IT liability insurance in Germany: tech E&O for developers and IT firms
If you write software or run IT projects for German clients, your mistakes rarely break anything physical. They cost the client money. German general liability policies leave out such pure financial losses, so the market offers IT-Haftpflicht: professional indemnity for the IT work and general liability for injury and property damage, written as one policy. It is the German counterpart of technology errors and omissions cover.
Do I need IT liability insurance to work as a developer in Germany?
Not by law. No statute requires software companies or freelance developers to carry it. The requirement comes from contracts: many clients, recruitment agencies and corporate buyers only award work against a certificate showing a set limit for financial loss. The reason is the liability itself. Under the German Civil Code a party that breaches a contractual duty owes damages (§ 280 BGB), and unless the contract caps it effectively, that means the client's full loss.
Why a standard German business policy is not enough
Betriebshaftpflicht, the German general liability policy, is built around bodily injury and property damage and the financial losses that flow from them. A typical IT claim looks different. The inventory system posts wrong figures after an update, the online shop is down over the busiest weekend, an interface sends every order twice. Nothing is damaged and nobody is hurt, yet the client loses revenue. German insurers call this a pure financial loss (reiner Vermögensschaden), and the standard policy excludes it.
IT-Haftpflicht puts the financial loss cover first. It insures programming, consulting, implementation, operations and training, and carries the general liability section in the same contract. If you come from the UK or the US, think of it as professional indemnity or tech E&O with public liability attached, with one difference: there is no market standard wording, so the name alone tells you little.
Delay, rework and penalties: read these clauses first
The wordings diverge most where projects actually go wrong. When a system is delivered late, the client can claim damages for delay (§ 286 BGB). Some policies cover this expressly, others exclude losses from missed deadlines. The same split applies to the client's wasted expenditure after it terminates the project, and to promised availability levels.
One limit is the same everywhere. Redoing your own work, meaning fixing bugs and delivering again, is your business risk and no policy pays for it. Contractual penalties and guarantees beyond statutory liability are excluded in basic wordings and covered with a sublimit in better ones. If a corporate client hands you a framework agreement with indemnities and fixed penalties, compare it with your policy before you sign, not after.
IT liability or cyber insurance: which one pays
The two are easy to confuse because both deal with data and systems. The dividing line is who suffers the loss. IT liability pays when your professional mistake harms someone else, and no attack is needed for that. Cyber insurance mainly pays when your own business is hit: forensics, restoring your own systems and data, and your loss of income while you are down.
They overlap at the edges. If you pass malware on to a client or lose client data, the claim may fall under the IT liability policy, the liability section of a cyber policy, or both. Some IT wordings offer first party cover as an add-on, many do not. A software company that hosts for its clients should therefore hold both and make sure they fit together, which is simplest with the same insurer.
Contract terms, third party rights and software as a product
Your own contract is the first line of defence. Capping liability for slight negligence is common in Germany, but standard terms cannot exclude liability for intent or gross negligence, and large clients usually impose their own terms anyway. Claims can also come from people who are not your client: a rights holder over an unlicensed image or library, or a data subject, since the GDPR gives every affected person a claim for compensation (Article 82).
Product liability is changing too. EU Directive 2024/2853 expressly treats software as a product, and member states must transpose it by 9 December 2026. A company that makes software and places it on the market will then be liable for damage caused by defects regardless of fault, as a machine manufacturer already is. Check whether your policy names product liability for software and not only for hardware you deliver.
What is covered
The client's pure financial loss caused by programming errors and defective software
Errors in consulting, analysis, design, implementation and training
Loss, deletion or corruption of client data, including the cost of restoring it
Losses from delay and missed deadlines, depending on the wording
Infringement of copyright, trade mark, name and licence rights
Breaches of data protection law and confidentiality duties
Passing malware on to clients and third parties
Bodily injury and property damage from your office and from work on client premises
Defence against unfounded claims, including in court
Your liability to the client for mistakes made by freelancers and subcontractors
What is not covered
Rework, redelivery and replacement of your own service
Knowing breaches of duty and deliberate deviation from the client's instructions
Contractual penalties and guarantees unless expressly included
Exceeded cost estimates and budgets
Damage to your own business after a cyber attack, which belongs in a cyber policy
Circumstances and breaches already known when the policy was taken out
Fines, as far as the law does not allow them to be insured
Claims under US or Canadian law unless agreed
Who needs it
Software companies and agencies building custom software, apps or online shops
Freelance developers and consultants on client projects, including through agencies
System integrators and administrators looking after client networks and servers
Providers of hosting, cloud services and software as a service
IT consultants, external data protection officers and project managers
Who does not need it
Employed developers who work only for their employer and run no business of their own
Pure hardware resellers without installation or advice, where general and product liability usually suffice
Wheel of misfortune
Spin the wheel of bad luck
Six things that really happen. The wheel picks yours and shows who pays.
Cost:
Budget policy Strong policy
See all six cases
Update wipes the client database, often five figures, more if downtime is long. Budget policy: pays in part, Strong policy: pays. Restoration and the client's lost revenue are the core case. Basic wordings reduce the payout if the client had no backup of its own.
Shop goes live three weeks late, the client's lost revenue. Budget policy: does not pay, Strong policy: pays. This is a loss from delay. Many wordings exclude missed deadlines, stronger ones cover them expressly.
Interface posts every order twice, extra costs and reversals at the client. Budget policy: pays, Strong policy: pays. A coding error causing pure financial loss at the client. This is what IT liability is designed for.
Client wants the code redone for free, your own working time. Budget policy: does not pay, Strong policy: does not pay. Rework is performance of the contract. No policy pays for your own service a second time.
Legal letter over a font in the project, legal fees and licence damages. Budget policy: pays in part, Strong policy: pays. Infringed rights are not insured to the same extent everywhere. Strong wordings also name open source licences.
Ransomware locks your own server, forensics, restoration, downtime. Budget policy: does not pay, Strong policy: pays in part. This is a first party loss. It belongs in a cyber policy or an add-on, liability cover alone does not pay it.
What it costs
Premiums are almost always based on annual turnover and the type of work. For solo freelancers with modest turnover, intermediaries quote premiums from roughly EUR 200 a year, rising to several hundred euros with higher limits and turnover. For software companies with staff, hosting or US business there is no rule of thumb, because the underwriter assesses the individual risk.
What drives the premium
Annual turnover, or planned turnover for a new business
Type of work: consulting, development, operations, hosting, hardware
Limit for financial loss and annual aggregate
Deductible per claim
Share of turnover with clients in the USA and Canada
High severity fields such as payments, medical or industrial control systems
Add-ons such as first party loss, contractual penalties or cyber
These figures come from published information by intermediaries and are snapshots. Your premium is fixed only in the quote we obtain on the basis of your actual work.
The policy levels on the market
01
General liability with an extension
A classic business policy in which pure financial loss runs along with a small sublimit only. Delay, rights infringement and data loss are often narrowly defined. Usually too thin for IT services.
02
IT liability with open cover
Financial loss and general liability in one contract, covering all IT activities and not just a list. Limits from EUR 500,000 for financial loss. The right starting point for freelancers and small software firms.
03
IT liability with add-ons
Higher limits, worldwide territory, sublimits for contractual penalties and assumed liability, plus first party and cyber modules. For providers with hosting, corporate clients or business abroad.
How to recognise a good policy
Criterion
Minimum standard
Strong policy
Why it matters
Limit for financial loss
EUR 250,000
EUR 1 million or more, available at least twice a year
A client's lost revenue after a faulty release can exceed the contract value many times over.
Open description of activities
list of insured IT services
all IT activities insured, new ones provisionally included
Your business changes faster than your policy, and under a list anything not named is uninsured.
Delay and wasted expenditure
excluded
expressly covered, also after the client terminates
Projects fail over deadlines more often than over a single bug.
Assumed liability and penalties
statutory liability only
sublimit for penalties, guarantees and indemnities
Framework agreements of large clients routinely go beyond the law.
Client data loss
covered, reduced if the client had no backup
covered without a backup condition
After a loss it is often impossible to establish whether the client backed up properly.
Rights infringement
copyright and trade marks
also open source licence terms, data protection and confidentiality
Cease and desist letters over images, fonts and libraries land on whoever delivered the project.
Territory
Europe
worldwide, USA and Canada by agreement
Clients with North American subsidiaries bring that law with them.
Retroactive cover and extended reporting
breaches during the policy period only
unknown earlier breaches included, long reporting period after the policy ends
Software defects often surface years after acceptance.
Insurers on the German market
Dedicated IT wordings mainly come from insurers with a strong professional indemnity book, alongside specialty insurers from other European countries. The list below describes the German market; it says nothing about which insurers we work with.
Insurer
Background
Markel
specialty insurer based in Munich, broker distribution only
HDI
part of the Talanx group, focus on small business and professions
AXA
commercial lines through agents and brokers
ERGO
part of the Munich Re group, sold through agents and brokers
Allianz
packages for many sectors, sold through agents and brokers
Gothaer
mutual group, commercial lines through agents and brokers
R+V
insurer of the German cooperative banks
From the BaFin register
129
129 insurers supervised by BaFin, the German regulator, are licensed for this class of insurance.
A lean policy for sole traders on client projects. What matters is the limit your client demands and cover for assignments placed through agencies.
IT liability for software and systems companies
For firms with staff, their own products and maintenance contracts. Premium by turnover, with freelancers and subsidiaries included.
First party module
Pays your own costs, for instance when a client withdraws from the project or withholds your fee over an alleged error. Not available in every wording.
Combination with cyber insurance
Adds forensics, restoration and business interruption in your own company. Sensible for anyone operating systems for clients.
Product liability for hardware and software
For providers that supply devices or sell software as a product. The new product liability rules make this section more important.
Myth or truth
True or false?
Five things people say about this insurance. Guess first, then see the answer.
German law requires software developers to hold IT liability insurance.
This is false.
False, there is no statutory duty. The requirement arises in contracts, because many clients and agencies ask for a certificate.
A German business liability policy pays my client's lost revenue after a software bug.
This is false.
False, that is a pure financial loss without injury or property damage, which the standard policy excludes.
The insurer also defends me against claims that are unfounded.
This is true.
True, assessing liability and defending unjustified claims is part of the cover, including lawyers and court costs.
I am liable to my client for my subcontractor's mistakes.
This is true.
True, the client turns to its contracting partner. Good wordings insure this liability, but the subcontractor should still show cover of its own.
With cyber insurance I no longer need IT liability.
This is false.
False, cyber cover generally requires a security incident. An ordinary coding or consulting error without an attack is a matter for IT liability.
Common mistakes
Buying a plain business liability policy and assuming financial loss is included
Choosing the limit by contract value and not by the loss a client could suffer
Signing penalties and indemnities without checking the policy
Adding hosting, operations or AI development and not telling the insurer
Treating IT liability and cyber insurance as the same thing
Assuming a policy from your home country automatically responds to German contracts
Frequently asked questions
Questions and answers
Frequently asked
Is IT-Haftpflicht the same as tech E&O or professional indemnity?
In substance, yes: it covers financial loss a client suffers because of your professional error.
German policies usually add general liability for injury and property damage in the same contract.
Wordings are not standardised, so compare the clauses, not the product name.
What is the difference between IT liability and cyber insurance?
IT liability pays for harm your professional mistake causes to clients and third parties.
Cyber insurance mainly pays for damage to your own business after an attack or data breach,
such as forensics, restoration and lost income.
If you run systems for clients you will usually want both.
