — Claims-made policy definition §38a-327-1 — Regulatory definition of a claims-made policy — the trigger form that makes the retroactive date decide whether old work stays inside coverage.