Professional services firms sell judgment, and judgment is what gets sued. Consultants, marketing and design agencies, IT providers, bookkeepers and accountants, staffing firms and engineers face a primary exposure general liability was never written to cover: a client alleging financial harm because the work was late, wrong, incomplete, or simply did not produce the promised result. Professional liability (errors and omissions) is built for that, and it is almost always claims-made — which means the retroactive date and the tail, not just the limit, determine whether your prior work is protected.
Coverage, exclusions and limits vary by carrier and policy form; treat this as a framework for reviewing your own program.
Why a Standard Business Policy Leaves the Main Exposure Open
A commercial general liability policy responds to third-party bodily injury, property damage, and personal and advertising injury — the scope described in the Texas Department of Insurance's CGL overview, which also lists what CGL excludes, including damage to your own work, liability assumed by contract, pollution, and workers' compensation or employer's liability exposure.
Hold your actual claim scenario against that scope. A client who says your strategy cost them a quarter of revenue, your code caused a failed launch, or your filing missed a deadline is not alleging bodily injury or property damage. They are alleging pure economic loss. That is how a firm carries a perfectly good GL policy and is still uninsured for the claim most likely to happen. GL remains necessary — landlords and contracts require it, and physical injury at your office or a client site is real — but it does not answer your core risk. See general liability and our explainer.
Professional Liability: the Mechanics That Matter
Claims-made is a different animal
A claims-made policy covers liability arising out of incidents, acts or omissions "as long as the claim is first made during the policy period or any extended reporting period," and reaches injury or damage occurring before the policy's effective date only if it occurred after the retroactive date — see the New York Department of Financial Services' opinion on claims-made coverage. Four consequences follow, and they are the four things firms get wrong:
- The retroactive date is the real coverage. A new policy with a retro date equal to today covers nothing you did before today, no matter how large the limit. When you switch carriers, full prior acts or a matching retro date preserves your history; losing it strands every engagement you have ever delivered.
- The tail is what covers you after you stop. An extended reporting period lets you report claims after the policy ends for work performed during the policy period or after the retroactive date. Retiring, selling the firm, or going a year without coverage all turn an unpurchased tail into an uninsured gap.
- "Claims-made" and "claims-made and reported" are not the same. The NY DFS opinion distinguishes them: a claims-made-and-reported form requires "the claim and the reporting of the claim to the insurer both take place during the same policy term." That is a tighter trigger. Know which you bought.
- Notice provisions are strict. Most forms require prompt notice, and many include a notice-of-circumstance provision letting you report a situation likely to become a claim so it attaches to the current policy. Not using it can push a claim into a later year with a different retro date.
Read these five things on the form
- The definition of "professional services." Coverage follows this definition. If your declarations say "management consulting" but you also do software implementation, the second activity may sit outside the grant of coverage.
- Whether defense costs erode the limit. On most E&O forms defense is inside the limit — every dollar defending you is a dollar less to resolve the matter.
- The contractual liability exclusion, which on many forms excludes liability you assumed beyond what you would owe at common law — and which matters when a contract makes you guarantee an outcome or indemnify broadly.
- The bodily injury and property damage exclusion. E&O typically excludes what GL covers; the two are complements, not substitutes, and gaps between their definitions are worth checking.
- Consent-to-settle and any "hammer" provision, which govern what happens when you want to fight a claim your carrier wants to settle.
See professional liability / E&O and our essentials overview.
Cyber — and a Regulation Many Firms Do Not Know Applies
Breach notification is universal. The National Conference of State Legislatures reports that all 50 states plus D.C., Guam, Puerto Rico and the Virgin Islands have security breach notification laws governing who must comply, what constitutes a breach, and how notice must be given. Cyber coverage funds forensics, notification, credit monitoring, restoration and third-party liability.
Some professional firms are "financial institutions" under the FTC Safeguards Rule. Under 16 CFR 314.2, the definition reaches institutions significantly engaged in activities financial in nature, and the examples explicitly include "an accountant or other tax preparation service that is in the business of completing income tax returns," a career counselor providing employment services to organizations in the financial field, and a business operating a travel agency in connection with financial services.
Where the Rule applies, 16 CFR 314.4 requires a written information security program with a designated qualified individual, a documented risk assessment, access controls, encryption of customer information in transit and at rest, multi-factor authentication, secure disposal, service provider oversight, a written incident response plan, and at least annual reporting to the board — plus notification to the FTC within 30 days of discovering a breach affecting 500 or more consumers.
Smaller firms get partial relief, not exemption. 16 CFR 314.6 provides that 314.4(b)(1), (d)(2), (h) and (i) "do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers" — the written risk assessment, the monitoring or penetration testing requirement, the incident response plan, and the annual report. The rest still stands, and cyber underwriters ask about these same controls, so compliance work and insurability work are the same work. More context here.
One gap worth naming: social engineering and funds-transfer fraud — the fake-invoice or spoofed-vendor wire — is often handled under a commercial crime policy or a specific cyber endorsement rather than base cyber coverage, frequently with its own sublimit.
The Rest of the Program
| Coverage | What it does for a services firm |
|---|---|
| Business owner's policy | Bundles general liability with commercial property; typically includes business income coverage replacing revenue if a covered event closes your office |
| Workers' compensation | Medical and wage replacement for work-related injury; repetitive-stress and remote-work injuries can be compensable depending on the state |
| Hired and non-owned auto | Answers for the firm when someone drives a personal or rented car on business |
| Employment practices liability | Wrongful termination, discrimination, harassment and retaliation — not covered by GL |
| Directors and officers | Management liability for private companies with boards, investors or outside stakeholders |
| Umbrella / excess | Sits above scheduled underlying policies — check whether E&O is scheduled; often it is not |
Workers' comp thresholds vary — do not generalize. Missouri requires coverage at five or more employees, one or more in construction. Kansas' K.S.A. 44-505 exempts an employer whose total gross annual payroll for the preceding calendar year was not more than $20,000, with agricultural pursuits separately excepted. Texas is elective for most private employers, with reporting duties for non-subscribers.
The personal-car problem. IRMI defines a non-owned automobile as one "used in connection with the named insured's business but that is not owned, leased, hired, rented, or borrowed by the named insured" — the employee's own car driven to a client meeting. The Insurance Information Institute's business vehicle guidance is direct: your business "could wind up liable for property damage and bodily injuries resulting from a traffic accident for which an employee was at fault," and recommends requiring employees to carry coverage and obtaining proof annually. IRMI also notes "hired automobile" generally excludes autos leased or hired from your own employees — which is why the non-owned piece matters separately.
What Underwriters Actually Evaluate
E&O underwriting is about the shape of the work, not just the revenue number.
| What they review | Why it matters |
|---|---|
| Service mix by revenue | A firm 80% strategy and 20% implementation prices differently than the reverse; implementation, hosting and anything touching production systems raises severity |
| Client industries served | Regulated, public-company or healthcare clients carry different exposure than small-business work |
| Client concentration | One client at 40% of revenue is both a business risk and a claim risk — disputes with a dominant client escalate |
| Largest single engagement | Underwriters map limit adequacy against your biggest project, not your average one |
| Engagement letters and contract terms | Whether agreements define scope, deliverables, acceptance and limitation of liability — and whether you have accepted uncapped indemnity or performance guarantees |
| Subcontractors | Whether you subcontract, require E&O of them, and collect certificates |
| Quality control | Peer review, sign-off procedures, documented change orders, version control |
| Prior claims and circumstances | Typically five years, including matters you have not yet reported |
| Security controls | MFA, encryption, backups, email security, vendor management — now standard E&O questions, not just cyber ones |
Contract clauses that change your insurance needs
| Clause you agree to | What it does to your program |
|---|---|
| Required E&O limit, "occurrence-based preferred" | You may need a higher limit; occurrence-form E&O is uncommon and usually has to be negotiated |
| Broad or uncapped indemnity | May trigger the contractual liability exclusion on your E&O form |
| Additional insured on your GL | Straightforward on GL; generally not available on E&O |
| Waiver of subrogation | Usually addable by endorsement — ask before signing |
| Maintain coverage for N years post-termination | This is a tail purchase obligation; price it before you sign |
| Guaranteed outcomes or performance warranties | Moves you from a professional standard of care to a contractual promise, which insurance may not follow |
An Illustrative Scenario
Hypothetical, for illustration only. Not an actual claim, and not a prediction of how any specific policy would respond.
A six-person consulting firm has carried E&O for four years. At renewal a lower-priced quote is placed with a new carrier. Nobody checks the retroactive date, and the policy issues with a retro date equal to the new inception date rather than matching the original.
Eight months later a client alleges that a project delivered two years earlier caused a financial loss. The claim is first made during the new policy period — so the claims-made trigger is satisfied — but the alleged act occurred before the retroactive date. The prior policy has expired and no tail was purchased.
The limit was never the problem. The date was. Matching prior acts coverage, or buying a tail on the expiring policy, would each have preserved the coverage — and both are ordinary requests to make at renewal.
Documentation Carriers Typically Request
- Application plus a professional liability supplement specific to your discipline
- Revenue by service line, projected revenue, and concentration by top clients
- Sample engagement letter or master services agreement
- Description of your largest current and recent engagements
- Credentials for principals and key staff
- Subcontractor list and their certificates of insurance
- Five years of loss runs, plus a signed no-known-claims or circumstances statement
- Security questionnaire — MFA, backups, encryption, incident response
- Current declarations pages, so the retroactive date can be matched
Common Mistakes Services Firms Make
- Letting the retroactive date reset when moving carriers, or allowing a gap that strands prior work.
- Not buying the tail when the firm winds down, merges or is sold.
- Assuming general liability covers professional mistakes. It covers bodily injury and property damage, not economic loss from advice.
- Signing contracts before checking the insurance clause — required limits, additional insured on E&O, multi-year post-termination obligations.
- Buying a limit sized to the average project rather than the largest one, and forgetting that defense usually erodes it.
- Skipping engagement letters for small or repeat clients. Scope disputes with familiar clients are common claim sources.
- Buying an umbrella and assuming it sits above E&O. Usually it does not unless E&O is scheduled as underlying.
Questions to Ask Your Agent
- What is my E&O retroactive date, and does it cover everything my firm has ever delivered?
- Is my form claims-made, or claims-made and reported?
- Do defense costs erode my limit, and what would a tail cost if I needed one?
- How is "professional services" defined on my declarations, and does it cover everything I actually do?
- What does the contractual liability exclusion say, and how does it interact with my client contracts?
- Where does social engineering and funds-transfer fraud sit — cyber, crime, or neither?
- Does my umbrella schedule E&O as underlying, and what can be endorsed if a contract demands more?
Frequently Asked Questions
What is the difference between general liability and professional liability? General liability responds to bodily injury, property damage, and personal and advertising injury. Professional liability responds to financial loss a client alleges from your services, advice or work product. Most services firms need both.
What is a retroactive date, and why does it matter more than my limit? On a claims-made policy, coverage reaches back only to the retroactive date. Work performed before it is generally outside coverage regardless of the limit. Preserving or matching it when you change carriers is the single most important renewal detail.
Do I need tail coverage if I close or sell my firm? Almost certainly. Without an extended reporting period, claims reported after the policy ends generally are not covered, even for work performed while insured.
Does my E&O cover a data breach? Not usually in a meaningful way. Breach response, notification and network security liability belong on a cyber policy. Some carriers bundle them — confirm limits and whether they are shared.
Does the FTC Safeguards Rule apply to my firm? It may. 16 CFR 314.2 expressly names accountants and tax preparation services, certain career counselors, and travel agencies operating in connection with financial services. Firms holding customer information on fewer than 5,000 consumers get a narrow set of exceptions, not a blanket exemption.
Do I need workers' compensation for a small remote team? It depends on your state's rule and how workers are classified — Missouri's general threshold is five or more employees, Kansas uses a $20,000 gross annual payroll test, and Texas is elective for most private employers.
Get a Professional Services Review
BluePeak Digital Insurance is founder-led by a former high-level commercial underwriter, so your program gets read from the carrier's side of the table: the retroactive date, the definition of professional services, whether defense erodes the limit, and whether your contracts have already committed you to coverage you do not carry.
See how we work with professional services firms, accounting firms, law firms, financial services firms, media and communications businesses and office-based businesses, or browse our coverage library and how to choose the right coverage. When you are ready, request a free review.
This article is general information, not legal or insurance advice. Coverage, exclusions and limits vary by carrier and policy form. Regulatory obligations depend on your specific facts. Review your own policy, contracts and applicable law with licensed advisors.