Professional Liability, Tech E&O, and Cyber: A California Business Checklist

Three related but distinct coverages

Professional liability (also called errors and omissions) addresses claims that a professional service you provided, or failed to provide, caused a client financial loss. Technology E&O is a specialized form of professional liability tailored to technology products and services — it can address allegations tied to a software defect, a service outage, or a failure to meet a contractual service level, though what it covers depends on the form. Cyber liability addresses a different set of costs: first-party incident-response expenses and third-party privacy or network-security allegations, where included in the form. The three can overlap, but no one policy automatically replaces the others. A professional error that causes a client financial loss, a technology product that fails, and a breach of your systems are different events that may call on different coverage — read each form to see where the lines are drawn. For a plain-English comparison of general liability and professional liability, see our guide to general liability vs. professional liability.

General liability vs. professional liability →

Where the lines blur

A single incident can raise questions under more than one policy. A software defect that causes a client outage may be a technology E&O question and, if the outage exposed data, a cyber question. A professional error that causes a client financial loss may be a professional liability question, while a breach of the client's systems during the engagement may be a cyber question. Overlap does not mean any one policy automatically responds — which coverage applies depends on the facts, the policy definitions, and the exclusions in each form. Some technology E&O forms bundle cyber-like elements and some do not; some cyber forms exclude professional error and some do not. Confirm in writing what each policy covers and excludes so you can see the gaps.

A practical document checklist

Before you talk to your insurer or broker, gather the information that shapes these coverages. A clear document set makes the conversation faster and the gaps easier to see. If you are reviewing existing policies rather than buying new, our business insurance renewal checklist walks through the same documents in a renewal context.

• Service descriptions — a plain description of the professional services you provide and how you deliver them
• Technology products and services — what you build, host, maintain, or support, and how clients rely on it
• Contracts — your largest client and vendor agreements, including service levels, hold-harmless clauses, and insurance requirements
• Revenue and client mix — annual revenue, client count, and how concentrated your client base is
• Data handled — the kinds of data you store, process, or transmit, including any payment, health, or personal information
• Subcontractor work — services you delegate to subcontractors or vendors and how they are insured
• Security controls — your security practices, compliance frameworks, and any assessments or certifications
• Current declarations and forms — your current policies, declarations pages, and endorsement schedules
• Prior incidents — any prior claims, breaches, or incidents and how they were resolved

Business insurance renewal checklist for California companies →

Questions to ask about each form

Verbal reassurances are hard to rely on later. Ask your insurer or broker to confirm these in writing so you can see exactly where each policy stands.

• Definitions — how does the policy define 'professional services,' 'technology services,' 'cyber event,' and 'wrongful act,' and where do the definitions draw the line?
• Contract exclusions — does the form exclude liability you assume under a contract beyond what you would otherwise owe?
• Retroactive date and continuity — what retroactive date applies, and are prior acts covered only after that date? A retroactive date and an extended reporting period are not substitutes for each other.
• Claims-made and reporting — is the policy claims-made, and what does it require for prompt notice of a claim or circumstance? How you report and when can affect whether a claim is covered.
• Extended reporting (tail) — if you buy an extended reporting period, what does it cover and for how long? A tail does not insure new work performed after the policy ends.
• Defense costs and limits — are defense costs inside or outside the limit, and do they erode it? What retention applies?
• Sublimits — are there sublimits for ransomware, regulatory defense, fines, or specific cyber coverages?
• Consent and vendor requirements — does the insurer require consent to settle, and are there required incident-response vendors or panels?

Retroactive dates and tails are not interchangeable

A retroactive date sets how far back the policy reaches for prior acts; an extended reporting (tail) period extends the time after the policy ends during which you can report a claim arising from an act before the end date. They serve different purposes, and neither is a substitute for the other. A tail does not insure work performed after the policy ends — if you continue providing services, you need continuing coverage for that new work. Confirm the dates and the tail terms in writing so you know what is and is not covered.

Three hypothetical scenarios with questions

These examples illustrate the questions to ask — they do not promise that any particular claim is covered. Whether coverage applies depends on the policy wording, exclusions, limits, and underwriting.

• Service-error claim: A client alleges that a consultant's recommendation caused a costly operational mistake and sues for the resulting financial loss. Questions: Does professional liability address the alleged error? What retroactive date applies, and was the act after it? Are defense costs inside or outside the limit? This example does not promise any claim is covered.
• Technology outage: A defect in a delivered platform causes a client outage and alleged lost revenue. Technology E&O may be relevant to the alleged service failure. Cyber coverage would require a covered privacy or network-security event or other applicable trigger; an outage alone does not establish coverage. Actual forms, exclusions, limits, and reporting conditions control. Questions: Does the form's definition of 'technology services' cover what you delivered? If the outage exposed data, does cyber also respond, or does the tech E&O form exclude it?
• Data breach: An attacker accesses a system you host and exposes client records. Questions: Does cyber liability address your response costs and third-party liability? Are there sublimits for notification or regulatory defense? Does the form require use of a panel vendor? Separately, ask counsel what breach-notification duties may apply to the data and jurisdictions involved — insurance does not replace legal obligations. This example does not promise any claim is covered and is not a complete incident-response plan.

California relevance

If your business handles personal information, ask counsel what breach-notification duties may apply to your data and the jurisdictions you serve; this guide does not determine legal obligations. The California Attorney General provides a data-breach reporting resource you can review with counsel for the current requirements that apply to your situation. Insurance can address response costs and liability, but it does not replace the legal duties that may apply to a breach. Review the reporting resource below with counsel for a current assessment rather than relying on this guide for legal thresholds or deadlines.

Sources reviewed

• Travelers — Errors and Omissions (Professional Liability) Insurance
• Travelers — Technology Errors and Omissions Insurance Risks
• The Hartford — Technology Professional Liability Insurance
• California Attorney General — Data Breach Reporting