Professional indemnity insurance for IT companies in Singapore
What professional indemnity covers for a technology firm
Professional indemnity (PI) insures civil liability for breach of professional duty. For an IT company the duty is to deliver work that meets the contract and the standard of a competent provider. The policy pays damages awarded or agreed, plus defence costs, up to the limit.
Technology errors and omissions wordings extend the traditional PI form in 3 ways.
- Products and services together. A software firm sells a product and the service of implementing it. Tech E&O covers both, so a dispute about whether the fault was in the code or the configuration does not fall between two policies.
- Breach of contract. Standard PI covers negligence. Tech E&O usually covers liability for failure to perform the contract, which is how most technology claims are pleaded.
- Intellectual property. Unintentional infringement of copyright or trade mark in delivered work is often included. Patent infringement is usually excluded.
Typical claims are a payroll system that calculated CPF wrongly for 8 months, an e-commerce platform that lost orders over a launch weekend, a migration that corrupted a client's database, and an architecture recommendation the client had to reverse. In each case the loss is financial, not physical, and the remedy is against the firm.
The policy excludes known circumstances, deliberate acts, fines and penalties in most forms, and liability assumed under contract beyond what the law would impose. It also excludes bodily injury and property damage, which belong to public liability.
Tech E&O vs cyber: which policy responds
The two policies are bought together. The trigger differs.
| Event | Tech E&O (PI) | Cyber |
|---|---|---|
| Your software bug causes the client to lose revenue | Yes | No |
| Your consultant's advice leads the client to a bad purchase | Yes | No |
| Ransomware encrypts your own servers and stops your service | No | Yes: incident response, restoration, business interruption |
| Your systems are breached and client personal data is taken | Liability to the client may fall on either; first-party costs fall on cyber | Yes: forensics, notification, PDPC investigation costs |
| PDPC imposes a financial penalty on your firm | Usually excluded | Covered where insurable at law |
| A client sues because the breach came through your product | Yes, as a professional failure | Possibly, under third party liability section |
| Social engineering fraud moves client money | No | Yes, if the crime extension is bought |
The overlap sits in the breach-of-client-data row. A broker checks that the two wordings meet on the scenario that involves both: a flaw in the firm's product that leads to a breach at the client.
CSA recorded 165 ransomware cases in 2025, up from 159 in 2024, with SMEs the most affected. Phishing reports fell 21% to about 4,800 from 6,100, which CSA notes may reflect under-reporting. The cyber insurance and PDPA explainer covers the cyber side.
Why clients demand professional indemnity for IT companies in Singapore
Most Singapore IT firms first buy PI because a contract requires it. Enterprise, bank and government procurement terms specify a PI limit and ask for the certificate before the purchase order issues.
The benchmark the market copies comes from the regulated professions. Lawyers must hold professional indemnity cover before the Law Society issues a practising certificate, under Section 75A of the Legal Profession Act. The minimum is S$1 million per claim for sole proprietorships and partnerships and S$2 million per claim for law corporations and limited liability law partnerships, costs and expenses included. Procurement teams apply the same logic to technology vendors: a limit per claim, costs inclusive or exclusive, maintained for a period after delivery.
The second reason is the Personal Data Protection Act. Since 1 October 2022 the PDPC can impose a financial penalty of up to S$1 million or 10% of annual turnover in Singapore, whichever is higher, on organisations with Singapore turnover above S$10 million. A client fined after a breach caused by its vendor's product looks to the vendor. The vendor's PI, not the client's cyber policy, is where that claim lands.
The third reason is the firm's own balance sheet. A S$600,000 claim with S$150,000 of defence costs ends a 20-person software house without insurance. With PI, the firm pays the excess and continues.
What limit, and on what basis
The limit is set per claim, with an aggregate for the policy year. Three choices shape the premium.
- Per claim limit. S$1 million is the floor most contracts specify; S$2 million to S$5 million is common for firms serving banks and government. Larger limits are bought where one contract carries most of the revenue.
- Costs inclusive or in addition. Costs inclusive means defence costs erode the limit. Costs in addition means they are paid on top. Contracts increasingly specify costs in addition.
- Excess. A higher excess lowers premium. The excess should be an amount the firm can pay 2 or 3 times in a bad year.
Worked example. The figures are an example.
A software firm with S$6 million revenue holds a S$2 million costs-inclusive PI policy with a S$25,000 excess. A client claims S$1.4 million for lost revenue after a failed ERP go-live. Defence costs reach S$350,000. The claim settles at S$1.1 million. Total S$1.45 million is within the limit; the firm pays S$25,000. Had the policy been S$1 million costs inclusive, the firm would have faced S$450,000 uninsured. The limit should be set against the largest contract, not the average.
Rates hardened from 2019. Chubb's Singapore underwriting view records that PI pricing began to rise in 2019 and that underwriters narrowed appetite through 2021. Technology firms with large single contracts, fixed-price delivery or financial services clients pay more per dollar of limit than firms with many small contracts.
Claims-made and the retroactive date
PI is written on a claims-made basis. The policy in force when the claim is first made pays, not the one in force when the work was done. Two dates follow.
The retroactive date is the earliest date of work the policy will cover. Work done before it is excluded. A firm that switches insurer must carry its original retroactive date forward, or it loses cover for every project before the switch. A firm buying PI for the first time usually gets a retroactive date equal to inception, so its past projects are uninsured until a client agrees otherwise.
The second date is the end of the policy. When a firm stops trading, is acquired or lets its PI lapse, claims for past work have nowhere to go. Run-off cover, which accepts claims for a fixed period after the firm stops, closes that gap. Acquirers ask for it in the sale agreement.
Notification matters as much. Most wordings require the insured to notify circumstances that may give rise to a claim as soon as it becomes aware of them. A client's email that a system is "not performing as agreed" is a circumstance. Notify it in the policy year it arrives and the later claim attaches to that year. The claims-made and retroactive date explainer covers the mechanics.
Underwriters also read the firm's standard contract terms. A liability cap at 12 months' fees with consequential loss excluded presents a different risk from signing the client's paper uncapped.
Frequently asked questions
Does PI cover a software bug that costs my client money?
Yes, if the client claims against the firm for the financial loss and the policy is a technology errors and omissions form that covers failure to perform. The policy pays damages and defence costs up to the limit. The cost of fixing the bug itself is usually excluded as a cost of redoing the work.
What is the difference between tech E&O and cyber insurance?
Tech E&O pays when the firm's work causes a client loss. Cyber pays when the firm's own systems are attacked or breached: forensics, restoration, notification, business interruption and regulatory costs. A breach at a client caused by a flaw in the firm's product can involve both policies.
What PI limit do enterprise clients usually demand?
S$1 million per claim is the common floor, matching the Law Society minimum for sole practitioners. Banks and government bodies often specify S$2 million to S$5 million, costs in addition. The limit should be set against the largest single contract, not average revenue.
Is PI claims-made and why does the retroactive date matter?
Yes. The policy in force when the claim is made pays, provided the work was done after the retroactive date. Losing the retroactive date on a change of insurer removes cover for all earlier projects. Run-off cover is needed when the firm stops trading or is sold.
Sources
General information only, not advice on any particular policy. Cover depends on the policy wording and the insurer's terms.