# IT liability insurance in Germany: tech E&O for developers and IT firms > If you write software or run IT projects for German clients, your mistakes rarely break anything physical. They cost the client money. German general liability policies leave out such pure financial losses, so the market offers IT-Haftpflicht: professional indemnity for the IT work and general liability for injury and property damage, written as one policy. It is the German counterpart of technology errors and omissions cover. Quelle/Source: https://www.nammert.com/en/insurance-broker-it-liability.php Updated: 2026-11-11 ## Do I need IT liability insurance to work as a developer in Germany? Not by law. No statute requires software companies or freelance developers to carry it. The requirement comes from contracts: many clients, recruitment agencies and corporate buyers only award work against a certificate showing a set limit for financial loss. The reason is the liability itself. Under the German Civil Code a party that breaches a contractual duty owes damages (§ 280 BGB), and unless the contract caps it effectively, that means the client's full loss. ## At a glance - **Compulsory?:** No, but clients often ask for a certificate - **Core cover:** pure financial loss from IT work, plus bodily injury and property damage - **Typical limit for financial loss:** EUR 500,000 to 3 million; budget tariffs sometimes only EUR 50,000 to 100,000 - **Premium basis:** annual turnover and type of work - **Policy language:** wordings are in German and differ from insurer to insurer ## Why a standard German business policy is not enough Betriebshaftpflicht, the German general liability policy, is built around bodily injury and property damage and the financial losses that flow from them. A typical IT claim looks different. The inventory system posts wrong figures after an update, the online shop is down over the busiest weekend, an interface sends every order twice. Nothing is damaged and nobody is hurt, yet the client loses revenue. German insurers call this a pure financial loss (reiner Vermögensschaden), and the standard policy excludes it. IT-Haftpflicht puts the financial loss cover first. It insures programming, consulting, implementation, operations and training, and carries the general liability section in the same contract. If you come from the UK or the US, think of it as professional indemnity or tech E&O with public liability attached, with one difference: there is no market standard wording, so the name alone tells you little. ## Delay, rework and penalties: read these clauses first The wordings diverge most where projects actually go wrong. When a system is delivered late, the client can claim damages for delay (§ 286 BGB). Some policies cover this expressly, others exclude losses from missed deadlines. The same split applies to the client's wasted expenditure after it terminates the project, and to promised availability levels. One limit is the same everywhere. Redoing your own work, meaning fixing bugs and delivering again, is your business risk and no policy pays for it. Contractual penalties and guarantees beyond statutory liability are excluded in basic wordings and covered with a sublimit in better ones. If a corporate client hands you a framework agreement with indemnities and fixed penalties, compare it with your policy before you sign, not after. ## IT liability or cyber insurance: which one pays The two are easy to confuse because both deal with data and systems. The dividing line is who suffers the loss. IT liability pays when your professional mistake harms someone else, and no attack is needed for that. Cyber insurance mainly pays when your own business is hit: forensics, restoring your own systems and data, and your loss of income while you are down. They overlap at the edges. If you pass malware on to a client or lose client data, the claim may fall under the IT liability policy, the liability section of a cyber policy, or both. Some IT wordings offer first party cover as an add-on, many do not. A software company that hosts for its clients should therefore hold both and make sure they fit together, which is simplest with the same insurer. ## Contract terms, third party rights and software as a product Your own contract is the first line of defence. Capping liability for slight negligence is common in Germany, but standard terms cannot exclude liability for intent or gross negligence, and large clients usually impose their own terms anyway. Claims can also come from people who are not your client: a rights holder over an unlicensed image or library, or a data subject, since the GDPR gives every affected person a claim for compensation (Article 82). Product liability is changing too. EU Directive 2024/2853 expressly treats software as a product, and member states must transpose it by 9 December 2026. A company that makes software and places it on the market will then be liable for damage caused by defects regardless of fault, as a machine manufacturer already is. Check whether your policy names product liability for software and not only for hardware you deliver. ## What is covered - The client's pure financial loss caused by programming errors and defective software - Errors in consulting, analysis, design, implementation and training - Loss, deletion or corruption of client data, including the cost of restoring it - Losses from delay and missed deadlines, depending on the wording - Infringement of copyright, trade mark, name and licence rights - Breaches of data protection law and confidentiality duties - Passing malware on to clients and third parties - Bodily injury and property damage from your office and from work on client premises - Defence against unfounded claims, including in court - Your liability to the client for mistakes made by freelancers and subcontractors ## What is not covered - Rework, redelivery and replacement of your own service - Knowing breaches of duty and deliberate deviation from the client's instructions - Contractual penalties and guarantees unless expressly included - Exceeded cost estimates and budgets - Damage to your own business after a cyber attack, which belongs in a cyber policy - Circumstances and breaches already known when the policy was taken out - Fines, as far as the law does not allow them to be insured - Claims under US or Canadian law unless agreed ## Who needs it - Software companies and agencies building custom software, apps or online shops - Freelance developers and consultants on client projects, including through agencies - System integrators and administrators looking after client networks and servers - Providers of hosting, cloud services and software as a service - IT consultants, external data protection officers and project managers ## Who does not need it - Employed developers who work only for their employer and run no business of their own - Pure hardware resellers without installation or advice, where general and product liability usually suffice ## What it costs Premiums are almost always based on annual turnover and the type of work. For solo freelancers with modest turnover, intermediaries quote premiums from roughly EUR 200 a year, rising to several hundred euros with higher limits and turnover. For software companies with staff, hosting or US business there is no rule of thumb, because the underwriter assesses the individual risk. **What drives the premium:** - Annual turnover, or planned turnover for a new business - Type of work: consulting, development, operations, hosting, hardware - Limit for financial loss and annual aggregate - Deductible per claim - Share of turnover with clients in the USA and Canada - High severity fields such as payments, medical or industrial control systems - Add-ons such as first party loss, contractual penalties or cyber _These figures come from published information by intermediaries and are snapshots. Your premium is fixed only in the quote we obtain on the basis of your actual work._ ## The policy levels on the market - **General liability with an extension:** A classic business policy in which pure financial loss runs along with a small sublimit only. Delay, rights infringement and data loss are often narrowly defined. Usually too thin for IT services. - **IT liability with open cover:** Financial loss and general liability in one contract, covering all IT activities and not just a list. Limits from EUR 500,000 for financial loss. The right starting point for freelancers and small software firms. - **IT liability with add-ons:** Higher limits, worldwide territory, sublimits for contractual penalties and assumed liability, plus first party and cyber modules. For providers with hosting, corporate clients or business abroad. ## How to recognise a good policy | Criterion | Minimum standard | Strong policy | Why it matters | | --- | --- | --- | --- | | Limit for financial loss | EUR 250,000 | EUR 1 million or more, available at least twice a year | A client's lost revenue after a faulty release can exceed the contract value many times over. | | Open description of activities | list of insured IT services | all IT activities insured, new ones provisionally included | Your business changes faster than your policy, and under a list anything not named is uninsured. | | Delay and wasted expenditure | excluded | expressly covered, also after the client terminates | Projects fail over deadlines more often than over a single bug. | | Assumed liability and penalties | statutory liability only | sublimit for penalties, guarantees and indemnities | Framework agreements of large clients routinely go beyond the law. | | Client data loss | covered, reduced if the client had no backup | covered without a backup condition | After a loss it is often impossible to establish whether the client backed up properly. | | Rights infringement | copyright and trade marks | also open source licence terms, data protection and confidentiality | Cease and desist letters over images, fonts and libraries land on whoever delivered the project. | | Territory | Europe | worldwide, USA and Canada by agreement | Clients with North American subsidiaries bring that law with them. | | Retroactive cover and extended reporting | breaches during the policy period only | unknown earlier breaches included, long reporting period after the policy ends | Software defects often surface years after acceptance. | ## Insurers on the German market Dedicated IT wordings mainly come from insurers with a strong professional indemnity book, alongside specialty insurers from other European countries. The list below describes the German market; it says nothing about which insurers we work with. - **Markel**: specialty insurer based in Munich, broker distribution only - **HDI**: part of the Talanx group, focus on small business and professions - **AXA**: commercial lines through agents and brokers - **ERGO**: part of the Munich Re group, sold through agents and brokers - **Allianz**: packages for many sectors, sold through agents and brokers - **Gothaer**: mutual group, commercial lines through agents and brokers - **R+V**: insurer of the German cooperative banks 129 insurers supervised by BaFin, the German regulator, are licensed for this class of insurance. (Allgemeine Haftpflicht, Finanzielle Verluste, Berufsrisiken). Source: BaFin company database, 2026-09-18; EU insurers without a German office excluded. ## Typical claims and who pays - **Update wipes the client database** (often five figures, more if downtime is long): Restoration and the client's lost revenue are the core case. Basic wordings reduce the payout if the client had no backup of its own. - **Shop goes live three weeks late** (the client's lost revenue): This is a loss from delay. Many wordings exclude missed deadlines, stronger ones cover them expressly. - **Interface posts every order twice** (extra costs and reversals at the client): A coding error causing pure financial loss at the client. This is what IT liability is designed for. - **Client wants the code redone for free** (your own working time): Rework is performance of the contract. No policy pays for your own service a second time. - **Legal letter over a font in the project** (legal fees and licence damages): Infringed rights are not insured to the same extent everywhere. Strong wordings also name open source licences. - **Ransomware locks your own server** (forensics, restoration, downtime): This is a first party loss. It belongs in a cyber policy or an add-on, liability cover alone does not pay it. ## Myth or truth - „German law requires software developers to hold IT liability insurance." ✘ False, there is no statutory duty. The requirement arises in contracts, because many clients and agencies ask for a certificate. - „A German business liability policy pays my client's lost revenue after a software bug." ✘ False, that is a pure financial loss without injury or property damage, which the standard policy excludes. - „The insurer also defends me against claims that are unfounded." ✔ True, assessing liability and defending unjustified claims is part of the cover, including lawyers and court costs. - „I am liable to my client for my subcontractor's mistakes." ✔ True, the client turns to its contracting partner. Good wordings insure this liability, but the subcontractor should still show cover of its own. - „With cyber insurance I no longer need IT liability." ✘ False, cyber cover generally requires a security incident. An ordinary coding or consulting error without an attack is a matter for IT liability. ## Common mistakes - Buying a plain business liability policy and assuming financial loss is included - Choosing the limit by contract value and not by the loss a client could suffer - Signing penalties and indemnities without checking the policy - Adding hosting, operations or AI development and not telling the insurer - Treating IT liability and cyber insurance as the same thing - Assuming a policy from your home country automatically responds to German contracts ## FAQ ### Is IT-Haftpflicht the same as tech E&O or professional indemnity? In substance, yes: it covers financial loss a client suffers because of your professional error. German policies usually add general liability for injury and property damage in the same contract. Wordings are not standardised, so compare the clauses, not the product name. ### What is the difference between IT liability and cyber insurance? IT liability pays for harm your professional mistake causes to clients and third parties. Cyber insurance mainly pays for damage to your own business after an attack or data breach, such as forensics, restoration and lost income. If you run systems for clients you will usually want both. ### Does it pay if I miss a deadline? That depends on the wording. Better policies cover losses from delay expressly, others exclude missed deadlines. An agreed contractual penalty is a separate matter and only insured if it is specifically included. ### Will the insurer pay for fixing my software? No. Correcting your own work is performance of the contract and no policy covers it. Insured is the loss the defect causes at the client, such as lost revenue, extra costs or data restoration. ### What limit do I need as a freelancer? Start with what your clients require in the contract. Limits for financial loss between EUR 500,000 and EUR 3 million are common. Very cheap tariffs sometimes offer only EUR 50,000 to 100,000 for IT financial loss, which is not enough for project work with larger clients. ### I trade through a GmbH or UG. Do I still need it? Yes. The company limits liability to its own assets but does not protect those assets. A large claim without insurance ends in insolvency, and clients ask for the certificate whatever your legal form. ### Can I get a certificate in English? The confirmation of cover is issued in German. Whether an English version is available depends on the insurer, so ask before you commit. The policy wording itself is in German and that version is binding. We explain the relevant clauses in English. ### Are past projects covered? Only if the policy includes retroactive cover for unknown earlier breaches. Depending on the wording, either the date of the mistake or the date of the claim decides. This matters most when you switch insurers or move your business to Germany. ### Is work with artificial intelligence insured? Under an open description of activities generally yes, and some wordings now name the development and use of AI expressly. Under a list of insured services you should ask and have the activity added. ### Why use a broker in Germany? Because very different wordings are sold under the same name, and they are in German. We match your work and your client contracts against the policies, watch for delay, penalties and retroactive cover, and support you when a client makes a claim. ## Legal basis and sources - [Insurance Contract Act (VVG, German)](https://www.gesetze-im-internet.de/vvg_2008/) - [BaFin company database (licensed insurers)](https://portal.mvp.bafin.de/database/InstInfo/) ## Request quotes We obtain quotes and come back with a comparison, free of charge. You can write in English. https://www.nammert.com/en/insurance-broker-it-liability.php#anfrage --- Your broker: Norman Nammert, trading as NAMMERT. Insurance broker licensed under section 34d(1) of the German Trade Regulation Act. Broker register no. D-C08Q-TOSD4-37. NAMMERT Assekuradeur GmbH is a separate company. It does not arrange your contract. NAMMERT Assekuradeur GmbH, Karl-Marx-Straße 4, 15711 Königs Wusterhausen, +49 3375 29 12 77, info@nammert.com. Wikidata: Q141141479.